The first 24 hours: preserve evidence, ask for a voluntary takedown, appoint one spokesperson
On day one, do three things: capture complete evidence, ask the employee to delete or hide the post, and name a single person to speak for the company. Capture everything: the full post, the time it was published, the profile page, the key comments that link the company to it, and where it has spread through shares or screenshots on other platforms. Use both screenshots and screen recordings, and note who captured them and when. Do not rush into action with a single cropped image. Once the post is deleted, you will have nothing to rely on, whether you later need to discipline the employee or answer outside questions.
Then have the direct manager or HR speak with the employee privately. Explain that the company is aware of the post and the impact it is having, ask them to delete it or restrict its visibility, and schedule a time for them to explain the situation in writing. This is a request, not an order. The personal account belongs to the employee. The company has no right to operate it and must not demand the phone, the login or the password. Do not organize mass reports against the employee's account either. Most employees remove the post once they understand the consequences.
At the same time, appoint one internal contact for all external communication. Everyone else should stay out of the comments, avoid messaging netizens privately and avoid defending the company on their own accounts. Many controversies are inflamed by second-round replies from staff. If the post exposes client personal data, start your data incident process immediately, as covered in what to do after a customer data breach. That track carries notification duties and cannot wait for the internal investigation to finish.
Classify it: leak, harm to others, speaking for the company, or purely personal
The type of post determines how much risk the company faces and what it can lawfully do. The first type is a leak: client data, internal documents, unpublished prices or contracts, or a colleague's personal details. This carries the highest risk, touching data protection and contractual confidentiality, and may expose the company to third-party claims. It also gives the strongest basis for discipline. The second type harms others: insulting or disparaging customers, competitors or government offices, or discriminatory and harassing remarks. The injured party may pursue the author and may try to involve the company as well. The elements of liability are explained in defamation and cyber libel in the Philippines.
The third type speaks for the company without authority: the employee promises prices, services or outcomes, or gives an official-sounding position on company matters. Such posts can mislead the public and may even lead people to demand that the company honor what was said. The priority is a quick clarification and a check on whether the employee was ever authorized to speak externally. The fourth type is purely personal: an opinion on a non-work topic, posted on personal time, noticed only because a profile photo, bio or colleague's share identifies the employer. Here the company can do the least and should show the most restraint. Before any discipline, it must assess the actual link to work and any real harm to the company.
Record the classification in a short internal note with a list of the evidence. That note becomes the basis for any discipline or public response. Make the call together with HR and a lawyer rather than leaving it to the employee's direct manager, who is often the most upset person in the room.
Can you discipline? Only with a policy basis, a work connection and the two-notice process
Disciplining an employee over a social media post requires a clear policy basis, a reasonable connection to work and completion of due process. The policy basis usually comes from a social media policy in the employee handbook, confidentiality clauses or a code of conduct. If the company has never issued any such rule, the case for discipline becomes much weaker. The connection to work must be concrete: did the post reveal information obtained through the job, did the employee speak as a company representative, did it cause provable harm to client relationships or the company's reputation?
On procedure, the common practice in the Philippines is to serve a written notice that sets out the facts alleged, the rule violated and the possible penalty, and to give the employee a reasonable time to answer in writing. Where appropriate, hold a conference or hearing so the employee can explain. Then issue a written decision with reasons based on the evidence. If it is genuinely necessary during the investigation, for example because the employee still holds access to sensitive systems, preventive suspension may be considered. It is an investigative tool, not a penalty; see disciplinary systems and preventive suspension. The penalty must be proportionate and consistent with how the company handled similar cases before, or it may be seen as selective enforcement.
Firing someone on the spot, verbally, or by announcement in a group chat is the most common and the most dangerous mistake. When the process is defective, the company can lose a labor case even if the employee did something wrong. Every case is different; consult a licensed lawyer, and treat this article as general information rather than legal advice.
