Social Media Policy Template
What staff may and may not post about the company, and who speaks for it.
Details
social media policy templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
| Applies to | [who it applies to] |
| Policy owner | [owner] |
| Effective from | October 14, 2026 |
| Next review | [date] |
1. Why this policy exists
Anything posted about this organization in public is read as coming from it, whether or not that was intended. This policy sets out what is expected so that people can post confidently rather than not at all.
2. What you should do
[add one expectation per line]
3. What you must not do
[add one prohibition per line]
4. Who may speak for the organization
[named roles only]. Anyone else approached for comment should pass the enquiry on rather than answer it.
5. Your own accounts
What you post on your own account in your own time is your business. It stops being your business alone when it identifies this organization, names a customer or colleague, or discloses something you only know because you work here.
6. If something goes wrong
[what to do, and who to tell]
What is a Social Media Policy?
A social media policy sets out what staff may post about the organisation, who may speak on its behalf, and what happens when the line is crossed. It matters at the moment something goes wrong: without a written standard that people have seen and acknowledged, an employer trying to act on a damaging post is arguing about a rule that was never stated, which is a weak position in almost any employment forum.
Employers of every size use one, along with schools, hospitals, councils, charities and regulated firms where confidentiality obligations are stricter. It is normally owned jointly by human resources and communications, issued in the onboarding pack, and revisited after an incident or before a campaign that will put staff in front of an audience. It also covers the practical questions that arise constantly — whether an employee may name the employer in a personal profile, who holds the passwords, and what happens to a work account when the person who ran it leaves.
How far a policy may reach into private conduct is limited by employment law, and the limits differ. In the UK a dismissal must be fair under the Employment Rights Act, with private life protections in play; in the United States the National Labor Relations Act protects concerted activity about pay and working conditions in most private workplaces, and several states restrict employers demanding access to personal accounts; in India certified standing orders and the IT Act are relevant; in Australia the Fair Work Act's adverse action provisions apply; across the EU, GDPR constrains monitoring of employees. Have the draft reviewed by an employment lawyer where you operate.
A policy does not give the employer a right to monitor private accounts or demand passwords, and asserting one in writing can create liability rather than reduce it. It does not override statutory whistleblowing protections, trade union rights or protected disclosures. It does not make dismissal automatic — the disciplinary procedure still applies, with its usual investigation and appeal. It is also not a security policy or a crisis communications plan, and it will not tell anyone what to do at eight o'clock on a Sunday unless you write that part separately.
What to put in a Social Media Policy
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Issuing organisation | For example: Maple Grove Homeowners Association |
| Organisation address | For example: 1420 Kinnear Road, Columbus, OH 43212 |
| Who this applies to | For example: All employees, contractors and anyone posting on a company account |
| Next review | Free text |
| Policy owner | For example: Head of People |
| What you should do | One per line |
| What you must not do | One per line |
| Who may speak for the company | For example: The Managing Director and the Marketing Manager only |
| What to do when something goes wrong | For example: Do not delete the post. Screenshot it, send it to the marketing team the same day, and… |
| If the policy is not followed optional | For example: Unapproved absence may be treated as unauthorised and dealt with under the disciplinary… |
How to write a Social Media Policy
Define which accounts the policy covers
Separate three categories in plain terms: official accounts the organisation owns, work-related accounts an individual runs as part of their role, and purely personal accounts. State that ownership of official and work-related accounts, including handles and passwords, rests with the organisation and that access is returned on leaving. Say explicitly how the personal category is treated, because that is the boundary most disputes turn on.
Name who may speak for the organisation
List the roles authorised to make public statements, respond to media enquiries and comment on incidents — usually communications, named executives and designated specialists. Everyone else should have one instruction: pass it on, do not respond. Add what to do when a journalist or an angry customer contacts someone directly, including the internal number to ring, so the default is escalation rather than improvisation.
Set the confidentiality line with examples
‘Do not post confidential information’ is not usable guidance, because nobody thinks their post is the exception. Give a concrete list for your organisation: unreleased products and launch dates, client names, pricing, tender activity, financial results before publication, patient or student information, security arrangements, photographs taken inside restricted areas, and screenshots of internal systems. Examples are what make a policy enforceable at a disciplinary hearing.
Say what happens when something goes wrong
Give the escalation route: who to tell, how quickly, and what not to do in the meantime — usually do not delete, do not argue publicly, do keep a screenshot. Name who decides on removal or a public response. Staff who have been told in advance not to engage generally do not, which converts most incidents into something handled in the morning rather than overnight.
Get it acknowledged and review it
Issue the policy through a route that records receipt — a signature, an onboarding system, a training module — because an unacknowledged policy is difficult to rely on later. Put a review date on the document and keep it, since platforms, features and employment case law all move. Reissue it whenever it changes materially rather than assuming the version signed three years ago still applies.
Common mistakes
- Banning employees from mentioning the employer at all, which is unenforceable in practice and, in several jurisdictions, unlawful where it catches discussion of pay and working conditions.
- Failing to name a person to escalate to, so an employee ends up arguing with a customer publicly at eleven at night because nobody told them what else to do.
- Saying nothing about personal accounts that identify the employer in a bio, which is exactly where most reputational incidents actually begin.
- Setting out rules without stating the consequences or linking to the disciplinary procedure, which produces inconsistent sanctions and a weak defence to an unfair dismissal claim.
- Issuing the policy once with no record of acknowledgement and never revisiting it, leaving you enforcing a document employees can credibly say they never saw.
Frequently asked questions
What should a social media policy include?
Scope covering official, work-related and personal accounts, who is authorised to speak publicly, a concrete confidentiality list, expected conduct including harassment and discrimination, disclosure requirements when staff endorse the employer's products, the escalation route for incidents, account ownership and handover on leaving, the consequences of breach, and a review date. Examples matter more than principles.
Can an employer dismiss someone for a social media post?
It depends on the post, the harm, the policy and the process, and the tests differ by country. Fairness under UK employment law, protected concerted activity under the US National Labor Relations Act, and the Australian Fair Work Act's provisions all constrain it. A clear policy, an acknowledgement record and a proper investigation matter more than the content of the post alone. Take specific cases to an employment lawyer.
Does a social media policy apply to personal accounts?
It can reach conduct on personal accounts where there is a genuine connection to the workplace — disclosing confidential information, harassing a colleague, or posting in a way that identifies the employer and damages it. It cannot reasonably regulate private life with no work connection, and attempting to do so tends to make the whole policy harder to enforce. Draw that line explicitly.
Do employees have to sign a social media policy?
There is usually no legal requirement to obtain a signature, but a recorded acknowledgement is what allows an employer to show the standard was communicated. Most organisations issue it with the contract or through an onboarding system that logs completion. Whether the policy forms part of the contract or sits outside it is a drafting decision worth taking advice on.
How often should a social media policy be updated?
Review annually as a minimum, and immediately after an incident, a significant platform change, or a change in employment or data protection law where you operate. Policies referring to platforms that have been renamed or features that no longer exist are read as unmaintained, which undermines the parts that still matter. Record the review date on the document itself.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.