Social media policy: what UK law requires, and what it cannot do

Someone posts something at the weekend, a customer sees it, and by Monday a manager is asking whether the person can be dismissed. Whether that ends well for the employer rarely turns on how bad the post was. It turns on three duller questions: was there a written rule the person could reach, did the post affect the work, and was the procedure fair.

This article answers those from primary sources and marks where official guidance does not reach at all. It covers Great Britain unless Northern Ireland is named, and it is general information rather than legal advice.

A policy protects nobody if people never received it. New Dynamics onboarding keeps a first week's tasks on one path, so issuing a policy and recording who has it is part of the process rather than a lost email.

No law requires a social media policy

Said plainly, because most writing on this subject implies otherwise: no United Kingdom statute obliges an employer to have a social media policy.

What the law requires is narrower. Section 3(1)(a) of the Employment Rights Act 1996 says the written statement of employment particulars must include a note "specifying any disciplinary rules applicable to the worker or referring the worker to the provisions of a document specifying such rules which is reasonably accessible to the worker". The duty does not create the rules. It bites on the rules you chose to have. If your handbook treats a post about a customer as misconduct, that is a disciplinary rule, and it must be written and reachable.

Parliament does name a policy when it means to. Section 2(3) of the Health and Safety at Work etc. Act 1974 imposes a duty "to prepare and as often as may be appropriate revise a written statement of his general policy with respect to the health and safety at work of his employees", except in prescribed cases. Nothing comparable exists for social media.

Where a policy does carry legal weight

Section 109 of the Equality Act 2010 makes an employer liable for its people: "Anything done by a person (A) in the course of A's employment must be treated as also done by the employer", whether or not with the employer's "knowledge or approval". Subsection (4) supplies the defence: it is a defence to show "that B took all reasonable steps to prevent A" from doing that thing. Section 40A goes further for one kind of conduct: "An employer (A) must take all reasonable steps to prevent sexual harassment of employees of A in the course of their employment." It was inserted on 26 October 2024 by the Worker Protection (Amendment of Equality Act 2010) Act 2023, and the word "all" was inserted on 30 October 2026 by section 20 of the Employment Rights Act 2025, commenced by S.I. 2026/1065. See our post on the sexual harassment prevention duty.

Neither provision requires a social media policy. Both make one part of the evidence of reasonable steps, alongside training, reporting routes and what you did when something was reported. A policy filed and forgotten is not a reasonable step.

A post made outside work can be a conduct matter, but not automatically

Section 98 of the Employment Rights Act 1996 sets out fair reasons for dismissal. Subsection (2)(b) covers a reason that "relates to the conduct of the employee", and does not limit conduct to the workplace, working hours or the employer's own systems.

Fairness is harder. Section 98(4) makes it depend on "whether in the circumstances (including the size and administrative resources of the employer's undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee", determined "in accordance with equity and the substantial merits of the case". So the employer has to say what the post did to the employment relationship: a named customer identified, a colleague targeted, confidential information published. Offence taken by a manager is not damage to the employer.

Acas, meanwhile, has no current guidance on social media at work. Its page on the subject sits at an archive address headed "This content is on an archive website", notes the advice "is archived and may not be up to date", and adds "We're still building this website and will add advice on this topic as part of that work." Checked on 7 November 2026. When an article tells you what Acas says about social media, it is quoting something Acas itself has withdrawn.

The Acas Code applies to any dismissal

The Acas Code of Practice on disciplinary and grievance procedures governs the procedure. It records its own date: it "was laid before both Houses of Parliament on 16 January 2015. It comes into effect by order of the Secretary of State on 11 March 2015 and replaces the Code issued in 2009." Acas says it will be updating the Code, so the 2015 text is the one in force. Four parts bear on a social media case:

• Written rules, paragraph 2. Rules and procedures "should be set down in writing, be specific and clear."
• Gross misconduct, paragraph 24. "Disciplinary rules should give examples of acts which the employer regards as acts of gross misconduct." If some posts qualify, say which, before it happens.
• Investigation, paragraph 5. Carry out "necessary investigations of potential disciplinary matters without unreasonable delay to establish the facts of the case."
• Separation, paragraph 6. "In misconduct cases, where practicable, different people should carry out the investigation and disciplinary hearing."

