Social Media Policy (New Zealand)

A Social Media Policy in New Zealand sets the organisation's rules and expectations on social media use and the responsibilities of staff and users, supporting compliance with the Companies Act 1993.

Social media creates legal risk for New Zealand organisations across multiple dimensions. The Harmful Digital Communications Act 2015 (HDCA) creates criminal offences and civil remedies for harmful digital communications — content that is grossly offensive, threatening, or designed to cause serious emotional distress. The Privacy Act 2020 prohibits the unauthorised disclosure of personal information about identifiable individuals, which can easily occur through careless social media posts. The Fair Trading Act 1986 prohibits misleading and deceptive conduct in trade, which applies to all commercial social media activity. The Defamation Act 1992 provides remedies for individuals who suffer reputational harm from false statements made on social media. The Employment Relations Act 2000 permits disciplinary action — including dismissal — for employees whose personal social media conduct damages their employer's reputation or constitutes serious misconduct.

A Social Media Policy addresses both the official use of social media on behalf of the organisation and the personal social media use of employees. For official accounts, it specifies who is authorised to post, what brand and communication standards apply, how advertising is disclosed, and how comments and interactions are managed. For personal use, it sets clear limits on what employees can say about the organisation, its clients, its competitors, and their colleagues, and requires disclosure of any affiliation with the organisation.

The Employment Relations Authority and Employment Court have considered social media conduct in a range of cases and have consistently held that personal social media posts can justify disciplinary action — including dismissal — where the conduct has a sufficient nexus to the employment relationship. A Social Media Policy that clearly communicates expected standards, is consistently enforced, and provides a fair ERA-compliant disciplinary process gives employers the framework they need to manage social media risk effectively.

A Social Media Policy is needed by any New Zealand organisation that uses social media for business purposes or has employees who use social media in connection with their work. Given that social media is ubiquitous in modern workplaces, this means virtually every New Zealand employer.

When hiring staff — a Social Media Policy should be provided as part of the employee onboarding pack. Under the Employment Relations Act 2000, employees must comply with reasonable employer policies. A Social Media Policy that is clearly communicated from the start of employment establishes behavioural expectations and provides a lawful basis for disciplinary action if they are not met.

When the organisation is active on social media — any organisation that maintains official social media accounts on LinkedIn, Instagram, Facebook, X (Twitter), TikTok, YouTube, or other platforms needs a policy that governs who posts on those accounts, what content is permitted, and how the accounts are managed. Without a policy, the risk of unauthorised or inappropriate posts from official accounts is significantly increased.

In customer-facing industries — retail, hospitality, healthcare, financial services, professional services, and other customer-facing industries face heightened reputational risk from social media. A well-drafted Social Media Policy helps confirm that employee social media activity — both official and personal — supports rather than undermines the organisation's reputation and client relationships.

After any social media incident — if the organisation has experienced a social media crisis, a harmful digital communication involving an employee, or a complaint about an employee's social media conduct, reviewing and updating the Social Media Policy is an essential remediation step. It demonstrates that the organisation takes the issue seriously and has taken steps to prevent recurrence.

When employees work remotely — remote working arrangements increase the risk of employees using personal social media during work hours on work devices, blurring the boundary between official and personal social media use. A Social Media Policy that is updated to address remote working contexts is particularly important in the post-COVID work environment.

In regulated industries — financial services organisations regulated by the Financial Markets Authority, health providers, and other regulated entities may face specific regulatory requirements regarding digital communications, advertising, and social media. A Social Media Policy helps confirm regulatory compliance.

A well-drafted New Zealand Social Media Policy should include the following key elements to address the requirements of the Harmful Digital Communications Act 2015, the Privacy Act 2020, the Fair Trading Act 1986, and the Employment Relations Act 2000, and to be effective in managing social media risk.

Scope — clearly identify who the Policy applies to (employees, contractors, volunteers) and what platforms are covered (all social media and online communication channels, not just the major platforms). Specify that the Policy applies to both official use and personal use where the personal use relates to the organisation.

Official accounts — specify who is authorised to post on the organisation's official social media accounts and what approval processes apply. Require consistency with brand guidelines and legal requirements. Address advertising disclosure requirements under the Advertising Standards Authority (ASA) Codes of Practice and the Fair Trading Act 1986 — all sponsored or paid content must be clearly identified as advertising.

Personal social media use — set clear rules for employees who identify themselves as employees of the organisation on personal social media accounts. Require a disclaimer that personal views do not represent the organisation. Specify whether personal use is permitted on company devices and during work hours.

Prohibited content — list all prohibited content and conduct, referencing the relevant legislation: content that constitutes a harmful digital communication under the HDCA 2015; defamatory content; content that discloses confidential information or personal information in breach of the Privacy Act 2020; misleading or deceptive statements in breach of the Fair Trading Act 1986; discriminatory or harassing content in breach of the Human Rights Act 1993.

Privacy obligations — address the Privacy Act 2020 obligations specifically: employees must not post photographs or other content that identifies individuals without consent; health information and sensitive personal information must never be posted; any social media post that discloses personal information without authorisation is a potential privacy breach.

Intellectual property — prohibit the sharing of the organisation's intellectual property without authorisation, and require compliance with copyright law when sharing third-party content.

Crisis communications — designate a spokesperson for social media crisis management and set out a crisis response process. Prohibit employees from making independent comments about crises or sensitive matters.

Monitoring — state whether and how the organisation monitors social media activity, consistent with the Privacy Act 2020.

Disciplinary consequences — set out the consequences of breaching the Policy, referencing the ERA-compliant disciplinary process including the right to a support person under section 97 of the ERA.

Governing law — state that the Policy is governed by New Zealand law and commit to annual review. The forms-legal.com Social Media Policy (New Zealand) provides a ready-to-use template that meets New Zealand legal requirements.