A staff social media policy: what employees may post about guests, the kitchen and the hotel
Define clear rules for guest photos, kitchen posts, and public replies. This guide provides a two-page policy template, incident steps, and a signature page to protect your hotel and staff.
Contents
Key takeaways
- A staff social media policy for hotels earns its place by naming the four things staff actually get wrong: guest images, guest data on screens, back-of-house conditions and speaking for the hotel.
- Permission to use a guest's photo must be specific, informed and given to the hotel, not to the employee who took the picture.
- Name the people who may answer publicly, and give everyone else one routing rule they can remember.
- A policy must never stop an employee reporting a genuine safety or legal problem to the authorities.
- Every incident follows the same order: preserve, ask, assess, escalate, listen, record, review.
A staff social media policy is a short written rule set, signed by every employee, that says what may be posted about guests, back-of-house work and the hotel itself, who may speak for the hotel, and what happens after a post goes wrong. Keep it to two pages and review it yearly.
A server plates a dessert, frames the shot, and behind the plate sits a guest's hand and a room key with the number showing. The post takes ten seconds; the conversation about it takes a week, and without a written policy it turns into an argument about who is allowed to be annoyed. This article gives you the two pages to write: the rules, the routing, the signature page and the incident sequence, so the next argument is about a rule everyone signed.
Do you actually need a written social media policy for hotel staff?
Yes, because the alternative is a set of unwritten rules that nobody can check and that change with whoever is on shift. A written policy turns a disagreement about taste into a conversation about a rule everyone signed.
Say in one sentence what the document is for: protecting guests, colleagues and the hotel's commercial information, not controlling what staff think. Keep it to two pages. A policy nobody reads protects nobody; the detail belongs in the employee handbook, and the policy points to it.
Set the scope explicitly: permanent, seasonal, part-time, interns, outsourced housekeeping and contractors, plus managers, who are held to the same rules and one more, the duty to act on reports. The document does three things: it sets expectations, it names a person to ask before posting, and it records that the employee read it.
State plainly what the policy cannot do. It does not replace legal advice, it does not override an employment contract or a collective agreement, and it does not decide consequences; those are handled under the handbook with counsel. Write it technology-neutral: describe the behaviour (publishing, sharing, filming, messaging) rather than listing platforms, so it does not expire when the platforms change.
May staff post photos of guests?
No, not without permission that is specific to that use and given to the hotel. A guest's face, name, room number or bill is personal data, and a friendly wave across the lobby is not permission to publish.
Define personal data in plain words at the top of the policy: anything that identifies a person or can be combined to identify them, including an image, a name, a room number, a date of stay, a vehicle plate or the text of a complaint. Consent is not transferable. The guest gives permission to the hotel for a stated use, this post, this channel, this campaign, and can withdraw it; an employee cannot grant that permission on the hotel's behalf. The same logic covers guest and staff photos more broadly, including events.
Most trouble comes from the accidental cases: the guest in the background of a pool photo, the hand and key card in a food shot, the reflection in a window, the name on a welcome card. Treat screens as strictly as faces. A screenshot of the reservation system, the guest list, a bill or an internal chat is never postable, even with the name blurred, because the rest of the screen usually identifies someone.
Handle children separately and more strictly: no images without a parent or guardian's written permission, and never in swimwear, bedrooms or identifiable locations. Add the rule staff forget: a guest's own public post is not a licence to reuse their photo on the hotel's account. Ask in writing and keep the reply. The same caution extends to AI chat tools: pasting a guest message or a screenshot into a chat assistant is publishing it outside the hotel, a rule worth covering in your hotel AI policy.
ChecklistThe one-page "never post" checklist staff can keep at the desk
- No guest faces, even in the background, without documented permission for that specific use
- No room numbers, floors, key cards or door codes
- No screenshots of the reservation system, guest list, bill or internal chat
- No names, ID or passport details, phone numbers, email addresses or vehicle plates
- No images of children without a parent's written permission, and never in swimwear or bedrooms
- No text of a guest complaint or a guest's private message
- No reposting a guest's photo without written permission
What may staff post from the kitchen and back of house?
The craft, yes; the workings, no. A photo of a dish being finished shows pride in the job, while a photo of the same kitchen mid-service can show a hygiene problem, a colleague's face and the layout of the building at once.
| Area | Fine to post | Not fine to post |
|---|---|---|
| Kitchen and food | A finished dish, a technique, a clean station with no people | Storage, pests, injuries, hygiene records, colleagues mid-rush |
| Colleagues | A group photo with everyone's agreement | Filming a coworker without consent; anything about pay or discipline |
| Security and keys | Nothing | Cameras, key storage, safe, staff entrance |
| Commercial information | A public menu item already on the website | Unpublished prices, supplier terms, occupancy, in-house guest names |
| Maintenance and incidents | A finished repair, after the fact | An active leak, a fire panel, an evacuation |
Write into the policy that nothing in it prevents an employee from raising a genuine safety, hygiene or legal concern with management or with the authorities. A policy that reads as a gag will be treated as one. And give the impulse somewhere to go: a shared folder or a named person who collects good photos for the hotel's own accounts.
