Social Media Policy (Hong Kong)

A Social Media Policy in Hong Kong documents the organisation's approach and the obligations placed on those it covers.

Hong Kong's legal environment creates particular risks for organisations whose employees use social media carelessly. The Defamation Ordinance (Cap. 21) provides that publishing a false statement of fact that damages another person's reputation is actionable — and social media posts constitute publications for defamation purposes. An employer may face vicarious liability for defamatory posts made by employees in the course of their employment. The 2021 PDPO amendment criminalised doxxing — the disclosure of personal data without consent with intent to cause harm — with penalties of up to HK$1,000,000 and five years' imprisonment, enforced by the Office of the Privacy Commissioner for Personal Data (PCPD).

The policy covers two distinct spheres: official company social media accounts managed by designated employees (such as the marketing or communications team), and personal employee accounts where posts may identify the employee's connection to the employer or disclose confidential information. Both spheres require separate but complementary guidance.

For official accounts, the policy addresses authorised users, content standards, approval workflows, compliance with the Trade Descriptions Ordinance (Cap. 362) for product claims, and crisis communication protocols. For personal accounts, the policy sets boundaries around confidential information, client data, colleagues' personal data, defamatory statements, and political commentary that could embarrass the organisation.

A Social Media Policy is a standalone document that complements — but does not replace — an Acceptable Use Policy (which governs IT systems broadly) and a Code of Conduct (which addresses general behavioural standards). Forms Legal provides a free Hong Kong Social Media Policy template, covering all key legal risks and compliant with the PDPO and Employment Ordinance (Cap. 57). Available as PDF and Word download.

The ubiquity of social media in Hong Kong — with platforms including Facebook, Instagram, LinkedIn, YouTube, Twitter/X, Xiaohongshu, WeChat, and WhatsApp used daily by the majority of Hong Kong's working population — means that every organisation faces social media risk on an ongoing basis. A documented, communicated, and enforced Social Media Policy is the primary tool for managing these risks, demonstrating to regulators and courts that the organisation has taken reasonable steps to prevent harm from employee social media activity.

From a regulatory perspective, Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) governs the collection and use of personal data on social media platforms operated by organisations. The Office of the Privacy Commissioner for Personal Data (PCPD) has issued guidance on the use of social media for marketing and employee monitoring. The Employment Ordinance (Cap. 57) is relevant where social media policies impose obligations on employees — policies that unreasonably restrict employees' personal activities outside working hours may be challenged as a breach of employment terms or as constructive dismissal.

Every Hong Kong organisation with employees needs a Social Media Policy. Given that virtually every employee in Hong Kong uses social media personally, and many interact with customers, partners, and the public through company social media channels, the absence of a policy creates significant unmanaged legal and reputational risk.

Organisations managing official social media accounts: Any Hong Kong company, NGO, educational institution, or public body that maintains a presence on platforms such as Facebook, Instagram, LinkedIn, YouTube, Twitter/X, Xiaohongshu, or WeChat needs a policy that defines who is authorised to post, what content standards apply, and how to handle complaints, crises, and negative comments.

Regulated financial institutions: Banks, securities firms, insurance companies, and MPF trustees regulated by the Hong Kong Monetary Authority (HKMA), Securities and Futures Commission (SFC), or Insurance Authority (IA) face additional obligations regarding social media communications. The SFC's guidelines on marketing materials and the HKMA's supervisory requirements for internet banking and digital communications apply to social media content. A Social Media Policy for regulated entities must address compliance with these additional requirements.

Organisations handling sensitive personal data: Healthcare providers, schools, social welfare organisations, and other entities that handle sensitive personal data about clients or service users need a Social Media Policy that specifically addresses the prohibition on disclosing such data on social media, consistent with the PDPO (Cap. 486) and the 2021 doxxing amendments.

Employers following disciplinary proceedings: When an employer needs to discipline or dismiss an employee for social media misconduct, a clear written Social Media Policy that was communicated to the employee is essential for demonstrating that the conduct was a breach of known rules. Under Section 9 of the Employment Ordinance (Cap. 57), summary dismissal is available for serious misconduct — a clear policy supports the employer's position.

Organisations onboarding new employees: A Social Media Policy should be provided to every new employee as part of the onboarding pack, signed as part of the employment documentation. Annual refresher training on the policy's key requirements helps maintain awareness and reinforces the employer's diligence.

