Social Media Policy Template: Rules for Employees and Company Accounts

A sales rep posts a proud update on LinkedIn: a new customer is signed, with the logo, the deal size, and a thank-you to the team. The customer had not announced anything yet. By lunchtime their legal team is on the phone, and nothing in writing tells anyone whether the post was allowed.

That gap is what a social media policy template exists to close. You need one you can turn into a real document this week, before a customer or an auditor asks for it.

A social media policy is a written rule set for how employees and the company use social platforms: which information stays private, how personal and company accounts differ, how company accounts are secured, how impersonation and phishing are reported, and what records prove it all works. A good social media policy template for employees covers each of those, stays inside the legal limits on what an employer may restrict, and maps to SOC 2, ISO 27001, HIPAA, and GDPR.

By the end of this guide, you will have a free, ungated template with real sample clauses, a security baseline for company accounts, and the evidence list auditors actually sample.

Here's what I'll cover:

• What a social media policy is, and where it stops and your acceptable use policy and code of conduct start
• What a social media policy template must include, section by section
• What employees must not post, and how fake recruiters and impersonators get in
• How to secure company accounts from first login to offboarding
• The legal guardrails that limit what a policy may say
• What SOC 2, ISO 27001, HIPAA, and GDPR expect
• A free downloadable template, sample clauses, and the audit evidence to keep

What Is a Social Media Policy Template, and What Does It Not Cover?

A social media policy template is a ready-to-adapt document that defines how employees and the company use social platforms, what they may and may not share, and who is responsible for the company's accounts. The policy sets the rules. It does not pick your posting calendar or brand voice, which belong in a marketing playbook.

The split matters in an audit. The policy says company accounts need MFA and a named owner. The access list and the offboarding tickets show it happening.

Social Media Policy vs Acceptable Use Policy and Code of Conduct

Several of your policies already brush against social media, so it helps to know who owns what. ComplyJet's acceptable use policy guide covers what people may do with company systems and devices. The code of conduct policy covers behavior and respect, and lists social media conduct as an optional section. The security awareness training policy covers how you teach people to spot threats.

This article covers what employees and company accounts may say and do on social platforms, and how those accounts are secured. If you only need a line about online behavior, the code of conduct is enough. If you need confidentiality rules, account security, and proof, you are in the right place.

Why You Need a Social Media Policy for Employees Before Your Next Audit

In 2019, the U.S. Department of Health and Human Services settled with a Dallas dental practice for $10,000 after the practice answered patient Yelp reviews with the patients' names and treatment details. The agency's Office for Civil Rights director said at the time: "Social media is not the place for providers to discuss a patient's care." The failure was a reply box and no rule.

Most startups face a lower-stakes version of the same problem. Three groups ask for the written policy:

• Auditors. SOC 2 and ISO 27001 reviewers expect documented rules for confidentiality and acceptable behavior, then sample your records against them.
• Customers. Security questionnaires ask whether you have an employee social media policy and who controls your accounts.
• Whoever inherits the job. Marketing leads change. A written baseline tells the next owner who has access, who approves posts, and what is off limits.

A practitioner on Hacker News, commenting in March 2025 in a thread about Apple's Severance, put the employee's side plainly: if you say where you work, "you become a spokesperson for that company unless you disclaim those words". Your policy is where that expectation gets written down, so nobody has to guess.

What a Company Social Media Policy Template Must Include

A working company social media policy has nine sections. Each answers a question an auditor, a customer, or a new marketing hire will eventually ask, and the quickest route is to start from a social media policy example and cut it to fit.

Employee Social Media Policy Scope: Who and Which Accounts Count

Scope is where social media policies quietly fail. A document that says "employees" and means "full-time staff" leaves contractors, interns, and advisors outside the rules while they still hold access to your information.

List the people and the places explicitly:

• People: employees, contractors, interns, board members, and advisors who handle company information
• Company accounts: every official profile on every platform, including ones nobody has posted on in a year
• Personal accounts, when the person identifies the company or discusses its business
• Messaging groups and communities such as public Slack or Discord groups
• Review sites and forums where staff reply as the company

The abandoned account is the one that gets forgotten. An unused company profile with an old password is an impersonation risk and a takeover target, so your asset inventory should list every one.

Personal vs Company Social Media Accounts: Who Speaks for the Company

The cleanest way to write this section is to define three account types and give each its own rule. People rarely break a policy out of malice. They break it because they were not sure whose voice they were using.