Responding publicly: one factual statement, no names, no comment on private life
If a public response is needed, issue one short factual statement giving the company's position and the steps taken. Do not name the employee and do not comment on their private life. First decide whether to respond at all. If the post has circulated only in a small circle and does not involve clients or the public interest, quiet internal handling is often better, because a statement can spread the story further. If it has been picked up by media, large pages or client groups, or if it involves a data leak or discrimination that the public cares about, a response is warranted.
A statement can follow three sentences: the company is aware of a post; the views expressed do not represent the company, which takes the matter seriously and is handling it under its internal procedures; any client affected can contact the company through a named channel. Do not disclose the employee's name, the outcome of any discipline or personal details. Doing so may create a new privacy problem. Do not attack the people sharing or commenting either. For the wording of public replies and platform reporting, compare handling malicious reviews and online attacks.
If a customer or third party threatens to go public unless they are paid compensation, separate a legitimate claim from pressure tactics; see when a customer threatens to expose you for compensation. Have HR and a lawyer review every public text before it goes out. Once the statement is published, do not keep posting follow-ups or arguing in the replies; one clear position, repeated consistently by the single designated contact, is easier to defend than a stream of reactive comments.
Five moves that make it worse
An angry response often does more damage than the original post. First, forcing the employee to hand over a phone, account or password, or logging into their account to delete content. Personal accounts and devices belong to the employee, and taking them over can raise privacy and data protection issues; evidence obtained that way may also be challenged. Second, shaming the employee publicly by naming them in company chats, notice boards or on official pages, or posting their photo. That turns the company from victim into aggressor and pushes bystanders to the employee's side.
Third, retaliation. If the post complains about unpaid wages, safety hazards or illegal practices and the company fires or transfers the employee straight away, that will very likely be seen as retaliation, and both labor authorities and the public will side with the employee. The right move is to treat the issues raised as an internal complaint and investigate them properly. Fourth, counter-attacking online by mobilizing colleagues or paid accounts to flood the comments, post fake praise or mass-report critics. When that is exposed, the controversy erupts a second time. Fifth, sending loud public demand letters to ordinary employees or netizens. They are screenshotted, shared and mocked.
If the company believes defamation or a leak genuinely calls for legal action, have a lawyer assess it first, send any letter privately, preserve the evidence, and only then decide on formal proceedings. Every case is different; consult a licensed lawyer, and treat this article as general information rather than legal advice.
Fix the rules afterwards: writing a social media policy, and how Yixing can help
The most useful step after an incident is to put social media rules into the employee handbook and have every employee acknowledge them. A workable policy covers what must never be posted (client data, internal documents, unpublished prices and contracts, colleagues' personal information, sensitive workplace images); who is authorized to speak for the company, with everyone else barred from making commitments in its name; a reminder that personal posts mentioning the employer should state that they are personal views; a rule that online discussions about the company are referred to the designated contact; and a penalty ladder tied to the handbook's offense categories.
Spell out the boundaries too: the company does not monitor personal accounts, does not ask for passwords, and does not restrict employees from lawfully raising labor rights concerns. Clear boundaries make the rules defensible and make employees more willing to follow them. Walk new hires through real examples during onboarding and review the policy every year. At the same time, check who controls the company's official accounts, so they are not registered to a departed employee; see recovering company social accounts from a former employee.
Yixing International Travel (SEC Registration No. CS202009551; Bureau of Immigration accreditation CA-202624381-1; DOLE accredited) supports Chinese-invested companies in the Philippines with compliance and HR retainer services: drafting social media policies and handbook sections, preparing disciplinary notices and records, organizing evidence and timelines when an incident happens, and bringing in licensed lawyers. We do not replace legal judgment and we do not promise any outcome. Consult a licensed lawyer for your specific case; this article is not legal advice.
Frequently Asked Questions
Can we fire an employee who insulted a client on Facebook?
Can the company make an employee hand over their password to delete a post?
An employee posted client data online. What comes first?
The post had nothing to do with work. Should we act?
Should the company respond publicly to an employee's post?
Can we discipline an employee who posted about unpaid wages?
How do we prevent this from happening again?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation