A social media policy for employees sets out how your people use social media at work, and outside work when it connects to their job. A good one protects the business, protects staff and still encourages them to post.
In 2026 it has a new job. Since 30 October 2026, employers in England, Wales and Scotland must take all reasonable steps to stop staff being harassed by customers, clients and the public, online included, under section 21 of the Employment Rights Act 2025.
Below is a ten section template and a seven step way to write or refresh yours. This is general guidance, not legal advice, so check your final policy with an employment adviser.
The short version
- Cover all ten areas. From personal use to official accounts and monitoring.
- Name online harassment. Including from customers in your comments.
- Say what good looks like. Not only what is banned.
- Lock down brand accounts. Named owners, two factor sign in and approvals.
- Be open about monitoring. Or it will not be lawful.
- Review it every year. And every time the law moves.
What is a social media policy for employees?
It is a short document that tells staff what is expected of them on social platforms. It covers personal accounts, posts about work, the brand’s own channels and what happens if things go wrong.
It is different from your brand guidelines. Brand guidelines tell the social team how the company sounds. The policy tells everyone how to behave.
Why does a social media policy matter more in 2026?
Two duties changed on 30 October 2026. Section 20 raised the duty to prevent sexual harassment to “all reasonable steps”. Section 21 made employers liable when a third party harasses staff, for any type of harassment covered by the Equality Act, according to the government guidance for employers.
Acas is clear that third parties include customers, clients and members of the public, and that harassment can happen online or in person. Northern Ireland has separate law.
For brands, this lands on the social team. Community managers read every comment and direct message. When a customer sends abuse to a named member of staff, that is now something the employer has to have planned for.
Acas guidance on sexual harassment says a social media policy should make clear that online sexual harassment is not tolerated, including on personal devices.
What should a social media policy include?
Use these ten sections as your template. Keep each one short enough to read on a phone.
| Section | What it covers | A line you could adapt |
|---|---|---|
| 1. Purpose and scope | Who it applies to, which platforms, work and personal accounts | “This policy applies to everyone who works for us, on any platform, whenever a post could be linked to us.” |
| 2. Personal use at work | Reasonable use during working hours | “Personal use is fine in breaks if it does not affect your work.” |
| 3. Talking about work | Saying you work here, sharing news, opinions | “If you say where you work, make clear your views are your own.” |
| 4. Confidential information | Clients, finances, unreleased work, colleagues’ details | “Never post anything you learned at work that is not already public.” |
| 5. Harassment and discrimination | Bullying, sexual harassment and discrimination online, including on personal devices | “Harassing a colleague online is treated the same as doing it in the office.” |
| 6. Abuse from the public | Third party harassment in comments, messages and replies | “You never have to put up with abuse from customers. Report it and we will act.” |
| 7. Reporting routes | More than one way to raise a concern | “Tell your manager, HR or use the anonymous form.” |
| 8. Official brand accounts | Who can post, approvals, passwords and access | “Only named people can post on brand accounts, using two factor sign in.” |
| 9. Monitoring | What you check, why and how | “We monitor brand accounts, not your personal profiles.” |
| 10. Advocacy, breaches and review | Posting about the company, disclosure, what happens after a breach, review dates | “If we give you anything for a post, it must be labelled as an ad.” |
Template written by Advertain from Acas, ICO and security.gov.uk guidance. Adapt the wording to your business and check it with an adviser.
How to write a social media policy for employees in 7 steps
Step 1: Start with the risks your teams actually face
A policy written from a generic template misses your real risks. Acas suggests a risk assessment for third party harassment that looks at where staff meet the public, online and in person.
For most brands, the highest risk roles are the social team, customer service and anyone whose face is on the channel. Ask them what they see in the comments every week.
Step 2: Make it match your other policies
Your social media policy should not say one thing while your disciplinary policy says another. Acas recommends linking the sexual harassment policy to your social media policy and checking that discipline, social media and dress code rules line up.
Acas also says your policy should be clear that discrimination is not allowed in any work connected activity, and that bullying policies should cover social media for people working from home.
Step 3: Write what good looks like, not only what is banned
Most policies read like a list of ways to get fired. That is a missed opportunity.