Spell out the rules per type:

• Company accounts speak for the company. Only named, trained people post, and sensitive topics go through an approver.
• Personal accounts speak for the person. Employees need no permission to have one, but they do not disclose Confidential or Restricted information and they do not use a work email to sign up.
• Executive and advocate accounts blur the line, so they get an extra rule: say clearly when a post is the company's view and when it is the author's.

Add one more sentence for press. Anything that looks like a media inquiry, analyst question, or request for comment goes to a single named owner, not to whoever saw it first.

Social Media Confidentiality Rules: What Your Social Media Policy Template Must Keep Private

"Do not share confidential information" is the line every template includes and almost no employee can apply. A rule people can follow lists the concrete things that leak. Hang each item off the labels in your data classification policy so there is one source of truth.

The screenshot row deserves the most attention. A photo of a laptop at a conference can show a customer name in a browser tab, an open ticket, or a Slack thread. Add a plain instruction to the policy: zoom out and read the whole frame before you post.

Social Engineering on Social Media: Fake Recruiters, Connection Requests, and Impersonation

Social platforms give attackers a free look at your team before they write the first message. Help Net Security reported in September 2015 on fake recruiter profiles, built with stolen photos, that messaged security professionals to map their professional networks. The pattern is not new.

Four patterns belong in the policy because each one is reportable:

• Fake recruiters who send a link or a "job description" file and ask the target to open it.
• Connection requests that probe, asking which tools, vendors, or cloud providers the team uses.
• Cloned executive profiles that message employees with an urgent request, often for money or gift cards.
• Impersonation of the company's own accounts, which customers read as the real thing.

Write one reporting channel and one promise. Employees report suspected phishing, fake profiles, or impersonation to [Security Lead] within [1 business day], and nobody is blamed for clicking. The owner takes the profile to the platform's takedown process and records what happened, and an ongoing incident follows your incident management policy.

Teach it, too. Your security awareness training policy is where the examples live, so the social media policy only needs to point there.

Securing Company Accounts: Social Media Policy for Startups

This is the part of a corporate social media policy that matters most to security and gets the least attention. A company account is a public megaphone with a login. If a former intern still has the password, or three people share one, the policy is decoration.

Write the lifecycle as five rules:

1. Ownership. Every company account has a named owner and at least two administrators, so one departure cannot lock the company out.
2. Access. People sign in through a scheduling tool with their own logins, or through a password manager, never a shared password in a chat.
3. MFA. Multi-factor authentication is required on every company account and on the email address used for recovery.
4. Review. The owner reviews who has access [quarterly] and removes anyone who no longer needs it.
5. Offboarding. Access is revoked on the person's last working day, and the recovery email and phone stay under company control.

That last rule is the one most startups miss, because the recovery email is often a founder's personal address or an old mailbox. Move it to a company-controlled alias early.

Legal Guardrails Your Social Media Policy Template Must Respect

A social media policy is an employment document as well as a security one, which means some rules you might want to write are not allowed. This section is a plain-language map, not legal advice. Have counsel review the final policy before you publish it.

Social Media Policy NLRA Rules: Do Not Chill Employee Rights

Section 7 of the National Labor Relations Act protects employees' right to engage in "concerted activities for the purpose of collective bargaining or other mutual aid or protection". That applies to non-union workplaces too, and it includes talking with coworkers, and sometimes the public, about pay and working conditions.

In its 2023 Stericycle decision, the National Labor Relations Board held that a work rule is presumed unlawful if an employee could reasonably read it as tending to chill those rights. An employer can rebut the presumption by showing the rule advances a legitimate and substantial business interest that a narrower rule could not serve. An April 2026 SHRM report said Stericycle remained in force, though a reversal looked likely, so confirm the current status with counsel before you finalize.

What this means for your template is practical:

• Name the specific information you protect, such as customer data, unreleased products, and security details.
• Do not ban "negative" or "disparaging" posts in general terms.
• Add a plain savings sentence saying the policy does not restrict employees' legal rights to discuss pay, conditions, or other protected topics.

One Hacker News commenter, writing in January 2026 about a cloud launch, claimed that at one large company "commenting on operational or internal aspects without PR approval was prohibited". Whatever any one employer does, a blanket pre-approval rule for everything employees say online is exactly the kind of wording that invites this scrutiny. Keep approvals for the company's own channels.

FTC Disclosure for Employees Promoting the Company

If an employee posts praise for the company's product, the audience may not realize they are paid by the company.

The FTC's Endorsement Guides require that a connection that might materially affect the weight or credibility of an endorsement, and that the audience does not reasonably expect, be disclosed clearly and conspicuously. The rule at 16 CFR 255.5 includes an example of an employee posting on a discussion board about the employer's product, and says the poster should disclose the relationship.

