A Social Media Policy for Employees is a workplace document that sets out the standards of conduct expected of employees, workers, and contractors when using social media, both in a professional capacity and on personal accounts where their conduct may affect the employer. In England and Wales, employers face a complex web of legal obligations that intersect with social media use, making a clearly drafted Social Media Policy an essential element of modern workforce management.

The policy operates at the intersection of employment law, data protection law, defamation law, and criminal law. The Employment Rights Act 1996 requires employers to make clear the disciplinary standards expected of employees and the consequences of breaching them. The Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) impose obligations on employers to prevent unauthorised disclosure of personal data, including disclosure via social media. The Equality Act 2010 imposes vicarious liability on employers for harassment committed by their employees, including harassment via social media. The Defamation Act 2013 makes individual employees personally liable for defamatory statements published on social media. The Computer Misuse Act 1990 criminalises unauthorised access to computer systems, including social media accounts.

A Social Media Policy typically addresses two distinct contexts. The first is professional use: the management of official company social media accounts, including who is authorised to post, what approval processes must be followed, what content standards apply, and how complaints and negative comments should be handled. The second is personal use: the standards expected of employees when using their own personal social media accounts, particularly where posts identify the individual as an employee of the organisation or where posts could affect the employer's reputation, its clients, or its colleagues.

The ACAS guidance on social media in the workplace, published by the Advisory, Conciliation and Arbitration Service, recommends that employers develop a dedicated Social Media Policy that is clearly communicated to all employees and consistently enforced. ACAS guidance notes that social media-related disciplinary cases have increased significantly in recent years, and that employers without a clear policy are at a substantial disadvantage when defending Employment Tribunal claims arising from social media disputes.

Every employer in England and Wales that employs staff should have a Social Media Policy, regardless of the size of the organisation or the sector in which it operates. The need for a Social Media Policy has become more acute as social media platforms have proliferated and as the boundary between personal and professional life has become increasingly blurred in the digital age.

You need a Social Media Policy if your organisation uses social media for marketing, communications, or customer engagement. Official company accounts on platforms such as LinkedIn, Facebook, Instagram, Twitter/X, YouTube, or TikTok create legal and reputational risks that must be managed through clear governance structures. Designating who can post, what approval processes must be followed, and what content standards apply is essential to prevent inadvertent disclosure of confidential information, breaches of advertising standards, copyright infringement, or defamatory publication.

You need a Social Media Policy if your employees use social media for any work-related purpose. Even employees who do not have responsibility for official company accounts may use LinkedIn to represent the organisation professionally, discuss work matters on Twitter/X or Facebook, or use social media to communicate with clients or colleagues. Each of these activities creates risk that must be managed through a policy that clearly delineates acceptable and unacceptable conduct.

You need a Social Media Policy if you have experienced or wish to prevent social media-related incidents. These include: an employee posting derogatory or discriminatory comments about a colleague, competitor, or client; an employee disclosing confidential business information or client data on social media; a former employee continuing to access company social media accounts after their employment has ended; an employee publishing defamatory statements that expose the company to reputational and legal risk; or an employee accessing a colleague's social media account without authorisation, potentially in breach of the Computer Misuse Act 1990.

You need a Social Media Policy if you wish to monitor employee use of IT systems. Under the Regulation of Investigatory Powers Act 2000 and the UK GDPR, employees must be informed of any monitoring before it takes place. A Social Media Policy provides the appropriate notice to employees and forms part of the lawful basis for monitoring under the UK GDPR's legitimate interests ground.

The Employment Tribunal has upheld social media-related dismissals in a wide range of circumstances, but only where the employer can demonstrate that the employee was on clear notice of the standards expected and the potential consequences of breaching those standards. A Social Media Policy provides that notice.

A well-drafted Social Media Policy for Employees in England and Wales should contain several essential components that address the principal legal risks and workplace scenarios.

The scope clause defines which individuals the policy applies to (employees, workers, contractors, agency staff) and which activities it covers (use of social media on company equipment, during working hours, and on personal accounts where conduct affects the employer). Limiting the scope to working hours only is no longer sufficient given that Employment Tribunals regularly uphold dismissals for out-of-hours social media conduct where the posts affect the employment relationship.

The personal use section addresses the employer's position on employee use of personal social media accounts during working hours — whether this is prohibited, limited to breaks only, or unrestricted subject to productivity obligations — and sets out the conduct standards that apply to personal social media activity at all times.

The company accounts section identifies who is authorised to post on official company accounts, sets out the approval process for content before publication, specifies the content standards that apply, and addresses the transfer of account credentials when an authorised user leaves their role.

The prohibited content clause is one of the most legally important elements of the policy. It should expressly identify the types of content that are prohibited, with specific reference to the relevant legislation: discriminatory content contrary to the Equality Act 2010; defamatory content contrary to the Defamation Act 2013; content disclosing confidential information or personal data without a lawful basis; and content that involves unauthorised access to computer systems contrary to the Computer Misuse Act 1990.

The confidentiality clause reinforces the employee's contractual confidentiality obligations in the social media context and makes clear that these obligations survive termination of employment. Reference to the employee's contract of employment and any separate non-disclosure agreement is important to create clear linkage.

The monitoring clause informs employees of the employer's right to monitor social media use on company IT systems, the legal basis for monitoring, and the proportionate approach the employer will take. This is essential to comply with the Regulation of Investigatory Powers Act 2000 and the UK GDPR requirement to inform data subjects of processing activities.

The data protection clause reinforces UK GDPR obligations in the social media context: employees must not share personal data of clients, employees, or third parties on social media without a lawful basis, and must not publish photographs or videos featuring identifiable individuals without consent.

The disciplinary consequences clause sets out the potential sanctions for breach of the policy, up to and including summary dismissal for gross misconduct. This section must be aligned with the employer's formal Disciplinary Procedure and the ACAS Code of Practice, and should identify specific examples of gross misconduct in the social media context to give employees clear guidance.

The responsibilities section allocates accountability across different levels of the organisation: all employees, line managers, the policy owner, and senior management. This allocation of responsibility is essential for demonstrating to an Employment Tribunal that the employer took all reasonable steps to prevent policy breaches.