Social media policy for staff: a practical template

Your staff are already on social media, and the public often sees them as speaking for you. A social media policy turns unwritten expectations into clear, fair rules. Without one, staff guess, managers react inconsistently, and a single post can turn into a crisis.

The risks are real. Regulators treat undisclosed connections seriously: the US Federal Trade Commission says that when an endorser is an employee of the marketer, the ad is misleading unless the connection is made clear, and that listing your employer on your profile page is not enough.¹ Content also travels further than people expect. Bond's ethical content guidelines remind organisations that images and stories could be seen by anyone, anywhere, including contributors' neighbours, families and employers.²

Keep the policy short enough to read in ten minutes, ideally two or three pages, with a one-page summary. In our own practice, we find that NGO social media policy documents work best when they follow a simple structure that staff can navigate quickly. Use these headings as a template:

• Purpose and scope: who the policy covers, including staff, consultants, volunteers and interns.
• Official accounts: who may post, approve and respond, and how access is managed.
• Personal accounts: what staff may share about their work, and what they should not.
• Confidentiality and political neutrality: information and opinions that stay offline.
• People in pictures: consent, children and personal data.
• Disclosure: being open about connections when promoting the organisation's work or products.
• Security: passwords, two-step verification and lost devices.
• Incidents: who to tell, how fast, and what happens next.

Name an owner for every official account and keep a register of all accounts, logins and the people with access. Shared passwords in a group chat are a common weakness: when someone leaves, nobody is sure who can still post.

Most platforms now offer role-based access. TikTok's Organization Accounts, for example, let you invite members by phone number or email, assign an Admin role for full management or an Operator role for day-to-day tasks, and remove a member's access instantly when they leave the team.³ Use these features wherever they exist. Agree a simple approval route for sensitive posts, such as statements on emergencies, figures or political events, and a faster route for routine content.

Staff have a right to a private life online, and the policy should say so. Its job is to draw a few clear lines, not to police opinions. Ask staff to make clear they speak for themselves, to avoid sharing confidential or unpublished information, and to take particular care on political topics if your organisation is public sector, a UN body or committed to neutrality.

When staff promote the organisation's products or services, ask them to disclose the connection in every post. The FTC advises that a disclosure should appear in each post that would need one if viewed in isolation, and in the same language as the endorsement.¹ A short line such as "I work here" or "my employer" at the start of the post is simple and honest.

Staff on field visits often post photos of the people they meet. That is where a social media policy matters most. Bond calls informed consent the cornerstone of ethical story production and says that, without evidence of informed consent, images should not be used for promotion or fundraising.² UNICEF's ethical reporting guidelines ask reporters not to publish a story or an image that might put a child, their siblings or peers at risk.⁴

In Rwanda, personal data is protected by Law n°058/2021, which was gazetted on 15 October 2021 and is supervised by the National Cyber Security Authority.⁵ The law defines personal data as any information relating to an identified or identifiable natural person, and for children under 16 it requires the consent of the holder of parental responsibility.⁶ A simple rule for staff: no recognisable photos of programme participants on personal accounts unless consent covers it.

Mistakes will happen, so the policy should make reporting them easy and blame-free. Set out who staff should contact if they post something in error, see a hacked or fake account, or receive abusive messages, with a phone number as well as an email. Ask them to take screenshots before anything is deleted.

Separate honest mistakes from serious breaches. Most issues need a correction and a conversation, not a disciplinary process. Where staff act as ambassadors for a campaign, the FTC's advice to advertisers applies equally to employers: have reasonable programmes to train and monitor the people who promote you, and explain what they can and cannot say.¹

A policy that sits in a shared drive changes nothing. Introduce it in a short team session with real examples, include it in induction for new staff and consultants, and ask people to confirm they have read it. Give staff a named person they can ask before they post.

Review the policy every year, or sooner when platforms change features or a new law applies. Keep a short log of incidents and questions, because they show which parts of the policy are unclear. The aim is confident staff who share your work proudly and safely.

• Register of all official accounts and who has access
• Role-based access, two-step verification, no shared passwords
• Approval route for sensitive posts
• Clear lines on confidential information and political neutrality
• Disclosure wording for staff who promote your work
• Consent rules for photos, with extra care for children
• Incident contact and steps, including hacked accounts
• Annual review date in the diary