A six-step social scheduling workflow, from classification to closure

A social media scheduling operating workflow should make one approved content version traceable from request to closure. Build the route as a state machine. Each state has an owner, entry evidence, allowed action and exit test.

This procedure is for an organisation operating in England. UK privacy, electronic-marketing and advertising questions still depend on the actual audience, content and delivery route. A qualified reviewer must assess them; the procedure itself does not confer compliance.

What to take away

1. Open and classify the job

The requester supplies purpose, audience, account, desired Europe/London release window and source material. The intake owner then classifies the item as public editorial content, an advert, paid creator content, a genuine service message or a promotional direct message. Do not treat those labels as interchangeable.

The ICO's identification guidance explains that targeted social advertising and direct messages can be direct marketing. If the purpose or recipient route is unclear, move the job to classification hold and ask the privacy or PECR reviewer. Do not solve uncertainty by calling promotion a service update.

2. Assemble the evidence package

Give every objective claim a source, owner, capture date and expiry trigger. Attach permission or licence evidence for images, recordings, music, logos and extracts. GOV.UK's copyright record explains that protected material needs permission, acquired rights or an applicable exception. Prior online availability is not a reuse right.

The package also holds the proposed copy, media, captions, alternative text, link destinations, audience settings, disclosure and monitoring plan. Assign a revision identifier before review. If copy or media changes later, create another revision rather than overwriting the approved one.

3. Draft for the final placement

Write within the real character, crop and link constraints. Keep the essential meaning out of images alone. Check captions against speech and describe relevant visual information in alternative text. ONS Digital's accessible social media article provides public-sector practice on alternative text, captions and descriptive links. It is not a universal legal test.

4. Run separate reviews

Send the same revision to the necessary specialists. Advertising review checks recognisability and evidence for the likely impression. Privacy and PECR review examines targeting, identifiers, direct messages, tracking, objections and suppression. Rights, accessibility, security, employment, commercial and finance questions retain their own outcomes.

Record pass for scope, return, exception with expiry or stop for each gate. One pass cannot cancel another gate's failure. CAP's social advertising guidance makes the final consumer-facing context important, so an approval must cover the rendered placement, not copy in isolation.

5. Approve and schedule

The accountable approver records the revision, account, audience, release window and monitoring owner. The scheduler enters a Europe/London time and checks the system's resolved timestamp against the current UK clock-change record. Schedule only through an authorised account and managed route.

The NCSC advises organisations to restrict publishing access, use approval workflows and prepare recovery for both social accounts and management tools in its social publishing guidance. Before release, inspect the loaded preview for account identity, disclosure, crop, captions, alternative text, link destination, thread order and timing. Any material mismatch returns to drafting.

6. Verify, monitor and close

At release, compare the live item with the approved package and capture its public identifier. Monitor the defined window for broken links, complaints, claim challenges, accessibility problems and security signals. Route specialist matters without inviting personal details in public.

If an account or tool may be compromised, pause the queue and revoke access under the recovery plan. The NCSC's response process uses analysis, containment, remediation and recovery, with tasks and findings tracked throughout.

Close only after the monitor records the live version, corrections, unresolved work and retention event. A withdrawal request opens a new controlled action; it does not erase the earlier record. Review the workflow after a serious defect, an unauthorised release, a platform change, a guidance change or a failed recovery exercise.

Before you act

Common questions

What should happen when the purpose or recipient route is unclear?

Move the job to classification hold and ask the privacy or PECR reviewer. The article warns against solving uncertainty by calling promotion a service update. The ICO's identification guidance explains that targeted social advertising and direct messages can be direct marketing, so the label matters.

Why must an approval cover the rendered placement rather than the copy alone?

CAP's social advertising guidance makes the final consumer-facing context important. The article says an approval must cover the rendered placement, not copy in isolation. Before release, inspect the loaded preview for account identity, disclosure, crop, captions, alternative text, link destination, thread order and timing.

What happens after a withdrawal request or a possible account compromise?

A withdrawal request opens a new controlled action and does not erase the earlier record. If an account or tool may be compromised, pause the queue and revoke access under the recovery plan. The NCSC response process uses analysis, containment, remediation and recovery, with tasks and findings tracked throughout.