Social media policy for UK small businesses

Short answer

A social media policy for a UK small business should fit on two pages and cover three things: who may post as the business, what employees may and may not say about work on personal accounts, and what happens when something goes wrong. Keep it proportionate, and take advice before using it as a disciplinary basis.

• Name who can post as the business and who holds account access.
• Set confidentiality rules clearly: clients, sites, pricing, colleagues, security.
• Be explicit about what is not controlled: lawful personal opinion outside work.
• Cover disclosure: employees promoting the business must identify their connection.
• Include the escalation route when something is published in error.

Why does a small business need one?

Because the alternative is deciding these questions in the middle of an incident. A policy written calmly is a far better document than one written after a post has caused a problem.

It also protects employees, which is the framing that gets it accepted. Most staff want to know what is acceptable to post about work, and an unwritten rule enforced retrospectively is unfair to them and legally risky for you.

What should it cover about brand accounts?

Ownership, access, approval and escalation. Who owns the accounts, who may publish, what requires sign-off, and what to do if something goes out that should not have.

Include the practical rules that prevent most incidents: no publishing from personal devices without account separation, two-factor authentication on every account, and immediate access removal when someone leaves.

• A social media approval workflow that does not slow you down

What can you reasonably ask of personal accounts?

You can require confidentiality, prohibit harassment of colleagues, require disclosure when promoting the business, and prohibit content that would clearly damage the business, such as identifiable client sites or customer details.

You cannot control lawful personal expression outside work simply because you dislike it. Employment law in the UK protects employees in this area, and dismissals connected to personal social media use have frequently been found unfair where the connection to the business was weak or the policy was unclear. Take professional advice before acting on anything contentious.

• Reasonable: confidentiality, no harassment, no client data, disclosure of connection.
• Reasonable: no posting on behalf of the business without authorisation.
• Not reasonable: controlling lawful personal opinion unconnected to work.
• Grey area: content that identifies the employer while causing reputational harm. Take advice.

What about employee advocacy?

Encourage it, and make disclosure a requirement. Employees sharing company content reach audiences a business page cannot, and on LinkedIn in particular this is the main distribution mechanism available to a small firm.

Two rules make it safe. Employees must identify their connection to the business when promoting it, which the CAP Code requires, and they must never present personal opinion as an official position. Provide content they can share rather than asking them to invent it.

• LinkedIn strategy for UK small businesses
• ASA rules for social media advertising in the UK

How do you make it actually used?

Two pages, plain language, covered at induction, and signed. A policy in a handbook nobody has read provides very little protection and no practical guidance.

Review it annually and whenever platforms change materially. Include three worked examples of acceptable and unacceptable posts, because examples teach faster than rules, exactly as they do in brand voice guidelines.

• Brand voice guidelines for social media

What should happen when someone leaves?

Run a fixed offboarding sequence, because this is where the most expensive social media failures in small businesses actually occur.

Remove their access from every page, ad account and scheduling tool on the day. Change any shared passwords they knew, which is a reason not to have shared passwords in the first place. Transfer ownership of anything created under their personal account. Check whether the account recovery email is theirs. And review any scheduled content they queued.

Do the same when an agency relationship ends, including reclaiming ownership of the ad account and exporting creative files and audience definitions before access is withdrawn on either side.

• Remove access from pages, ad accounts and tools on the day.
• Transfer anything created under a personal account.
• Confirm recovery emails point to a shared business address.
• Review and clear content they had queued.
• Apply the same sequence when an agency contract ends.

How do you introduce a policy without it landing badly?

Frame it as protection rather than restriction, and be specific about what it does not cover. A policy introduced without that framing is read as surveillance, and the result is a team that stops sharing company content altogether.

Say plainly in the document that you are not monitoring personal accounts and that lawful personal expression unconnected to work is not your business. That single paragraph does more for acceptance than anything else in it.

Introduce it at a team meeting rather than by email, take questions, and use three real examples. Most of the questions people actually have are practical, such as whether they can mention where they work or post a photo taken on site, and answering those in the room removes most of the anxiety.

• Frame as protection, and say what is not covered.
• State explicitly that personal accounts are not monitored.
• Introduce in person, not by email.
• Answer the practical questions with real examples.

Next step

Two pages written calmly now is worth considerably more than any amount of drafting during an incident.