Writing a Social Media Policy for Staff

Your team is on social media every day, and sometimes they talk about work. A clear, fair social media policy helps everyone know what is fine, what is not and who speaks for the business, without turning you into the fun police. This guide walks you through what to include, what to leave out and a template you can adapt for a small team.

Colorful blocks arranged together, each printed with a different social and messaging app icon — Every app your team uses is a place where your business might come up.

Key takeaways

A good social media policy covers two things: running official business accounts and how staff talk about work on their personal accounts.
Keep it short, plain and focused on real risks: confidential information, customer privacy, harassment and who speaks for the business.
In the US, the National Labor Relations Act protects employees discussing pay and working conditions, so do not ban that.
Employment law varies by country, so have a qualified professional review your final policy.
Explain the policy, train on it and review it once a year.

In a small business, social media is everywhere. Your barista posts latte art, your stylist shares before-and-after photos, your warehouse assistant jokes about a busy week, and someone on the team might be running the official account between other tasks. Most of the time this is great. It shows real people behind the brand.

Problems start when nobody knows where the lines are. A customer's photo is posted without permission. A frustrated employee vents about a named client. A team member replies to a complaint on the business account in a way that makes things worse. A social media policy will not prevent every mistake, but it gives everyone a shared, reasonable starting point.

A quick note: this is general information, not legal or employment advice. Rules on employee speech, privacy and monitoring vary between the US, UK and EU countries, and between states. Ask an employment lawyer or HR professional to review your policy before you roll it out.

What a social media policy is for

A social media policy is a short document that sets expectations for how people connected to your business use social platforms. For a small team, it usually has two parts.

Official accounts. Who can post on behalf of the business, how passwords and access are handled, the tone to use and how to deal with comments, complaints and messages.
Personal accounts. How staff should handle work-related topics on their own profiles, such as confidentiality, customer privacy and making clear when an opinion is their own.

The goal is to protect customers, colleagues and the business while respecting that employees have their own lives and their own rights. A policy that tries to control everything people say online tends to be ignored, resented or unlawful.

Know the legal limits before you write

Social media policies are an area where well-meaning employers often go too far. A few principles help you stay on safe ground.

United States

The National Labor Relations Act protects employees who discuss pay and working conditions with each other, including on social media. That applies to most private-sector employees, whether or not there is a union. Rules such as "never say anything negative about the company online" or "do not discuss your salary" can conflict with these protections. Your policy should focus on specific harms, like sharing trade secrets or harassing coworkers, rather than broad bans on criticism. Some states also have their own rules on topics like off-duty conduct or employer access to personal accounts, so check what applies to you.

UK and EU

Employees have rights to privacy and to freedom of expression, balanced against an employer's legitimate interests. Data protection rules under GDPR (and UK GDPR) apply when you handle personal data, including any monitoring of staff or posting of customer information. If you plan to monitor work accounts or devices, be transparent about it and check that it is proportionate. Make sure your policy ties into your disciplinary procedure so any action is fair and consistent.

Common mistake

Copying a policy from a large company or a random template online. Big-company policies often contain clauses that do not fit your size, your country or your team, and some include broad bans that would not hold up. Start from your own real risks and get a professional to check the final wording.

What to include in your policy

A practical small-business policy fits on two to three pages. Cover these sections in plain language.

Purpose and scope. One short paragraph on why the policy exists and who it covers: employees, contractors, interns or anyone with access to business accounts.
Official account access. Who can post, how logins are stored (ideally in a shared password manager, with two-factor authentication on) and what happens to access when someone leaves.
Brand voice and approvals. The tone you want, what needs approval before posting (offers, announcements, anything sensitive) and who approves it.
Confidential information. What counts as confidential in your business, such as unreleased products, supplier terms, financial details or internal documents, with clear examples.
Customer privacy and permissions. Never post customer details, and get permission before sharing photos or posts that show customers or their property.
Respect and harassment. Harassment, discrimination and bullying are not acceptable online any more than they are at work, including toward coworkers, customers and suppliers.
Personal accounts and disclosure. If staff talk about your products, they should make the connection clear. Opinions should be their own unless they are authorized to speak for the business.
Handling complaints and media. Who responds to complaints, press questions and anything that looks like a crisis, and what everyone else should do (usually: pass it on, do not reply).
Protected rights statement. A clear line saying nothing in the policy restricts employees' legal rights, including discussing pay and working conditions where the law protects that.
Breaches and questions. How concerns are handled, linked to your normal disciplinary process, and who to ask when unsure.