So the policy asks employees to say so when they promote the company's products: "I work at [Company]" is enough, placed where readers will see it.

Passwords, Monitoring, and Regulated Industries

Three more limits show up in most policies.

• Personal account access. A number of U.S. states restrict employers from asking for the passwords to employees' personal accounts. Do not write a rule that demands them, and check the law in each state where you have staff.
• Monitoring. Monitor the company's own accounts and work systems. Do not promise to watch personal accounts, and tell employees in writing what you do watch.
• Regulated information. Patient data, customer financial data, and material non-public information carry their own rules. If you are a public company, the SEC's 2013 Regulation FD guidance says investors should be alerted to the channels a company will use to disclose material information, so the policy should name the official channels and bar employees from using personal accounts for disclosures.

Social Media Policy Requirements by Framework: SOC 2, ISO 27001, HIPAA, and GDPR

Each framework touches social media from a different angle. None has a control called "social media policy," and none sets a number.

Social Media Policy SOC 2: Confidentiality and Communication Criteria

No SOC 2 criterion mentions social media. Three are relevant. CC1.1 covers a commitment to integrity and ethical values, CC2.2 covers communicating responsibilities internally, and C1.1 covers identifying and protecting confidential information if you include the Confidentiality category in your report.

In a Type II audit, the reviewer reads your policy, then asks for signed acknowledgements and the records that prove the rules were in force across the period. Our SOC 2 compliance checklist shows where this evidence fits in the wider program.

Social Media Policy ISO 27001: Annex A 5.10, 6.3, 6.4, and 6.6

Four Annex A controls apply. Control 5.10 covers acceptable use of information and associated assets. Control 6.3 covers information security awareness, education, and training. Control 6.4 covers the disciplinary process. Control 6.6 covers confidentiality or non-disclosure agreements.

Together they map to the shape of this policy: the acceptable-use rule is the policy itself, training is how you teach it, the disciplinary process is the enforcement clause, and non-disclosure obligations are what the confidentiality section refers to. As with every Annex A control, you select them through your Statement of Applicability. Our ISO 27001 checklist covers the rest of the controls.

Social Media Policy HIPAA and GDPR: Patient and Personal Data

HIPAA does not ban social media. It limits what covered entities and business associates may disclose about patients, and no reply to a review is exempt. The Elite Dental Associates settlement above is the clearest example: the practice answered public reviews with identifiable patient details and paid $10,000 under a corrective action plan.

GDPR works the same way from the privacy side. Article 5(1)(f) requires personal data to be processed with appropriate security and confidentiality, and posting identifiable information about a customer or colleague needs a lawful basis. If you employ people in the EU or UK, say in the policy that employees do not post identifiable personal data without consent. Our HR security policy guide covers how people-related controls fit together.

Social Media Policy Template: A Free Example You Can Download

Here is what a social media policy example looks like as clauses you can adapt. Brackets mark the values to set for your own company.

Social Media Policy Example: Sample Clauses You Can Adapt

Social Media Policy Template Summary: Social Media Guidelines for Employees

Many employees will not read the full policy, so give them a one-page version for the handbook. Plain language, no clause numbers:

• Do say you work here, and say when you are speaking for yourself.
• Do read the whole photo or screenshot before you post it.
• Do report fake profiles and odd recruiter messages the same day.
• Do not post customer names, deals, roadmap, or security details before we do.
• Do not share a password for any company account.
• Do not answer press or analyst questions. Send them to [Communications Lead].

Rolling Out Your Social Media Policy Template and Proving It Works

Writing the policy takes an afternoon. Rollout is where the rules become access lists, and the access lists become records.

1. Assign an owner, usually the head of marketing or the security lead.
2. Inventory every company account, including old ones, and record the owner and recovery details.
3. Remove shared passwords, move access to individual logins, and turn on MFA.
4. Align with your other policies, especially the acceptable use policy and code of conduct.
5. Run counsel review on the confidentiality and monitoring clauses.
6. Distribute the policy and collect acknowledgements, and add it to new-hire onboarding.
7. Review access quarterly and the policy at least annually.

Social Media Policy Template Evidence: What Auditors Sample

The policy is the small part. The records turn it into evidence.

Answering Customer Questionnaires About Your Corporate Social Media Policy

Security questionnaires ask about social media in predictable ways: do you have a written policy, who controls your accounts, how do you protect them, and how do you handle impersonation. Answer with what is true, and attach the policy.

Measure what you promise with a few numbers that mean something: the share of company accounts with MFA, the date of the last access review, and the time from an impersonation report to a platform takedown request.