The Code states its own consequence: tribunals "will also be able to adjust any awards made in relevant cases by up to 25 per cent for unreasonable failure to comply with any provision of the Code." Our posts on the disciplinary procedure and gross misconduct cover the steps and the threshold.

Acas's guidance on unfair dismissal says it "might be unfair dismissal if an employee worked for their employer for at least 2 years" and "the employer did not follow a fair procedure", and flags a change: "Protection from unfair dismissal will become a right after 6 months of being in a job. This is part of the government's Employment Rights Act 2025. This change will happen in January 2027 and is not yet law." Acas research published with its July 2026 consultation puts "an estimated 1.7 million formal disciplinary cases in UK organisations each year" at an average of "approximately £1,141" each, from a YouGov survey of 1,050 senior decision makers, fieldwork 27 April to 6 May 2026. Wider figures sit in our HR statistics hub.

What a policy cannot override

This is where most writing overstates the employer's position.

Convention rights. The Human Rights Act 1998 makes it "unlawful for a public authority to act in a way which is incompatible with a Convention right", and section 6(3)(a) includes "a court or tribunal" in that definition. A private employer is not bound by section 6 as a public body is, but the tribunal hearing the claim is. Article 8 of Schedule 1 gives everyone "the right to respect for his private and family life, his home and his correspondence", and Article 10 "the right to freedom of expression". Article 10 is qualified: paragraph 2 permits restrictions "prescribed by law" and "necessary in a democratic society", including "for the protection of the reputation or rights of others". A policy is not law, so it does not settle the point by itself.

Protected characteristics. Section 4 of the Equality Act 2010 lists the characteristics protected in England, Wales and Scotland: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, sexual orientation. Section 10 is broad: "Belief means any religious or philosophical belief and a reference to belief includes a reference to a lack of belief." Political opinion is not on that list. In Northern Ireland it is, because article 3(1)(a) of the Fair Employment and Treatment (Northern Ireland) Order 1998 defines discrimination as including "discrimination on the ground of religious belief or political opinion".

Protected disclosures. Section 43G of the Employment Rights Act 1996 sets conditions for a disclosure made otherwise than to the employer or a prescribed person: the worker must reasonably believe the information and any allegation in it "are substantially true", must not make it "for purposes of personal gain", must meet one of the conditions in subsection (2), and it must be "reasonable for him to make the disclosure". Acas puts it this way on how to make a disclosure: for "any other person or body, for example, the police or media", "there must be a good reason to, or it must be related to an 'exceptionally serious failure'". See our post on what a whistleblower is. A clause banning anything negative about the employer cuts across this.

Monitoring an employee's social media

Looking at what a worker publishes is processing personal data, so the ICO's guidance on monitoring workers applies. "You must be clear about your purpose and select the least intrusive means to achieve it." And: "you should not monitor workers 'just in case'. You must document why you are monitoring workers and what you intend to do with the information you collect." The page carries a status notice: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."

Two limits on what can be claimed from it. The guidance has no section on monitoring workers' social media, and its only reference to social media is an example of an employer blocking sites rather than watching them. The ICO has published no position on whether an employer may look at an existing employee's private account. Nothing official settles that, but purpose, necessity and least intrusive means are hard to satisfy for an account you must get past a privacy setting to see.

Screening a candidate's social media

For candidates the ICO is specific. On pre-employment vetting it says that if you want to check public profiles "you must be able to justify why this is necessary. This means you should identify and document a specific risk." It adds a transparency duty, "you must inform candidates if you intend to use social media", and a separation of duties: "The staff members who research the candidate's social media profiles should not also make the recruitment decisions about them."

