Government Social Media Policy: How to Write Posting and Response Rules

Why does a government body need a written policy for its accounts?

A government body’s official account is not a marketing page. What appears on it is read as an official position, and a reply to one citizen is seen by thousands. International practice therefore separates public communication, which serves the common good, from political communication tied to individuals and parties, and calls for that separation to the extent possible. ^[6]

The OECD notes that governments still use social media mainly to share information rather than to engage, and that communicators in most countries lack dedicated guidance for using it to meet strategic objectives. ^[6] A written policy is what closes that gap.

What differs across the GCC?

There is no single GCC rule for government accounts; each country has its own reference point:

• UAE: The Telecommunications and Digital Government Regulatory Authority has issued social media guidelines for government entities, which require entity accounts to be linked to the “Sharik” platform. ^[1] The official portal treats having a social media account as one of an entity’s digital maturity indicators, assessed every year, and the Digital Government Enablers guide recommends that every entity hold a verified account on the main platforms. ^[2] The Federal Authority for Government Human Resources, for example, bases its policy on the guidelines for secure use of social media by federal government employees, endorsed by Cabinet Resolution No. (73/3 m/1) of 2014. ^[3]
• Saudi Arabia: The National Cybersecurity Authority has issued the Organizations’ Social Media Accounts Cybersecurity Controls (OSMACC-1:2021). They extend the Essential Cybersecurity Controls and apply to government organisations and to private organisations that own, operate or host sensitive national infrastructure. ^[5]
• Other GCC states: check with your national government communication body and cybersecurity authority before adopting the policy.

Component one: who owns the account and who can access it?

The most damaging incidents are rarely a bad post. They are a hijacked account, or one an employee registered with personal details before leaving. So the policy starts with ownership:

1. Create accounts only with written approval from the responsible unit, after consulting IT, naming the platform, the staff responsible and the policies or services the account will cover. ^[4]
2. Register with official details: a dedicated official social media email address and an official mobile number, never personal information. ^[5]
3. Control access: a strong, unique password for each account, multi-factor authentication, access limited to specific devices, and rights granted on business need. ^[5]
4. Review access rights at least once a year, restrict service providers’ rights, and include non-disclosure and secure data removal clauses when a contract ends. ^[5]

Component two: the posting policy, who writes and who approves?

The posting policy starts from the strategy. The UAE guidelines recommend a strategy covering one or two years at most, with account goals linked to the entity’s goals and written to SMART criteria, a posting frequency set for each platform, and a tone consistent with the corporate identity while respecting the nature of each platform. ^[1]

For day-to-day work, set clear approval levels by how sensitive a post is:

The table is a template to adapt. The fixed rule is that the owner of the information checks its accuracy, while the communication team owns the wording and timing.

Component three: response and moderation rules

What you tell the public in advance protects you later. Publish participation terms, comment removal criteria and response times on the entity’s website. The UAE Federal Authority for Government Human Resources, for example, states that it removes comments that threaten security, breach public morality, violate privacy, harm or defame others, break the law, spread racism or are unrelated to its work, and that it may ignore or block offending accounts. ^[3]

The key distinction is that a negative but on-topic comment stays, while abusive, off-topic or unlawful content may be removed. ^[4] Deleting legitimate criticism turns one complaint into a story.

The policy should also set the moderation approach for each platform. The authority’s policy lists several: self-moderation by users, reporting by users, moderation by the account manager, pre-moderation before a comment appears, post-moderation after it appears, and automated keyword filtering with manual review. ^[4] Pre-moderation suits sensitive campaigns; post-moderation suits busy everyday accounts.

The same policy notes that most government information counts as a public record and that content posted by officials may fall within it, so classifying content helps with long-term storage and handling. ^[4] Keep a copy of official posts and replies in the entity’s own records rather than relying on the platform.

Response times should be published for each platform. The same authority, for instance, commits to replying within 24 hours on Facebook and LinkedIn, within one working day on Instagram, and within two working days for specialised legal enquiries on X. ^[3] Its policy also notes that account managers may need to respond outside working hours, which should be considered when selecting them. ^[4]

Hypothetical example: an angry comment on a service post

A service entity announces a new e-service, and a customer posts an angry comment saying their application has been stuck for two weeks, including their ID number.

• Hide the personal data, not the criticism: platforms do not let you edit someone else’s comment, so the comment is hidden or removed solely because of the ID number, the customer is told why and invited to repost without it, and the entity’s public reply stays visible.
• The public reply is short: an apology for the delay and an invitation to continue by private message, with no case details.
• In private messages the case is passed to the owning department and logged in the customer system, and the team comes back to the customer with the outcome.
• If several customers raise the same complaint, it goes to management as a sign of a service fault, not just a run of comments.

How do you measure performance?

The UAE guidelines suggest indicators tied to each goal: followers and reach for awareness; likes, shares and comments for engagement; visits to the website from social media; the share of e-service transactions originating from social media; and enquiries answered and average response time for customer service. ^[1]

The OECD observes that evaluation of government communication tends to focus on outputs such as coverage and reach rather than outcomes. ^[6] So include at least one indicator of real effect in your monthly report, such as the share of enquiries resolved or transactions generated.

Crises and compromised accounts

Set out two separate paths in the policy. The first is for a media crisis: who decides whether to stay silent or respond, who drafts the statement, and when scheduled posts are paused. The OECD reports that only 38% of the centres of government in its survey had a framework or policy guiding their response to mis- and disinformation. ^[6]

The second is for a technical incident. OSMACC requires a plan to recover the organisation’s social media accounts and requires staff to contact the cybersecurity department directly when a threat is suspected. ^[5]

Conclusion

A sound government social media policy is one clear document that fixes account ownership and security, the approval path for posts, and the response and removal rules published to the public. Start from your country’s national reference, then write response times and approval levels as numbers you can measure and review.