What may be posted about work and customers on social media?

In brief

You may post about work or customers on social media only when no person is identifiable, or when the organisation has a GDPR-compliant reason for publishing the personal data. A person can be identifiable directly, such as by name, or indirectly, such as by a face, role, location or a customer story that points to one person. An unauthorised post can be a personal data breach if personal data is accidentally or unlawfully disclosed or made available. The GDPR's Article 33 can then require notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours after the controller becomes aware of the breach.

A social media post is personal data processing if a person can be identified

A social media post becomes a data protection matter when it tells something about an identifiable person. This is broader than many workplace rules assume.

The GDPR's Article 4 defines personal data through identification. A name is the obvious case. A face in a photo can be enough. A work role can be enough if only one person has that role. A customer visit can be enough if the place, date and details point to one person.

Processing is also broad under the GDPR's Article 4. It includes collecting, storing, using, disclosing by transmission, spreading or otherwise making data available. A post on a public channel is therefore not just communication. It is processing personal data when a person can be identified.

A simple workplace test is useful:

Planned post	Data protection view
A photo of an empty meeting room	Usually not personal data if no one is identifiable
A group photo from a staff day	Personal data if employees are identifiable
A customer quote with the customer name	Personal data because the customer is identified
A customer story with rare details but no name	Personal data if the person is identifiable from context
A screenshot that shows an email address	Personal data if it relates to a person

The same rule applies to internal and external channels. A post in a closed workplace group can still make personal data available to recipients. The practical difference is the risk and the audience, not whether the GDPR applies.

For the basic test of identifiability, see also What is personal data, and when does it stop being personal data?.

A post needs a legal basis, a purpose and limits

If a person is identifiable, the organisation needs more than a good story. It needs a legal basis under the GDPR's Article 6. The article lists the bases for lawful processing. They include consent, contract, legal obligation, vital interests, a task in the public interest or exercise of official authority, and legitimate interests. Public authorities cannot use legitimate interests for processing carried out in the performance of their tasks.

The legal basis is only one part of the assessment. The GDPR's Article 5 sets the principles for processing. In social media work, three principles are usually the first to check.

• Purpose limitation: the organisation needs a specified, explicit and legitimate purpose. A photo collected for an access card is not automatically available for a campaign post.
• Data minimisation: the post should contain only what is necessary for the purpose. A customer success story may not need the customer's full name, photo, location and service history.
• Integrity and confidentiality: personal data must be handled in a way that protects it from unauthorised or unlawful processing.

The controller is the body that decides the purposes and means of processing. In plain terms, it is the organisation that decides why the post is published and how. A processor acts on the controller's behalf. For example, a social media agency may be a processor if it publishes material under the organisation's instructions.

Consent is sometimes used for social media publishing. Under the GDPR's Article 4, consent must be voluntary, specific, informed and unambiguous. This matters at work because an employee may feel pressure to agree. A decision-maker should therefore avoid treating consent as a simple formality.

For a deeper explanation of the bases, see What legal basis permits processing personal data?.

Posting about customers needs special care

Customer posts often carry more risk because they can reveal a need, a service relationship or a life situation. A named customer testimonial is personal data. A photo from a service desk can reveal who visited. A story about a rare service event can identify the customer even without a name.

The GDPR's Article 9 adds a stricter layer for special categories of personal data. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about a natural person's sex life or sexual orientation. Processing this data is prohibited unless one of the Article 9 exceptions applies.

This is why customer stories in health, social welfare, education, recruitment, housing, debt advice or similar settings need a stricter review before publication. The risk is not only that the customer is named. The risk is that the post reveals sensitive facts about the customer through context.

A practical assessment should ask:

• Can the customer be identified directly or indirectly?
• Does the post reveal a service relationship or other personal situation?
• Does the post include special category data under the GDPR's Article 9?
• What is the legal basis under the GDPR's Article 6?
• Is every identifying detail necessary for the purpose?
• Has the customer received the information required by the GDPR's Articles 13 or 14, unless an exception applies?

The safest customer publication is often one where the learning point or result is described without identifying the person. If the person remains identifiable, the organisation needs the full GDPR assessment.

Work can be described when people are not revealed unnecessarily

Workplace social media is not banned by the GDPR. The key question is whether the post reveals personal data and whether that revelation is necessary and lawful.

A post about a project milestone may not need employee names. A picture of equipment may not need badges, screens or email addresses in the background. A recruitment post may not need a current employee's face if the purpose is to describe the role. These are data minimisation decisions under the GDPR's Article 5.

Employees are data subjects when their personal data appears in a workplace post. The organisation remains responsible for the processing when it decides to publish on its own channel. The GDPR's Article 5 also includes accountability. This means the controller is responsible for compliance and must be able to show it.

