A Social Media Policy Your Staff Will Actually Read

Why nobody reads the twelve-page version

Most social media policies are written by lawyers to protect the company at a tribunal, and they succeed at exactly one thing: being signed, filed and never read. The employee who posts something unwise on a Saturday night has not memorised clause 7.3(b). A policy only works if people can recall it at the moment their thumb hovers over 'post', and that means one page, plain English and examples from your actual business.

The legal footing does not suffer for brevity. Acas guidance on discipline expects rules to be clear, specific and properly communicated if you ever want to rely on them, and UK tribunals have given short shrift to employers waving vague policies staff had never genuinely seen. A short policy people have actually discussed protects you better than a long one they have not.

The one-page template

Here is the full skeleton: seven headings, each with two or three sentences underneath, the whole thing under 400 words. Write it in your brand's normal voice.

• 1. Who this covers: everyone who works here, on any platform, including group chats that feel private but aren't.
• 2. Your accounts are yours: we don't monitor your personal social media, and we don't want to.
• 3. But some things are off-limits: confidential information, customers' details, colleagues' private business, and content that could reasonably harm the company's reputation.
• 4. Speak for yourself: make clear your views are your own when discussing anything near work; only [named roles] speak for the company.
• 5. If you promote us, say who you are: UK advertising rules require you to disclose that you work here when praising our products.
• 6. If something blows up: say nothing publicly, don't defend us, and send what you've seen to [named person] immediately.
• 7. When unsure, ask [named person]. Asking is never a black mark.

Personal accounts and talking about work

You cannot ban employees from mentioning work, and you should not want to: staff talking warmly about their jobs is the most credible marketing you will ever get. What you can do is set the boundary clearly. Respect for colleagues and customers applies online exactly as it does in the building, confidential information stays confidential on every platform, and 'views my own' in a bio is politeness, not a legal shield.

Say that last part explicitly, because many people genuinely believe a disclaimer protects them. UK employment case law has long established that conduct on personal accounts can be a disciplinary matter where it damages the employer or breaches confidentiality, but a tribunal will ask whether your policy warned them. One plain sentence, such as 'serious breaches of this policy can lead to disciplinary action, even on personal accounts', does that work.

The disclosure point matters too. Under ASA and CMA rules, an employee enthusiastically promoting your products without saying they work for you is a misleading endorsement. The fix is painless: 'I work here and I love this' is both compliant and more persuasive.

Define confidential, or the rule means nothing

'Don't share confidential information' fails because people picture secret documents, not the everyday leaks that actually happen. Give examples from your own operation.

• Customer names, orders or complaints, which is a UK GDPR problem as well as a trust problem.
• Prices, discounts or terms not published on the website.
• Unreleased products, launch dates or pitches in progress.
• Internal disagreements and staffing matters.
• Photos and videos with whiteboards, screens or paperwork readable in the background, comfortably the most common accidental leak.

Then give the rule of thumb that covers everything else: if it isn't already on our website or public channels, ask before posting it.

The crisis silence rule

This is the most valuable paragraph in the whole document, and the one almost no small-business policy contains. When a company is criticised publicly, the biggest amplifier is often its own well-meaning staff: replying, arguing, correcting strangers and liking combative comments from personal accounts. Every reply spreads the story to a new network and hands journalists quotable material from someone who does not know the full picture.

So the rule is absolute and easy to remember: if the company is getting public criticism, do not post, reply, like or argue, even in our defence, and send anything you spot straight to [named person]. Crucially, explain the why in the policy itself, in one sentence, so it reads as protecting colleagues rather than gagging them. People follow rules they understand.

Making it stick: adaptation notes

A policy read aloud in five minutes during onboarding outperforms a signature collected by email. A few adjustments as you adopt the template:

• Regulated sectors (financial services, healthcare, legal) need extra clauses; check FCA or professional-body rules before simplifying.
• Swap the examples for ones from your business; a café's confidentiality list looks nothing like an accountancy firm's.
• Show the draft to two or three staff before finalising. They'll spot ambiguities, and involvement breeds compliance.
• Review it once a year, when platforms, roles and named contacts change.
• Keep the signed copy for the file, but treat the conversation as the real control.

If you would like help drafting the policy in your brand voice, or aligning it with the rest of your social media presence, our team can help.