Who may speak for the hotel, and what about private accounts?
Name the roles that may answer publicly, in writing, and give everyone else one routing rule: listen, screenshot, send it to that person, do not reply. Private accounts stay private until the account identifies the hotel or the post uses something the employee only knows because of the job.
The hotel's own accounts
List who holds the passwords, who may post without review, who may reply to a complaint, and who may offer compensation. A reply that promises a refund the hotel will not give is worse than no reply. For guest complaints in public: acknowledge once, politely, move the conversation to a direct channel, and never argue, never confirm whether the person stayed, and never discuss a bill in public.
An employee's own account
An employee's account becomes the hotel's voice when the bio names the hotel, the uniform is in the photo, or the post answers a guest as if from the hotel. Say so, and say the reverse too: an opinion posted from a clearly personal account is not the hotel's position. Press, influencers and anyone asking for a statement go to the named person, with a holding line staff may use word for word.
Working hours and time off
The policy governs conduct that touches guests, colleagues or confidential information, not private opinions. Posting during a shift is a working-time question for the handbook. Say that respectful, lawful criticism of working conditions is not by itself a breach, then let counsel confirm the wording against the employment contract.
Watch outThree things the policy must not ask for
An employee's passwords, an employee's phone or login, and a blanket permission to use the employee's own image forever. Each of these turns a work rule into a legal problem, and each is common in templates copied from other industries.
What do you do when an employee's post goes viral?
Run the same sequence every time, in the same order, and write it down before you need it. Improvising under pressure is how a ten-minute problem becomes a public one.
Checklist
- 1. Preserve the post with the date, time and address, plus the replies. Do not edit, do not delete, do not ask the employee to delete before you have a record.
- 2. Ask the employee in writing to remove it, without threats. A demand sent in anger is itself evidence.
- 3. Assess four questions: is a guest identifiable, is a child involved, is a colleague identifiable, and is commercial information exposed.
- 4. Escalate to the named person and to counsel.
- 5. Check the data-protection position with your adviser; if personal data has been exposed, that side has its own decision-maker and its own timing.
- 6. Hear the employee and record the account the same day; a decision made without that record rarely holds.
- 7. Brief the team in general terms, fix the gap the incident exposed, set a review date.
The employee conversation matters most. Hear what happened, whether they were asked, whether they were trained, and write it down the same day. What follows a refusal or a repeat belongs to the disciplinary procedure, and the rules for written warnings apply to it like any other case.
The signature page: what staff actually sign
One page, plain language, signed and dated, re-signed whenever the policy changes. The signature is not a promise of loyalty; it is a record that the person was told the rules and knew who to ask.
The acknowledgement says three things: I have read the policy, I had the chance to ask questions, and I know who to ask before posting something uncertain. Keep the wording narrow. A statement that the employee will follow the policy is normal; a waiver of legal rights, a blanket consent to use the employee's image, or an agreement to monitoring beyond what the policy describes is not, and counsel should see the page before it is used.
Key pointWhat goes on the signature page
Policy title and version; a one-line summary of the four rules; the named person to ask before posting; the named person to report a post to; the acknowledgement sentence; signature, printed name, role and date; a line for the person who explained the policy.
Record the practical details: name, role, date, the version number, and whether the person received a copy or only a link. Cover seasonal and outsourced staff on their first day, not at the end of the season. Review yearly and after any incident, change the version number, and re-sign; a signature against a version nobody can produce later proves very little. Say where consequences live: the handbook and the disciplinary procedure, applied with counsel, not this page.
What to do next
Draft the two pages this week, starting with the "never post" checklist and the routing rule, because those two carry most of the weight. Have counsel read the signature page and the consequences sentence before anyone signs, then put the policy beside the handbook, set a yearly review date, and treat the first incident as a test of the document rather than of the person.
Frequently asked questions
Can a hotel ban staff from using social media altogether?
A blanket ban is hard to justify and harder to enforce, because it reaches into off-duty life where the hotel has little standing. A policy that targets conduct touching guests, colleagues and confidential information is both more defensible and more useful. Have counsel check the wording against the employment contracts.
Do we need a separate policy for messaging apps and short video?
No. One policy written around behaviour, publishing, sharing, filming and messaging, covers new platforms without amendment. Listing platform names dates the document within a year and invites arguments about whether an unlisted app counts.
Can we make an employee delete a post?
You can ask, in writing, and you should record the request. You cannot edit or delete it yourself, and you should not threaten. What follows a refusal belongs to the disciplinary procedure and to counsel, and the policy should say so rather than implying an automatic outcome.
If a guest posts a photo of our hotel, may we repost it?
Not automatically. A public post is not permission to reuse the image in the hotel's own marketing. Ask the guest in writing for permission covering the specific use, keep the reply, and treat images of children as a separate and stricter case.
How often should the policy be reviewed?
Once a year and after any incident, with a new version number and a fresh signature. Reviews should check three things: whether the named people are still in those roles, whether the rules match how staff actually work, and whether the training still happens.