Social media misconduct - what employers and employees each need to get right? Part 2
In part 1 of this article, Social media misconduct - what employers and employees each need to get right? Part 1, we cover the legal position on social media misconduct and the changes arriving this autumn and next January. In this part, we look at what a social media policy needs to do, how to investigate before reacting, and what employees and anyone on the receiving end should know, including where the criminal law applies.
What a policy has to do now?
A policy sitting unread in a handbook has never been much of a defence. From this autumn it is close to worthless. The shift is from having a policy to being able to prove it works.
A workable policy says what conduct is prohibited, gives examples, states plainly which behaviour is capable of amounting to gross misconduct, and explains that conduct outside working hours can be covered where there is a genuine connection to work. It addresses who owns work-related accounts, followers and contacts when someone leaves. It sets out how concerns are reported, and it is supported by training that is recorded, refreshed and actually delivered to managers.
The evidence trail is the point. Risk assessments, training records, reporting routes and prompt action all become the material you rely on when asked what else you could reasonably have done.
Investigate before you react
Acas published a redrafted Code of Practice on disciplinary and grievance procedures on 30 July 2026, the first full revision since 2009, with consultation running to 23 September 2026. It remains a draft and is not yet in force, but its direction of travel is informal resolution first, with greater use of mediation and facilitated conversations. That is sound instinct for social media disputes, most of which are better resolved by a conversation and a deleted post than by a disciplinary hearing.
Where formal action is needed, the basics still decide cases. Establish who actually posted the material. Preserve it properly. Consider context, tone and audience. Put the allegations to the employee and let them respond. Consider mitigation, length of service and lesser sanctions. Treat comparable cases consistently.
If you are the employee
Responsibilities run both ways, and employees underestimate theirs.
Anything you post can be read by people you did not intend to reach, and screenshots outlive deletions. A closed group is not private. Naming or identifying your employer raises the stakes considerably. Confidential information about your employer, colleagues or clients does not stop being confidential because you shared it socially and disclosing it may breach both your contract and data protection law. Posting about a colleague in terms connected to their race, sex, religion, disability, age, sexual orientation or gender reassignment can expose both you and your employer to a harassment claim.
None of that means you have no protection. Beliefs are protected, and so is the expression of them, within limits of proportionality. If your employer moves straight to dismissal over a post that caused no demonstrable harm, that decision is open to challenge.
Where the criminal law bites
A short factual note, because the position has changed and older summaries are unreliable.
Communications Act 2003, section 127(1): sending a grossly offensive, indecent, obscene or menacing message over a public electronic communications network. Still in force. The false message provisions in section 127(2)(a) and (b) were repealed for England and Wales in January 2024.
Malicious Communications Act 1988, section 1(1)(a)(i): sending an indecent or grossly offensive message. Still in force. The provisions covering threats and false statements were also repealed in January 2024.
Online Safety Act 2023: created a false communications offence and a threatening communications offence, both in force since 31 January 2024. The Act itself regulates platforms rather than individual users, and Ofcom does not adjudicate individual complaints about a post.
Protection from Harassment Act 1997: a course of conduct amounting to harassment, which carries both criminal penalties and a civil remedy, including injunctions and damages.
Sexual Offences Act 2003 (as amended), sections 66E and 66F: creating, or requesting the creation of, a purported intimate image of an adult without consent. In force since 6 February 2026, and it applies whether or not the image is ever shared.
Sexual Offences Act 2003 (as amended), section 66I: making, adapting, supplying or offering to supply a tool for generating purported intimate images, the so-called nudification apps. In force since 29 June 2026.
If you are on the receiving end
Preserve the evidence before it disappears, including URLs, timestamps and full-screen captures rather than crops. Report the content to the platform. Where a course of conduct is involved, the Protection from Harassment Act offers both a criminal route through the police and a civil claim. Where a post contains a damaging false statement of fact, defamation may be available, though the serious harm threshold is real and the limitation period is one year.
Whichever side of this you are on, the position usually turns on detail: what was said, who could see it, what connection it had to work, and what was done next. If a post has put your business or your job at risk, get in touch with Gareth Edwards, Partner in our Employment team before you act, and certainly before you dismiss.
This article was first produced as part of our LawNet membership. Find out more about our networks
Last updated:
Get in touch today
Are you looking for legal services?
Fill out our form to find out how our specialist lawyers can help you.