People follow people. Staff who post about their work often reach audiences the brand account never will. A good policy gives them confidence: what they can share, how to say they work here and who to ask if unsure.
You also cannot ban staff from social media in their own time. You can only set fair rules where it connects to work. Our guide to employee generated content shows how to turn that goodwill into a programme.
Step 4: Protect your people from the comments section
This is the section most policies are missing. From 30 October 2026, Acas lists steps such as recording incidents, training staff to calm tense situations, setting terms with customers and telling customers what happens if they harass staff.
For a social team, that means clear moderation rules, the right to hide, block and report without asking permission, a simple log of incidents and an escalation route to a manager. Consider a short community guidelines line in your bios or pinned posts that says abuse of staff will be removed.
Step 5: Lock down the official accounts
Brand accounts are company assets. The government’s guidance on using social media securely recommends named people authorised to publish, a content approval process, two factor authentication and removing access when people leave.
The NCSC gives similar advice on protecting what you publish. Our social media audit template walks through checking who has access to every account.
Step 6: Be honest about monitoring
If you monitor anything, say so. The ICO guidance on monitoring workers says employers must tell workers the nature, extent and reasons for monitoring, have a clear purpose and use the least intrusive method. High risk monitoring needs a data protection impact assessment.
Workers notice. In an ICO survey published in October 2023, most people said employer monitoring would feel intrusive.
How UK adults feel about employer monitoring
Monitoring brand accounts is straightforward. Monitoring staff’s personal profiles is much harder to justify, so most businesses should not do it routinely.
Step 7: Train, sign off and review
A policy nobody has read protects nobody. Walk teams through it, give the social team scenario training and ask everyone to confirm they have read it.
Review it at least once a year and whenever the law changes. Acas advises keeping a record of the steps you took, and why, if you decided a step was not reasonable for your business.
A social media policy should give people confidence to post, not just a list of ways to get it wrong.
Social media policy examples
A real case: the tweets that reached the tribunal
In Game Retail Ltd v Laws (2014), an employee was dismissed over offensive tweets from a personal account followed by 65 of the company’s stores. The Employment Appeal Tribunal declined to set general rules for social media cases.
Instead, the usual test applies: was the response within the range a reasonable employer could take? The lesson for your policy is to say plainly that posts can reflect on the business when an account is linked to it.
An illustrative example: a brand social team
This example is fictional. A consumer brand with 60 staff has two community managers. One starts receiving abusive messages from a customer after a product delay.
Under a refreshed policy, she hides and reports the messages, logs them and tells her manager the same day. The brand posts a short reminder of its community rules. Nobody has to ask whether they are allowed to act, because the policy already says so.
Social media policy checklist
- All ten template sections covered.
- Online harassment, including from customers, named.
- At least two reporting routes.
- Matches your harassment, disciplinary and dress code policies.
- Named owners and two factor sign in on every brand account.
- Monitoring explained, with a purpose.
- Advocacy encouraged, with ad labelling rules.
- Staff trained and read receipts kept.
- Review date in the diary.
Frequently asked questions
Can an employer ban employees from using social media?
Not in their own time. You can limit personal use during working hours and set rules for posts that connect to work, such as confidentiality and harassment.
Can my employer monitor my personal social media?
Only with a clear and lawful reason, and you must be told. The ICO expects monitoring to be open, necessary and the least intrusive option, which is hard to show for personal accounts.
Does the third party harassment duty cover online abuse?
Acas says harassment by customers, clients or the public can happen online or in person. Abuse sent to staff through brand channels is likely to be part of the risk you assess.
Should a social media policy cover AI tools?
Yes, briefly. Say what staff must never paste into AI tools, such as confidential client details, and who checks AI assisted posts before they go live. Use AI for speed, but keep a human accountable for anything published. Our guide to generative engine optimisation covers how AI search finds brand content.
Do employees need to label posts about their employer as ads?
If the company asks for, rewards or controls the post, it is likely to count as an ad and should be labelled. Even without that, staff praising their employer’s products should make clear they work there. Our guide to the ASA influencer guidelines explains the rules.
Want help building a social team and channels your people are proud to be part of? See our work or talk to us about your brand.