Going further is ruled out in terms: "It's unlikely to be lawful, appropriate or necessary to conduct intrusive or targeted checks of candidates on social media or online (eg by using specialist software to check information that is not publicly available)." Nor should you decide on what you find alone: "You should give the candidate an opportunity to provide further information or comment on the accuracy of the information you have obtained." This guidance is also under review following the Data (Use and Access) Act. Our post on social media recruitment covers hiring through social platforms.

What a workable policy actually says

Most policies fail because they treat one subject. There are three, and the consequences differ.

Personal use on a personal account. Set out what is off limits rather than what is required: naming customers, identifying colleagues without consent, disclosing anything confidential, and conduct that would be harassment in the office. Say nothing about opinions as such. Explain that personal use becomes a work matter when it is capable of damaging the employment relationship, and that any decision then follows the disciplinary procedure.

Speaking as the employer. Name who may post on the organisation's accounts, who approves what, and how to make clear when someone is speaking for themselves. Write this part in detail, because it is wholly within the employer's gift.

Confidential information. State what counts: customer data, commercial terms, unannounced plans, anything about an identified colleague. Do not bury the whistleblowing route in this clause. Say in the same paragraph that nothing in the policy prevents a protected disclosure.

For the wider document this clause sits in, see our code of conduct guide and our posts on code of conduct examples and the employee handbook.

Frequently asked questions

Is a social media policy a legal requirement in the UK?

No. No United Kingdom statute requires one. Section 3(1)(a) of the Employment Rights Act 1996 requires only that the written statement specify any disciplinary rules you do have, or refer the worker to an accessible document specifying them. By contrast, section 2(3) of the Health and Safety at Work etc. Act 1974 does require a written health and safety policy.

Can an employee be dismissed for a post made outside working hours?

It is possible, but not automatic. Section 98(2)(b) of the Employment Rights Act 1996 allows a fair reason that "relates to the conduct of the employee" and does not limit that to the workplace. Section 98(4) then requires the employer to have "acted reasonably" in treating it as sufficient. The employer has to show what the post did to the employment relationship.

Does Acas publish guidance on social media at work?

Not currently. The Acas page on social media in the workplace carries the notice "This content is on an archive website" and says the advice "is archived and may not be up to date", adding "We're still building this website and will add advice on this topic as part of that work." Checked on 7 November 2026. The Acas Code of Practice on disciplinary and grievance procedures, in effect from 11 March 2015, still governs any resulting disciplinary action.

Can an employer look at an employee's private social media account?

No official United Kingdom source says yes. The ICO's monitoring guidance has no section on social media monitoring, so the question is unsettled, but the requirements it does set apply: be clear about your purpose, select the least intrusive means, and do not monitor "just in case". For candidates the ICO is explicit that intrusive or targeted checks of information that is not publicly available are "unlikely to be lawful, appropriate or necessary".

Can a policy stop staff criticising the employer online?

Not without limits. Section 43G of the Employment Rights Act 1996 protects a disclosure made outside the employer where, among other conditions, the worker reasonably believes the information is "substantially true" and it is "reasonable for him to make the disclosure". Equality Act 2010 section 10 protects religious and philosophical belief, and in Northern Ireland political opinion is protected too. Restrict confidential information and conduct towards colleagues instead.

Next steps

Check that the social media rules you already have satisfy section 3(1)(a) of the Employment Rights Act 1996, which means a worker can reach them without asking HR. Rewrite the policy as the three separate subjects above, and make the confidentiality clause say that nothing in it prevents a protected disclosure. Then confirm any disciplinary step taken under it runs through your ordinary procedure and the Acas Code. The code of conduct guide sets out the wider document and the review questions behind it.

Want the record of who received a policy, and when, to exist before you need it? Book a New Dynamics demo and bring your current handbook. You can also email contact@new-dynamics.com.

This article is general information about the position in the United Kingdom, with Northern Ireland named where it differs. It is not legal advice. Take advice on a specific case before acting.