Rules and ethics
Part of What are the UK corporate social media disclosure rules?
What are the UK corporate social media disclosure rules?
How the FCA, ASA, FRC and Companies Act 2006 apply to corporate social media, and the checks a UK comms team should run before any post goes live.
What to take away
- There is no single UK rule for corporate social media. Obligations come from company law, financial regulation, advertising codes and data protection law.
- For listed companies, inside information must go to a regulatory information service. A post is not a substitute, and posting first creates a selective disclosure risk.
- Paid brand posts and controlled influencer posts sit inside the ASA's CAP Code, so they must be obviously identifiable as ads.
- Personal data in posts, from staff photographs to customer comments, is covered by the UK GDPR and the Data Protection Act 2018.
- No post should go live without a named owner, an approval gate and a correction route.
Where the UK rules come from
A corporate account is not regulated by one body. Which rules apply depends on what the company is and who reads the post. A private software firm faces the advertising codes and data protection law. A company with listed shares also faces the FCA.
Which rules apply to you
Private software firm
- Advertising codes
- Yes
- Data protection law
- Yes
- FCA rules
- No
- Companies Act duties
- Directors
Listed company
- Advertising codes
- Yes
- Data protection law
- Yes
- FCA rules
- Yes
- Companies Act duties
- Directors
The Companies Act 2006 is often cited as if it policed social posts. It does not create a social media regime. It sets directors' duties and the records a company must keep, and those duties attach to what a director approves, whatever channel carries it: Companies Act 2006, Part 10.
Most problems start before a post is written, when nobody owns the approval. The corporate communications strategy and planning guide shows how gates and rollback fields keep that ownership visible.
| Rule set | What it covers | Typical trigger |
|---|---|---|
| FCA rules, including UK MAR and financial promotion rules | Inside information and promotional claims | A listed company or regulated firm posting price-sensitive or promotional content |
| ASA and the CAP Code | Advertisements in UK media | Paid posts, gifted content, influencer campaigns |
| Data protection law | Personal data in posts | Staff photographs, customer quotations, replies to comments |
| Companies Act 2006 | Directors' duties and the statutory record | A director approving a statement that misleads |
What the FCA expects from listed companies
Inside information must be announced through a regulatory information service as soon as possible. Posting the same news from a personal account first creates a selective disclosure problem, even if the post is deleted minutes later.
The provision behind that rule is Article 17 of the UK Market Abuse Regulation (UK MAR), which requires an issuer to inform the public of inside information as soon as possible. The FCA's Disclosure Guidance and Transparency Rules, DTR 2, cover how issuers control and announce it.
An issuer may delay disclosure only if three conditions are all met: immediate disclosure would prejudice its legitimate interests, the delay is unlikely to mislead the public, and confidentiality is kept. A social post is not a way to manage that delay, because a leak onto social media ends the confidentiality condition.
Regulatory information services are the approved channels for the announcement. Examples include the London Stock Exchange Group's Regulatory News Service (RNS), Business Wire and PR Newswire. Check the FCA's current list before relying on a provider.
Financial promotions have their own statute. Section 21 of the Financial Services and Markets Act 2000 restricts communicating an invitation or inducement to invest unless the sender is authorised, an authorised person approves the content, or an exemption applies. The FCA's supervisory guidance on financial promotions in social media (FG15/4) treats a post as a communication to clients. The fair, clear and not misleading standard applies in a short post just as it does in a brochure.
The FRC's UK Corporate Governance Code, updated in 2024, covers how boards engage with stakeholders. It names no platform, and it applies on a comply or explain basis to companies listed in the commercial companies or closed-ended investment funds categories of the UK Listing Rules.
When a corporate post becomes an advert
The CAP Code covers marketing communications in UK media, and social platforms sit inside that scope. A paid post from a brand account is an ad. So is an influencer post the brand pays for or controls.
Organic posts turn on context. If a post is clearly promotional and the brand controls it, the ASA can treat it as an ad even when no money changed hands. That is why an ad label matters on a company account too.
Naming people or repeating a third party's claims brings two more statutes into play. The Data Protection Act 2018 sits alongside the UK GDPR and governs personal data in a post. Section 10 of the Defamation Act 2013 limits actions against people who are not the author, editor or publisher of a statement.
A pre-post check for UK corporate accounts
- Classify the post as a statutory announcement, a financial promotion, marketing or general comment. The class decides the reviewer, not the channel.
- Check the facts against a signed source. If the source is still a draft, the post waits.
- Confirm the lawful basis for every name, photograph and quotation before publishing.
- Record the approval decision with a date and the name of the approver.
- Set the correction routewho edits, deletes or replies, and within what time.
Ownership is the part most companies get wrong. The person who signs off a statutory announcement is rarely the person who runs the account. Our guide to what a UK corporate communications manager does covers where that boundary usually falls.
Common questions
Do UK companies have to disclose their social media accounts?
No blanket duty requires it. The statutory record is the accounts filed at Companies House and, for listed companies, announcements made through a regulatory information service. Naming official accounts in a policy is good practice rather than law.
Does the Companies Act 2006 cover social media posts?
Not directly. The Act governs directors' duties and company records. A director who approves a misleading post can still fall short of the duty of care in section 174.
Does the ASA regulate organic posts from company accounts?
Sometimes. The CAP Code covers advertisements in UK media, and the ASA decides case by case whether a post is promotional and controlled by the brand.
Who owns the disclosure decision?
Usually the company secretary for anything price-sensitive and the comms lead for everything else. In smaller firms one person often holds both roles.
