Social media scheduling for charities UK: consent and safeguarding

What to take away

Social media scheduling for charities UK is a record-keeping job before it is a copywriting job. Fix the lawful basis and keep the evidence.
Every image of a child, a patient or an adult at risk needs a named check before the post is queued, and DBS-checked roles need their evidence on file.
Volunteer posts need a written licence covering reuse, rescheduling and withdrawal.
The CAP Code, enforced by the Advertising Standards Authority, and the UK GDPR apply to charity posts just as they do to commercial ones.
Buffer, Hootsuite and Later will publish on time whatever the paperwork says, so the records have to sit outside the queue.
Write the audience and launch assumptions down before the calendar is approved.

Set the lawful basis and keep the record

A charity schedules posts that carry personal data every week. A named volunteer in a photo, a case study, a thank-you to a donor: all of it counts as processing. Under the UK GDPR you need a lawful basis, and consent is only one of several. The ICO's Guide to the UK GDPR and its lawful basis interactive tool set out the options, and the ICO's consent guidance says what a valid consent record has to contain.

Donor thank-yous and fundraising texts also touch the electronic marketing rules. The Privacy and Electronic Communications (EC Directive) Regulations 2003 — PECR — restrict direct marketing by phone: live calls must not go to TPS or CTPS numbers, and automated calls need prior consent. A post sent on the wrong basis is a complaint waiting to happen.

For each post type, pick the basis and write it into the schedule template. That way the decision is made once, not at 5pm on a Friday.

Consent wording for people in the picture

A generic photo consent form usually fails the test. Ask for the things the calendar actually needs.

What the form asks	Why the schedule needs it
Name and role of the person	Confirms who agreed
Platforms and post types	Stops reuse on a new channel
Review or expiry date	Forces a periodic re-check
Withdrawal route	Tells staff how to pull a post

For children, the Charity Commission's safeguarding guidance tells charities to make sure they have permission to display any images on their website or social media accounts, and notes that individual or parental permission may be needed. Add a parent or guardian field to the form and do not queue a child's image until it is filled in.

Adults at risk need the same care, with one difference. The Mental Capacity Act 2005 starts from the principle that a person must be assumed to have capacity unless it is established that they lack it. Ask the adult first. If there is real doubt about their capacity to agree to a public post, the safer choice is not to schedule the image at all and to record why.

Keep a consent register: one row per person, with the post, the platform, the date and the basis recorded. Signed forms live alongside it in a folder the scheduler can open. If the record cannot be found, the post does not go out. Write that into the charity social media policy so new starters inherit it.

Safeguarding checks before a post is queued

Buffer, Hootsuite or Later will publish on a timer. Nobody is watching the screen when the post goes live. That makes pre-approval the only real control.

A named safeguarding lead has seen the image and the caption.
Disclosure and Barring Service (DBS) checks are on file for every role that qualifies for one.
No school badge, street sign or house number is visible.
Written permission is filed and still in date.
Location data has been stripped from the photo file.

Safeguarding is a trustee duty, not a communications preference. The Charity Commission's guidance on safeguarding and protecting people, Safeguarding and protecting people for charities and trustees, says what trustees must do. It applies to England and Wales. For children, it points charities in England to Working Together to Safeguard Children 2023 and charities in Wales to the Wales Safeguarding Procedures. For adults at risk, it points to guidance on the Care Act 2014 in England and, again, the Wales Safeguarding Procedures.

On DBS checks, the guidance asks trustees to risk assess every role. It says to always get a standard, enhanced or enhanced with barred list check from the DBS when a role is eligible for one, and to use the DBS eligibility checker to decide. A volunteer who only drafts captions may not be eligible; one who photographs children at a holiday club may be.

The guidance also has a section on operating online. It says that operating online carries specific safeguarding risks connected to protecting people from abuse and protecting sensitive information, and that charities must manage those risks in their policies and practices. A scheduling queue full of approved images is exactly that kind of sensitive information.

Some images should never be scheduled at all. A picture taken inside a refuge, or one that maps a child's daily route, needs a separate decision. Publish after the event, or not at all, and record the reasoning.

Set up the scheduling tool to enforce the checks

The checks above only work if the tool cannot skip them. Whatever scheduler the charity uses, set it up along these lines:

Volunteers draft; only named staff can approve and publish. Where the tool offers draft-only or approval roles, use them.
Each queued post carries the consent register reference and the safeguarding lead's sign-off in its notes field or internal comment.
Remove access the day a volunteer leaves, and review the user list every quarter.
Keep the tool's activity history, or export it, so you can show who approved a post and when.
Turn off location tagging by default.

Scotland and Northern Ireland

Charities registered outside England and Wales answer to different bodies, so the schedule template needs a line saying which rules apply.

In Scotland, the Charities and Trustee Investment (Scotland) Act 2005 established the Scottish Charity Regulator, known as OSCR. Vetting runs under the Protection of Vulnerable Groups (Scotland) Act 2007, which sets up the PVG Scheme: individuals must be scheme members to carry out regulated roles, so check membership before a volunteer photographs children or protected adults.

In Northern Ireland, the Charities Act (Northern Ireland) 2008 established the Charity Commission for Northern Ireland, and AccessNI provides basic, standard and enhanced criminal record checks.

UK GDPR, PECR and the CAP Code apply across the UK, so the consent and advertising sections of this guide hold wherever the charity is based.

Volunteer contributors and the licence they sign

Volunteers often take the photos themselves, so they hold the copyright. A friendly email saying "yes, use it" is not a licence. Ask for platforms, paid boosts, duration, credit and a withdrawal route.

Think about the people who will run the calendar day to day. A set of persona hypotheses for England gives each role, its authority and its expiry date.

Store the licence with the asset, not in a separate inbox thread. When a volunteer leaves, the licence usually survives, unless the terms say otherwise. Check that wording before you rely on it.

Example: a fortnightly schedule for a food bank

Take a food bank in Leeds running three posts a fortnight. Monday shows a volunteer packing boxes, Wednesday asks for tinned goods, Friday thanks a local shop.

Before any of those posts is queued, the volunteer licence and the shop's permission are filed. The safeguarding lead confirms the packing photo shows no client. The appeal goes to supporters who opted in to fundraising messages.

A dry run of that first calendar belongs in a launch review that ends in a hold until the proof arrives. Hold the queue, gather the evidence, then release it.

Ad rules for scheduled charity posts

A paid boost is an ad. So is a fundraising post that makes a claim about what a donation achieves. The CAP Code, written by the Committee of Advertising Practice and enforced by the Advertising Standards Authority, applies to both, and a scheduled post cannot be edited once it is live.

Fundraising posts have a second rulebook. In England and Wales, the Charity Commission's guidance Charity fundraising: a guide to trustee duties (CC20) explains what trustees need to do to comply with the law on the management and control of their fundraising. Scheduled appeals are part of that fundraising, so the trustee who owns CC20 should see the appeal calendar.

Keep claims modest and verifiable. A figure such as "your £10 buys a food parcel" needs a basis you can show. If the figure changes, the queued post is out of date.

Name the person who can halt the queue. One named approver beats a committee when a post is already set to publish at 9am. Your trustee board should also confirm how the Charity Commission's guidance applies to your safeguarding and reporting duties.

Common questions

Who signs off a post that shows a child?

A named safeguarding lead signs it off, every time, and the decision is recorded. The scheduler should not be able to queue the post without that reference.

Does a charity need consent to post a photo of a volunteer?

Consent is one route, but a written licence or a legitimate interests assessment may fit better. What matters is that a record exists and covers the channel used.

How long should consent records be kept?

The ICO's storage limitation guidance expects a period you can justify, not "forever". Keep records while the content stays published, plus a defined period afterwards, and write that period into your social media policy.

What happens if a volunteer withdraws?

Pull the post, remove the asset from the queue and note the date. Then recheck any other scheduled posts that reuse the same image.