Most businesses think about digital risk as somebody breaking in. The more common and more expensive version is something going out: a post that defames a competitor, a staff member’s comment that becomes the company’s problem, customer information shared in a group chat, or a claim made online that cannot be substantiated.
Compliance practitioners have been treating digital risk as a distinct discipline for years, precisely because businesses now communicate across many channels with very little control over who says what.
Your staff’s posts can become your liability
An employee identifiable as working for you, posting something defamatory or discriminatory, creates exposure for the business as well as themselves. A written social media policy that staff have actually read is cheap, and it is the difference between an incident being one person’s conduct problem and the company’s legal one.
Sharing customer information informally is still processing it
Sending a client’s details to a colleague on a messaging app, keeping a spreadsheet of contacts on a personal phone, or discussing an account in a group are all processing personal information, and the obligations apply regardless of the informality of the channel.
Anything asserted publicly must be substantiable
Claims about a product, a result or a competitor made on social channels are subject to the same standards as advertising. The casual tone of the medium changes nothing, and comparative claims about competitors are where small businesses most often create a problem for themselves.
Compliance cost rises with the number of channels
Each additional channel multiplies what has to be monitored, approved and retained. A small business is generally better served operating well on two channels than poorly on six, and that is a compliance argument as much as a marketing one.
Keep the records, because you will need them
Posts get deleted, staff leave and messages disappear. Where something is disputed, the business that can produce what was actually published and when is in a far better position. Personal information obligations across all of this are enforced by the Information Regulator.
Frequently asked questions
What is the most common digital risk for a small business?
Something going out rather than someone breaking in: a defamatory post, an unsubstantiated claim or customer information shared informally.
Can a business be liable for a staff member’s post?
Where the person is identifiable as working for the business, yes. A written and genuinely circulated social media policy is the cheapest protection.
Do informal channels change the data obligations?
No. Sharing client details on a messaging app or personal phone is still processing personal information, with the same requirements.
Are social media claims treated as advertising?
Yes. Claims about products, results or competitors must be substantiable regardless of the platform’s casual tone.
Why limit the number of channels?
Because each one adds monitoring, approval and retention obligations, and operating well on two beats operating poorly on six.
Further reading
Originally published in August 2017. Updated September 2026 to set out the digital risks a small business actually carries, in place of a conference programme.