A useful workplace rule is to separate three cases:

• No identifiable person: the GDPR personal data rules do not drive the post.
• Identifiable person and ordinary personal data: the post needs an Article 6 basis, a purpose, transparency and minimisation.
• Identifiable person and special category data: the post also needs an Article 9 exception.

Supervisors often need a similar mindset when they handle employee data outside social media. See A supervisor's data protection duty: what may be collected, viewed and asked about an employee.

An unauthorised post can be a personal data breach

A personal data breach is not limited to hacking. Under the GDPR's Article 4, it can include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. In everyday work, an accidental post can therefore be a breach.

Examples include:

• a customer list is posted in a screenshot;
• a photo reveals a visitor badge;
• a staff health detail appears in a caption;
• a customer case is described so precisely that the person is identifiable;
• an employee posts personal data on a channel without authorisation.

The controller must assess the breach. Under the GDPR's Article 33, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. If the notification is not made within 72 hours, reasons must be given.

The GDPR's Article 33 also says that a processor must notify the controller without undue delay after becoming aware of a personal data breach. This matters when an agency, outsourced service provider or platform-related contractor handles posts for the organisation.

The controller must document all personal data breaches under the GDPR's Article 33. The documentation must cover the facts, effects and remedial action so that the supervisory authority can verify compliance.

If the breach is likely to result in a high risk to natural persons' rights and freedoms, the GDPR's Article 34 requires the controller to communicate the breach to the affected data subject without undue delay. Article 34 also lists cases where that communication is not required, such as when suitable protection measures have made the data unintelligible to unauthorised persons.

For the notification timeline, see Personal data breach: the 72 hours start when an employee notices.

A post can start data subject rights

A social media post can trigger a data subject request. The data subject may ask whether their personal data is being processed. They may ask for access, correction, erasure, restriction or portability, depending on the situation.

The GDPR's Articles 12 to 20 set these rights and the response rules. Under Article 12, the controller must provide information on action taken without undue delay and in any event within one month of receiving the request. That period may be extended by up to two further months when necessary, taking into account the complexity and number of requests. The controller must tell the data subject about the extension within one month of receiving the request and give the reasons for the delay.

Erasure is often the most practical issue after a social media post. Under the GDPR's Article 17, the data subject has the right to have personal data erased without undue delay when one of the listed grounds applies. Grounds include that the data is no longer needed, consent is withdrawn and there is no other legal basis, the processing is unlawful, or the data subject objects and there are no overriding legitimate grounds.

The right to erasure is not absolute. Article 17 also lists exceptions. These include processing needed for freedom of expression and information, a legal obligation, a task carried out in the public interest or exercise of official authority, certain public health reasons, certain archiving, research or statistical purposes, and legal claims.

This means a request to remove a post must be handled as a legal assessment, not as a pure communications choice. The organisation should know who receives the request, who checks the legal basis and who decides what happens to the post.

For request handling, see Data subject rights: when a customer asks for their data, you have a month.

What the obligation does not mean and what remains open

The GDPR does not ban all workplace or customer-related social media. It does not require a data protection assessment for a post that contains no identifiable person. It also does not say that every unauthorised post must be notified to the supervisory authority. The Article 33 notification duty depends on whether the breach is likely to result in a risk to natural persons' rights and freedoms.

The GDPR also does not provide a ready-made list of allowed and forbidden posts. The same words or image can be harmless in one context and identifying in another. A small town, a rare role, a visible location or a timing detail can change the answer.

A legal basis does not remove the other requirements. The post still needs a purpose, transparency, minimisation, security and accountability under the GDPR's Article 5. If special category data is involved, the Article 9 prohibition and exceptions must also be considered.

The sources used here are the GDPR's Articles 4, 5, 6, 9, 12 to 20, 33 and 34. Other laws, sector duties, employment rules and confidentiality duties may also matter in real cases, but they are outside this article.

The key control for a decision-maker is a shared way to assess posts

The main management problem is not one difficult post. It is inconsistent judgement across teams. Marketing, customer service, supervisors and project staff can all create posts. If they use different tests, the organisation gets avoidable risk.

A shared assessment method should be simple enough for daily work. It should answer the same questions every time:

• Is any person identifiable directly or indirectly?
• What personal data is included?
• Is any special category data included?
• What is the purpose of the post?
• What is the Article 6 legal basis?
• Is each identifying detail necessary?
• Has the data subject received the required information?
• Who approves the post when the risk is not obvious?
• What is the internal route if a post may be a personal data breach?

This is a data protection control, not only a communications policy. It helps the controller show accountability under the GDPR's Article 5. It also helps staff react quickly when a post has already gone live and may be a personal data breach.