Social Media Policy Template Mistakes to Avoid

• A policy that is only brand voice. It says how to sound and nothing about access, MFA, or confidentiality.
• Shared passwords for company accounts. Three people know the login and nobody can say who posted what.
• Blanket gag rules. "Do not say anything negative about the company" invites a legal challenge and does nothing for security.
• No offboarding step. A departed employee keeps admin rights on a page for months.
• A personal address as the recovery email. The founder leaves and takes the account's recovery path with them.
• Ignoring abandoned accounts. An old profile with a weak password is the easiest one to hijack.

How ComplyJet Helps With Your Social Media Policy Template Evidence

A social media policy is quick to write and tedious to prove. The rules fit on three pages. The proof is a year of consistent behavior.

ComplyJet's policy management drafts policies with AI from a library of 30+ templates mapped to SOC 2, ISO 27001, HIPAA, and GDPR, lets you edit them before publishing, distributes them to your team, and tracks acknowledgements with a timestamp and a version history. Our security awareness training assigns courses when a new hire is added through your HR integration and keeps per-person completion records.

We are not a social media management or monitoring tool. We do not watch your accounts, post for you, or manage logins, and that stays with your marketing stack and your password manager. ComplyJet holds the policy, the acknowledgements, and the training evidence beside everything else an auditor asks for.

FAQs

What Should a Social Media Policy Template Include?

Nine sections: purpose and scope, roles, personal accounts, company accounts, confidentiality, security and impersonation, legal and disclosure rules, monitoring and enforcement, and evidence with review. Add concrete confidentiality examples and a company-account access rule so the policy covers more than brand voice.

Is a Social Media Policy Required for SOC 2 or ISO 27001?

In practice, yes. Neither framework names a social media control, but SOC 2 expects documented, communicated rules on ethical conduct and confidentiality, and ISO 27001 Annex A 5.10, 6.3, 6.4, and 6.6 cover acceptable use, awareness, discipline, and confidentiality. A written policy with signed acknowledgements is the standard evidence.

Can Employers Discipline Employees for Social Media Posts?

Sometimes. An employer may enforce a lawful, narrowly written rule, such as a ban on posting customer data or security details. Discipline for posts that amount to protected activity under the NLRA, such as discussing pay and conditions with coworkers, can be unlawful. Ask counsel to review the enforcement clause.

Can an Employer Ask for Personal Social Media Passwords?

Often not. A number of U.S. states restrict employers from requesting access to employees' personal accounts, and asking for a password is rarely necessary. Do not write that rule. Limit monitoring to company accounts and work systems, and check the law in each state where you have staff.

Do Employees Have to Disclose Their Employer When Posting?

When promoting the company's products, yes. The FTC's Endorsement Guides call for clear and conspicuous disclosure of a connection the audience would not reasonably expect, and the rule includes an example of an employee posting about the employer's product. A short "I work at [Company]" satisfies the spirit of it.

Who Should Own the Company's Social Media Accounts?

The company, through a named owner and at least two administrators, never an individual's personal login. The owner keeps an account inventory, controls the recovery email and phone, reviews access quarterly, and revokes it on a person's last day. Marketing usually owns posting, and security reviews access.

Is There a Free Social Media Policy Template?

Yes. The PDF above is free and ungated: nine sections, sample clauses, a "what stays private" table, company-account security rules, an evidence checklist, and framework notes. Adapt the bracketed values to your company and route it through your normal approval process, including counsel review.

Related Reading

• Acceptable Use Policy, for what people may and may not do with company systems.
• Code of Conduct Policy, for behavior, respect, and reporting expectations.
• Security Awareness Training Policy, for teaching people to spot phishing and impersonation.
• Data Classification Policy, the labels that decide what may be posted.
• Incident Management Policy, for what happens after an account compromise or a leak.
• HR Security Policy, for onboarding, training, and offboarding controls.

Sources:

• HHS OCR settlement with Elite Dental Associates, reported by HIPAA Journal, October 2019
• 29 U.S.C. 157, NLRA Section 7
• NLRB, Stericycle, Inc., 372 NLRB No. 113 (2023), summarized by Barley Snyder
• SHRM, NLRB's Strict Decision on Work Rules Remains in Place, April 2026
• 16 CFR 255.5, Disclosure of material connections
• SEC Report of Investigation on Netflix and Regulation FD, April 2013
• Help Net Security, Fake recruiters on LinkedIn are targeting infosec pros, September 2015
• ISMS.online on Annex A 6.6, Confidentiality or non-disclosure agreements
• Hacker News comment, March 2025
• Hacker News comment, January 2026