A social media policy for employees is a short document that tells staff what they can and can't post about work, how to handle personal and official accounts, and what happens if the rules are broken. The best ones are one or two pages, written in plain language, and paired with an easy way to get work content approved.
Below you'll find a full template you can copy and adapt, plus notes on the Malaysian points to check with your adviser and how to roll the policy out so people actually read it. It is a starting point, not legal advice: have the final version reviewed by your legal or HR adviser.
Why you need one (and what it isn't)
A policy isn't about stopping people posting. It's about avoiding Mondays like this.
Your staff are already on TikTok, Instagram, Facebook, LinkedIn, Xiaohongshu (RED) and in dozens of WhatsApp groups. Some of them talk about work. A policy doesn't stop that, and it shouldn't try. It makes the expectations clear, so people can post with confidence and nobody is surprised.
A good policy protects three groups: customers (their data and privacy), colleagues (from harassment and unwanted exposure) and staff themselves (from accidentally sharing something that gets them into trouble).
It isn't a gag order. If your policy reads like a list of threats, people will stop posting about work altogether, including the good stories you'd love them to share.
Decide these five things before you write
Who it covers: permanent staff only, or also contract staff, interns, agents, dealers and outlet partners?
Who speaks for the company: which roles may post on official accounts or talk to media.
What needs approval: posts that mention products, prices, promotions or clients, versus general posts about working life.
Who approves, and how fast: a named team and a turnaround time, such as one working day.
Whether you reward posting: if so, how, and how that links to your rewards scheme.
Social media policy template
Share this one-pager with the full policy. It's what people will remember.
Copy the sections below into your own document. Replace anything in square brackets.
Purpose. This policy explains how [Company] employees use social media when it relates to their work, so that we protect our customers, our colleagues and our reputation, and so that staff can share their work with confidence.
Scope. This policy applies to all employees, contract staff and interns of [Company], [and to agents, dealers and partners who promote our products]. It covers all social media and messaging platforms, including TikTok, Instagram, Facebook, LinkedIn, X, YouTube, Xiaohongshu (RED) and WhatsApp groups and channels, whether you post during or outside working hours.
Personal and official accounts. Only authorised staff may post on [Company]'s official accounts or reply to comments on our behalf. Your personal accounts are yours. When you post about work on a personal account, make it clear that views are your own, and don't present yourself as an official spokesperson.
Say that you work here. When you post about our products or services, make it clear that you work for [Company], for example in your bio or in the caption. This keeps things honest for your followers.
Confidential information. Do not share non-public information, including financial results, plans, pricing not yet announced, client names, contracts, internal documents, screenshots of internal chats, or anything shown on screens, whiteboards or desks in the background of photos and videos.
Prices, promotions and claims. Only share prices, promotions and product claims that appear in official [Company] materials and are current. Include any required disclaimers or terms exactly as provided. If you are unsure whether something is correct or allowed, ask [approving team] first.
Respect and harassment. Do not post anything that harasses, bullies, threatens or discriminates against colleagues, customers or anyone else. Be especially careful with content touching on race, religion or royalty. Our [anti-harassment policy] applies online as it does at work.
Work content needs approval. Posts that feature our products, outlets, projects, prices, promotions or clients must be approved by [approving team] before they are posted. Submit drafts through [tool or channel]. We aim to reply within [one working day].
Privacy of customers and colleagues. Do not post photos, videos, names, contact details or other personal information of customers or colleagues without their permission. Handle any personal data in line with the Personal Data Protection Act 2010 and [Company]'s privacy notice. If someone asks you to remove a post that shows them, remove it.
Rewards. [Company] may reward approved posts under the [programme name] scheme. Taking part is voluntary and will not affect your performance review or employment. Rewards to employees may be treated as income; [HR] will explain how they are paid.
Mistakes and consequences. If you post something by mistake, delete it and tell [contact] straight away; we'd rather help than find out later. Breaches of this policy may lead to disciplinary action in line with [Company]'s disciplinary procedures.
Questions and updates. Contact [name, email] with questions. We review this policy every [12] months.
Have the final wording reviewed by your legal or HR adviser before you issue it, especially the sections on confidentiality, personal data and disciplinary action.
Malaysian points to check with your adviser
We aren't lawyers, and the right wording depends on your industry and your employment contracts. These are the areas Malaysian companies usually ask their adviser about:
Personal data. The Personal Data Protection Act 2010 governs how personal data is handled in commercial transactions. Photos and videos of customers and staff can be personal data.
Employment terms. Make sure the policy fits your existing employment contracts, employee handbook and disciplinary procedures.
Agents and partners. People who aren't employees may need the same rules written into their agency or dealer agreement, not just a staff handbook.
Sensitive topics. Malaysia has laws on offensive and harmful online content. Ask your adviser how to describe this in plain language for staff.
How to roll it out so people read it
Keep it short. If it's longer than two pages, cut it. Link to longer policies rather than repeating them.
Translate it. Offer Bahasa Malaysia, English and Chinese versions if your team needs them.
Explain it in person. A 15-minute briefing with real examples beats an email attachment.
Show good and bad examples. A great staff post, and a (made-up) post with a background screen showing customer details.
Make approval easy. One channel, a clear turnaround time, and a named person to ask.
Ask for acknowledgement. A signature or a click to confirm people have read it.
Review it yearly. Platforms and rules change.
Where ViaCRM fits
A policy only works if the approval step is easy to follow. If you run a programme with many staff, agents or outlets, ViaCRM can hold the workflow:
Briefs that carry your restricted keywords, terms and disclaimers, so the rules travel with every campaign.
Drafts uploaded and watched inside ViaCRM, with comments and two-layer approval: a project manager reviews first, then an approver signs off. Every approval is timestamped, which gives you a record.
An AI draft checker that flags spelling, profanity, religious sensitivities and banned words before your reviewers look.
Payouts to agents, dealers and outside partners through Airwallex. For employees, many companies prefer to add rewards through payroll.
Each person counts as one active participant and users are unlimited. See pricing; networks of 150 or more people are on Enterprise.
Frequently asked questions
What should a social media policy for employees include?
Purpose and scope, rules for personal and official accounts, disclosure of employment, confidential information, prices and claims, harassment, approval for work content, privacy of customers and colleagues, any rewards, and consequences. Keep it to one or two pages.
Can a company control what employees post on personal social media?
A company can set rules for posts that relate to work, such as confidential information, customer privacy and how staff represent the company. How far that goes depends on your employment contracts and the law, so have your policy reviewed by your legal or HR adviser.
Do employees need approval before posting about the company?
For general posts about working life, usually not. For posts featuring products, prices, promotions, projects or clients, approval before posting is good practice and protects staff from honest mistakes.
Is there a free social media policy template for Malaysian companies?
Yes, the template in this article covers the main sections Malaysian companies use, including PDPA and privacy. Adapt it to your business and have it reviewed by your legal or HR adviser before issuing it.
Put your policy into practice
Brief, approve and keep a record of every post from your employees, agents and partners with ViaCRM. Tell us about your team on WhatsApp.
How to plan and run an employee advocacy programme in Malaysia: goals and KPIs, roles, a 90-day launch plan, policy, rewards, measurement and partner networks.
How to encourage employees to post on social media: why staff hold back, a 7-step plan that makes posting safe and easy, content ideas, and mistakes to avoid.
Why property developers, insurers, takaful operators and car brands should approve agent and dealer social media posts, plus a practical approval workflow.
