Social media policy for schools

What requires a school social media policy

No statute says a school must have a document called a social media policy. The requirement arrives through safeguarding guidance, in two places.

The first is the staff behaviour policy. Paragraph 123 of Keeping children safe in education 2026 lists the policies every school should have, and says the staff behaviour policy, sometimes called the code of conduct, "should, amongst other things, include low-level concerns, allegations against staff and whistleblowing, plus acceptable use of technologies (including the use of mobile devices), staff/pupil relationships and communications including the use of social media". Governing bodies and proprietors must have regard to KCSIE, and the policy is given to all staff at induction.

The second is online safety. KCSIE paragraph 164 calls for "an effective whole school and college approach to online safety", and paragraph 169 says the school's approach should be reflected in the child protection policy. Paragraph 165 groups online risks into four areas, content, contact, conduct and commerce, and paragraph 169 says considering those 4Cs will provide the basis of an effective online policy. Social media is where most of those risks reach pupils.

Behind both sit the school's data protection duties, because every photograph and every name posted on a school account is personal data, and the professional standard KCSIE paragraph 10 draws from the Teachers' Standards: that teachers should safeguard children's wellbeing and "maintain public trust in the teaching profession".

So in practice a school social media policy is either a standalone document that the code of conduct and the online safety policy point to, or a section in each of them. Either works, and a template from a local authority or trust is a reasonable place to start. What matters is that the four audiences below are each covered once, consistently, and that staff can find the rule that applies to them. This guide is written for schools in England; schools in Wales, Scotland and Northern Ireland should read their own governments' guidance.

What the policy covers in practice

A school social media policy that works covers four groups, and says clearly which rules apply to which:

• The school's official accounts. Why each exists, who may post, who approves, how comments are handled, and what is never posted.
• Staff, governors and volunteers in their own lives. Personal accounts, contact with pupils and former pupils, talking about the school, and the line between private opinion and professional conduct.
• Pupils. How the school teaches online safety, how it responds to cyberbullying and harmful content, and how conduct online outside school is handled under the behaviour policy.
• Parents, carers and the wider school community. Photographs at school events, parent groups, and what the school does when a parent posts about a member of staff or another child.

Each of those links to a policy the school already has. Staff personal use belongs with the code of conduct, the acceptable use agreement staff sign for school technology, and the staff–pupil communication rules; pupils' conduct with the behaviour policy, which KCSIE says must include measures to prevent bullying, including cyberbullying; parents with the complaints procedure and the home–school agreement. A social media policy that restates all of them in full will drift out of step with each; one that states the social media rule and points to the rest will not.

Draft it in terms of behaviour, not platforms. A list of named apps is out of date within a year. A rule that says staff do not use any personal account to communicate with a pupil will still be right when the next platform arrives.

The school's own accounts

Before a school opens an account, the policy should make it answer the question an honest plan starts with: is there a need for this, and what does it offer that the school's website, email and parent communication system do not? A school newsletter on a social media platform reaches parents who follow it; it also reaches everyone else, and it invites comments the school then has to moderate.

Where the school does use social media, the policy should set out:

1. Purpose and audience for each account: celebrating pupils' work, sharing events, recruitment, community news.
2. Who manages it. Named staff who may post, a senior leader who approves new accounts, and the headteacher's authority to take a post down.
3. An account register. Every account in the school's name, who holds the login and password, that two-factor authentication is on, and what happens when a member of staff who manages one leaves. Accounts set up by a keen department years ago are a common way for a school to lose control of its own name.
4. School devices. Posts made from school devices, not staff personal phones, so photographs of pupils are not stored on personal cameras.
5. Photographs of pupils. Consent recorded for each pupil where consent is the basis, refusal respected without cost, no full names beside images, and a check before every post against the list of pupils who must not appear, which includes some looked-after children and children subject to court orders. The school's privacy notice should describe this use.
6. Comments, moderation and messages. Whether comments are open, who moderates them, when a user is blocked or the content reported to the platform, and a rule that complaints, concerns and anything about an individual pupil are taken offline to the proper route. The school does not argue in public.
7. What is never posted: personal data about pupils beyond what is agreed, anything that identifies a pupil's location in real time, party political content, and anything that would breach the school's data protection obligations.

Keep a simple log of incidents on official accounts: what was posted or received, who responded, what was reported and to whom. A negative comment handled calmly and recorded is a small matter; the same comment deleted without a record, during a live complaint, can become a larger one.

Staff, governors and volunteers in their own lives

Staff are entitled to a private life online, and the policy should say so before it sets limits. The limits come from safeguarding and from professional conduct, not from the school's reputation alone.

• No contact with pupils through personal accounts. Staff do not friend, follow, message or accept requests from current pupils on personal social media, and the policy should say how to handle a request or message from a pupil when one arrives: do not reply, keep the evidence, tell the designated safeguarding lead.
• Former pupils and pupils' families. Say what the school expects, including contact with pupils who have recently left and with parents who are also friends, rather than leaving staff to guess.
• Nothing about pupils, parents or colleagues. No photographs of pupils on personal accounts, no discussion of identifiable school matters, no comments about colleagues that would be misconduct if said in the staffroom.
• Privacy settings and identity. Encourage staff to review their settings and to be cautious about naming the school on personal social media profiles. A professional profile on LinkedIn that lists the school as an employer is ordinary; a senior leader who names the school on an account used for opinions is, to many readers, speaking for it.
• Raising concerns. A concern about the school is raised through the whistleblowing or complaints route, not on social media, and the policy should make those routes easy to find.

The same expectations apply to governors, trustees and volunteers, adjusted for their role. A governor who comments on a school matter on a personal account can easily be read as speaking for the governing board.

Breaches are handled through routes the school already has. A post or message that is inconsistent with the code of conduct but does not meet the harm threshold is a low-level concern; one that suggests a risk to children is an allegation, managed under Part four of KCSIE. The social media policy should name those routes rather than invent a new one.

One recruitment point belongs here too. KCSIE paragraph 301 says schools should consider an online search on shortlisted candidates as part of due diligence, and should tell candidates that such searches may be done. The social media policy is a sensible place to state that the school does this and why.

Pupils, parents and posts about the school

For pupils, the policy's job is to connect social media to the online safety curriculum, the behaviour policy and the child protection policy. KCSIE paragraph 170 says all schools should be mobile phone-free environments by default, so most pupils' social media use happens outside the school day, and the behaviour policy should say how the school responds to online conduct outside school that affects pupils or staff. Harmful content, contact from adults and the sharing of images go to the designated safeguarding lead, under the child protection policy, not to a pastoral conversation.

For parents, the policy should start with what the law actually says about photographs at school events, because it is widely misunderstood. The ICO's guidance is that data protection law does not apply to purely personal or household activity, so a parent filming a nativity play for the family is not breaching anything. Posting to a private account seen only by friends and family is likely to be personal use; posting to a public account, viewable by an indefinite number of people, is likely to go beyond it. A school may still set its own rules on photography at events for safeguarding reasons, and should explain them.

KCSIE paragraph 172 also expects schools to use their regular contact with parents and carers to reinforce the importance of children being safe online, including what the school's systems do and who from the school, if anyone, their child will interact with online.

The harder case is the parent who posts about a member of staff, or about another child. The policy should say, calmly and in advance:

1. Concerns about the school go through the complaints procedure, which is the route that can actually resolve them.
2. The school will not respond to criticism on social media, and staff should not reply personally.
3. Posts that amount to harassment, are abusive or threatening, or identify another child will be addressed directly with the parent, and may be reported to the platform, which has its own duties under the Online Safety Act 2023.
4. The school will support any member of staff who is targeted, including with advice on reporting, and will record what happened.

Parent WhatsApp and Facebook groups are run by parents, not the school, and the school is not responsible for them. It is worth saying that plainly in the policy and in communications with parents, alongside the route for raising anything about a child that belongs with the school, and the reminder that a parent group is not a way to contact the school.

Staff group chats about pupils

Most of what staff write about pupils is never posted anywhere public. It is in the year-team group chat, the thread for a residential trip, the message to a colleague after a difficult lesson. KCSIE brings that messaging inside the policy. Paragraph 123 puts "acceptable use of technologies (including the use of mobile devices)" and "staff/pupil relationships and communications including the use of social media" in the staff behaviour policy, and paragraph 164 describes an approach to online safety that protects and educates "pupils, students, and staff in their use of technology". A policy that covers the school's page and staff's personal accounts, but not the groups staff use to talk about pupils, has left out the part closest to safeguarding.

The first question is where a concern goes. KCSIE paragraph 74 says that "All concerns, discussions and decisions made, and the reasons for those decisions, should be recorded in writing", and paragraph 62 that staff "should not assume a colleague or another professional will take action and share information that might be critical in keeping children safe". A year-team chat in which a head of year mentions what a pupil said at lunchtime, and five colleagues reply, has met neither expectation: the concern has reached everyone except the designated safeguarding lead, and nobody has recorded it. The policy should say plainly that a worry about a pupil raised in a group chat is still reported to the DSL straight away, through the school's usual route, by the person who raised it, and that the chat is not the record.

The second question is who the audience really is. In a school, what staff write about a pupil has two readers beyond the colleagues it was meant for: the pupil and the parents. A remark about a family, a nickname for a pupil or a photograph of pupils' work that shows their faces is personal data the school controls, and it can reach the family through a screenshot or a subject access request. The code of conduct does not lapse because a message was sent in the evening from a personal phone: KCSIE's definition of a low-level concern includes conduct "inconsistent with the staff code of conduct, including inappropriate conduct outside of work", and one of its examples is "taking photographs of children on their mobile phone, contrary to school policy". The simplest rule to write down is that nothing about a pupil goes in a staff group that the writer would not be content for the pupil's parents to read.

The third question is who is in the group. A PE or trip group that includes parents, run from a teacher's personal number, is the school talking to families through something it does not run. The policy should either move those groups onto a school route or say who may run them, what may be said in them and which other member of staff is in them, in line with the school's rules on communicating with pupils and parents. No staff group, on any platform, includes pupils.

A school can set those rules in the policy and also give staff somewhere for school conversations that the school runs. ComplyChat is designed for that: staff and school conversations in a channel the school controls, recorded on the server as they are sent, with everyone added told that the channel is on the record. On paid plans, support staff, supply colleagues and volunteers without a school account can join with a mobile number verified by SMS, and the lasting record files into the school's own Microsoft 365 once its tenant is connected. It is not a social media management tool, it does not replace the school's public accounts, its learning platform or the DSL's safeguarding records, and it is not a channel for pupils.

A question for the next leadership or governors' meeting: if a concern about a pupil was raised in a staff group chat last term, did it reach the DSL and the child's file, and could the school show that it did?

Official guidance and your next step

The primary source is Keeping children safe in education 2026: paragraphs 62 and 74 on sharing and recording concerns, paragraph 123 on the staff behaviour policy, paragraphs 164 to 172 on online safety, mobile phones and parents, paragraph 301 on online searches of candidates, and paragraph 509 on low-level concerns. For photographs, read the ICO's guidance on taking photos in schools, and for the wider data protection duties the DfE's data protection in schools guidance. Quotations here are from those documents as read on 25 and 26 September 2026.

This guide is a practical summary for schools in England, not legal advice on a particular post, dispute or allegation. Where a post may be defamatory or harassing, or may be a safeguarding matter, take advice before acting.

Then do one thing: list every social media account in the school's name, who holds its login and whether two-factor authentication is on. Any account nobody can answer for is the first item for the policy review.