Pro tip

Add a short "when in doubt" rule, such as: "If you would not say it out loud in front of a customer and your manager, do not post it." Simple rules are remembered long after the full document is forgotten.

Close-up of a phone screen showing a grid of social media and messaging app icons — Personal phones and business accounts often live side by side, so clear lines help everyone.

What to leave out

A shorter, fairer policy is usually a stronger one. Avoid these common overreaches:

Blanket bans on criticism. As above, broad "no negative comments" rules can conflict with employee protections, especially in the US.
Requests for personal passwords. Do not ask staff for logins to their personal accounts. Keep business and personal accounts separate.
Forced friending or following. Requiring staff to follow, share or promote the business from personal accounts can feel intrusive. Invite, do not require.
Vague words without examples. "Inappropriate" and "unprofessional" mean different things to different people. Give concrete examples.
Rules you will not enforce. If you ban phones on shift but use them yourself, the whole policy loses credibility.

A social media policy template for small teams

Use this table as the skeleton of your policy. Fill in one row per section and turn the "Our rule" column into short paragraphs. The rows below are examples only.

Section	Our rule (example wording)	Example to include	Owner
Official account access	Only named team members post on business accounts. Logins live in our shared password manager with two-factor authentication.	Access is removed on someone's last day.	Owner
Customer privacy	Never post customer names, contact details or bookings. Ask before sharing any photo that shows a customer.	Ask: "Is it okay if we share this on our page?" and note the yes.	Everyone
Complaints and media	Pass complaints and press questions to the manager. Do not reply from personal accounts.	Forward a screenshot to the team chat with the link.	Manager

Add rows for confidentiality, respect and harassment, personal accounts and your protected rights statement. Date the policy and note when it will next be reviewed.

Hypothetical example

Imagine Amara, who runs a hair salon with six stylists. Her old "policy" was a single line in the handbook: "Do not post anything bad about the salon." After a stylist shared a client's photo without asking, Amara wrote a two-page policy. It covers who runs the salon's accounts, a rule to ask clients before posting their hair photos and note their answer in the booking system, a ban on sharing client details, and a clear statement that staff can discuss pay and conditions. She removed the old line, walked the team through the new policy at a staff meeting and asked for feedback. Two stylists suggested a simple consent card at the mirror, which she added.

Roll it out, train and review

A policy that sits in a folder does not change behavior. Introduce it properly.

Explain the why. Walk the team through it in a short meeting. Focus on protecting customers and colleagues, not on catching people out.
Ask for input. Staff who use social media every day often spot gaps or unrealistic rules.
Get written acknowledgment. Ask everyone to confirm they have read it, and add it to your onboarding pack for new starters.
Train the account managers. Anyone posting for the business needs a bit more: tone, approvals, complaint handling and what to do in a crisis.
Review yearly. Platforms, laws and your team change. Put a review date in the calendar, perhaps alongside your midyear planning.

Your social media policy action plan

List the real social media risks for your business
Decide who can post on official accounts and secure the logins
Write sections on confidentiality, privacy, respect and personal accounts
Add a clear statement protecting employees' legal rights
Remove broad bans, vague words and rules you will not enforce
Have an employment professional review the draft
Present it to the team, gather feedback and collect acknowledgments
Add it to onboarding and set a yearly review date

Frequently asked questions

Can I discipline an employee for something they posted on a personal account?

Sometimes, for example if it reveals confidential information or harasses a coworker. But some speech is legally protected, such as discussing pay and working conditions in the US. Each case depends on the facts and local law, so take advice before acting.

Do I need a social media policy if I only have two or three staff?

A short one is still worth having, especially if anyone other than you posts on business accounts or shares photos of customers. Even a single page sets clear expectations and saves awkward conversations later.

Should staff be allowed to use social media during work hours?

That is a business decision, and it belongs in your general workplace rules as much as in a social media policy. Many small businesses allow reasonable personal use on breaks and ask staff to keep phones away when serving customers.

The bottom line

A good social media policy for staff is short, specific and fair. Cover official account access, confidentiality, customer privacy, respect and who speaks for the business, and leave out blanket bans that clash with employees' rights. Get the draft checked by a professional, explain it to your team and review it once a year.

Start this week by listing the three biggest social media risks in your business. Turn each one into a clear rule with an example, and you will already have the heart of your policy.