Professional services firms: Solicitors, barristers, accountants, and other professionals in Hong Kong are subject to professional conduct rules that restrict advertising and self-promotion. A Social Media Policy for professional firms must address compliance with the Law Society of Hong Kong's guidelines on marketing, as well as the general prohibitions on client confidentiality breaches and misleading statements about services or qualifications.

A Hong Kong Social Media Policy must address all legally significant risk areas to protect the organisation and provide employees with clear, actionable guidance. Forms Legal's template covers the following essential elements.

Scope and application: Which employees are covered (all employees, contractors, temporary staff, directors); which social media platforms and channels are addressed (professional platforms such as LinkedIn, consumer platforms such as Facebook, Instagram, and Xiaohongshu, messaging platforms such as WhatsApp and WeChat, and video platforms such as YouTube and TikTok); and whether the policy applies only during working hours or also to out-of-hours personal use.

Official company accounts: The identity of authorised account administrators; the content approval process for posts on official accounts; content standards (accuracy under the Trade Descriptions Ordinance Cap. 362, no defamation, no copyright infringement, brand voice consistency); credential security and handover procedures when an authorised person leaves; and the process for responding to comments, complaints, and crisis situations.

Personal account guidelines: The rules for personal social media use that may affect the employer — including the requirement to include a disclaimer that personal views are the employee's own; the prohibition on disclosing confidential business information; the prohibition on posting personal data of colleagues, clients, or others without consent (PDPO Cap. 486 compliance); and the prohibition on defamatory, discriminatory, or harassing content.

Confidentiality obligations: A clear statement that the employee's duty of confidence under Hong Kong common law extends to social media activity. Examples of confidential information that must not be disclosed: client names and transaction details, financial results before publication, personnel matters, and business strategies.

Data protection and doxxing: Specific reference to the Personal Data (Privacy) Ordinance (Cap. 486) and the doxxing offences under Section 64 introduced in 2021. Employees must not post personal data (including names, HKID numbers, addresses, photographs, or employment details) of identifiable individuals without consent. The PCPD has criminal investigation powers for doxxing offences.

Copyright compliance: Employees must not share copyrighted material — including articles, photographs, videos, music, and graphics — without permission from the copyright owner, consistent with the Copyright Ordinance (Cap. 528). Safe use of Creative Commons licensed material and embedding (rather than downloading and re-posting) should be addressed.

Monitoring: Whether the organisation monitors employees' public social media activity; the legal basis for any monitoring; and how monitoring findings may be used in disciplinary proceedings, consistent with the PDPO.

Breaches and disciplinary action: The disciplinary consequences of breaching the policy, ranging from a formal warning to summary dismissal for serious breaches. Reference to the Employment Ordinance (Cap. 57) disciplinary framework and the right of the employee to respond before action is taken.

Record keeping: Whether social media posts on official accounts constitute business records that must be archived; the retention period for such records; and the procedure for preserving social media records when they may be relevant to litigation or regulatory proceedings. Courts in Hong Kong have admitted social media posts as evidence in defamation, employment, and commercial litigation proceedings under the Evidence Ordinance (Cap. 8). The Electronic Transactions Ordinance (Cap. 553) confirms that electronic records, including social media posts and messaging platform communications, are admissible as evidence.

Regulatory compliance for licensed entities: Organisations regulated by the Securities and Futures Commission (SFC) under the Securities and Futures Ordinance (Cap. 571), or by the Hong Kong Monetary Authority (HKMA), must requires social media communications comply with applicable guidelines on advertising and marketing of financial products. The SFC's Code of Conduct and the HKMA's supervisory circulars address digital communications standards. Insurance intermediaries regulated by the Insurance Authority under the Insurance Ordinance (Cap. 41) face similar constraints on social media marketing.

Crisis communications protocol: The designated spokesperson authorised to post on behalf of the organisation during a reputational crisis or emergency; the approval chain for emergency posts; and the procedure for correcting misinformation circulating on social media about the organisation. Hong Kong's fast-moving media environment — with platforms including RTHK, TVB, Now TV, and major print media all operating active social media accounts — means that a crisis can escalate rapidly without a documented response protocol. The forms-legal.com Social Media Policy (Hong Kong) template covers the mandatory elements under the Personal Data (Privacy) Ordinance (Cap. 486), the Defamation Ordinance (Cap. 21), and the Employment Ordinance (Cap. 57) section 9 summary dismissal provisions.