Who Owns Social Media Accounts When Staff Leave?

Leah runs a busy Auckland florist. Her employee set up the shop's Instagram account, posted daily reels, answered customer DMs and built the page to 18,000 followers. Then the employee resigned and Leah realised the login, recovery email and two-factor authentication were all tied to the employee's personal phone.

It's a stomach-drop moment. Your social media accounts can hold years of brand value, customer conversations, content and warm leads. If access sits with one person, your business can feel very exposed when they leave.

The good news is that this doesn't have to be messy if you set the rules early. Social media ownership comes down to a mix of account setup, intellectual property, employment or contractor terms, confidentiality, privacy and practical access control.

Who Owns Social Media Accounts In New Zealand?

It depends, because New Zealand law doesn't have one single rule that says every business social media account belongs to the business or the person who created it.

In practice, the strongest signs that your business owns or controls an account are things like:

• the account uses your business name, logo, brand colours or registered trade mark
• the account was created for your business, not as a personal profile
• the account is linked to your business email address, phone number, NZBN or company details
• your business paid for content creation, ads or social media management
• posting and managing the account formed part of the person's job or contractor scope
• your employment agreement, contractor agreement or social media policy says the account belongs to your business
• your business controls the admin settings, passwords and recovery details

If the account was created by an employee as part of their role, using your brand and for your business, you'll usually be in a stronger position to say it's a business account. But if you never documented that, and the account is linked to the employee's personal email and phone, recovering access can still be difficult in real life.

Social media platforms don't always treat ownership in the same way lawyers do. Often, the person with the login and recovery access has practical control. That's why your legal documents and your internal systems need to work together.

Does The Business Own An Employee's Social Media Content?

Usually, your business is more likely to own content created by an employee in the course of their employment, but the details matter.

Under the Copyright Act 1994, the employer is generally the first owner of copyright in works made by an employee in the course of employment, unless you've agreed something different. That can cover things like photos, graphics, captions, videos, scripts and other original content created as part of the job.

For example, if your marketing coordinator takes product photos during work hours for your business Instagram account, those photos will usually belong to your business unless your agreement says otherwise.

Contractors are more nuanced. Contractors can own copyright in some work they create, especially written content, unless the contract assigns it to your business or gives your business a suitable licence. However, New Zealand copyright law has specific default rules for some commissioned works. If you commission and pay, or agree to pay, for certain works, including photographs, films, computer programs, drawings, diagrams and similar works, your business may be the first copyright owner unless agreed otherwise.

Because platform content often includes a mix of captions, graphics, photos, video, templates, raw footage and editable files, don't rely on the default position to do all the work. Your contractor agreement should spell out ownership, licences, usage rights and handover. Paying the invoice may matter for some commissioned works, but it won't answer every practical question about how your business can use, edit, repurpose or transfer the content.

This is one of the most common gaps we see with business Instagram account ownership. The business has the brand, the audience and the commercial risk, but the contractor's terms never clearly deal with IP and usage rights.

Your agreements should clearly cover:

• who owns content created for your business
• whether the person can reuse that content in their portfolio
• whether drafts, raw files and editable design files must be handed over
• whether the person can post similar content for a competitor
• what happens to content when the role or contract ends

If you use influencers or creators, this becomes even more specific. You may only get a limited licence to use their content for certain channels, time periods or ad campaigns. Make sure the usage rights match how you actually plan to use the content.

What If The Account Is In An Employee's Name?

If the account is genuinely personal, you may not own it just because the employee used it to talk about your business.

This is where the facts really matter. An employee might have a personal LinkedIn profile, TikTok account or Instagram account that they built before joining your business. They may post about your products, tag your business, connect with customers or share work updates. That doesn't automatically make the whole account yours.

On the other hand, an account called something like LeahsFloristAuckland, using your logo and set up to take customer orders, looks much more like a business account, even if an employee created it.

The safest approach is to separate personal and business accounts from day one.

Business Accounts Should Use Business Details

Set up business accounts using:

• a business email address, not an employee's personal Gmail or iCloud account
• a phone number your business controls for account recovery
• your registered company name, business name or trading name where appropriate
• your business logo and approved brand assets
• a central password manager or approved access system

If your business is a company, check your Companies Office details and NZBN information are consistent with the way you present the business online. That won't prove account ownership by itself, but it helps keep your business identity clean and consistent.

Personal Accounts Should Stay Personal

If staff use personal LinkedIn profiles or personal creator accounts, be clear about boundaries. You might ask them to disclose their role accurately, follow your social media policy and avoid sharing confidential information. But trying to claim ownership of a personal profile will often go too far.

A practical middle ground is to create official business pages and make sure client enquiries, campaign assets and customer conversations happen through those official channels, not through one person's personal account.

Can An Employee Leave With Business Contacts?

No, they usually shouldn't take your confidential business contacts or customer data when they leave, but not every follower or LinkedIn connection will be treated the same way.

Your client list, CRM records, customer order history, private DMs, lead spreadsheets, pricing notes and supplier contact lists can be valuable confidential information. If staff copy or export those records for their own use, that can create serious commercial and privacy issues.

Public followers are a bit different. If someone can see your follower list publicly on Instagram, it may be harder to argue the list itself is confidential. But private messages, purchase history, customer preferences, complaints, phone numbers and email addresses aren't the same as a public follower count.

The Privacy Act 2020 also matters if the account includes personal information. Personal information can include names, contact details, images, social media handles, order details and messages from customers. If an employee or contractor downloads, forwards or keeps that information without authorisation, your business may need to look at whether there has been a privacy breach.

If a privacy breach is likely to cause serious harm, the Privacy Act 2020 may require notification to the Privacy Commissioner and affected people. Whether that threshold is met depends on the information, who has it, how it may be used and what steps you can take to contain it.

You should also think about the Fair Trading Act 1986. If a former staff member uses a confusingly similar page, suggests they're still connected with your business, or misleads customers about who they're dealing with, that can raise misleading conduct concerns. Getting advice early can help you choose a practical response without escalating things unnecessarily.

What Should A Social Media Policy In New Zealand Include?

Your social media policy should set clear rules for how staff and contractors access, use and hand back your business accounts, alongside your employment contract terms.

A good policy doesn't need to be cold or heavy-handed. It should simply tell your team what's expected, what they can do, and where the boundaries are. That helps protect your business while giving your team confidence to post and respond consistently.

Your policy should cover:

• account ownership: which accounts are business accounts and who controls them
• approved users: who can post, respond to messages, run ads and access analytics
• brand rules: tone of voice, logos, claims, disclaimers and approval steps
• password rules: how passwords are stored, changed and shared
• two-factor authentication: whose device or number is used and how backup access works
• content approvals: when posts, reels, offers or customer replies need sign-off
• confidential information: what must never be posted or shared
• customer privacy: how to handle DMs, photos, testimonials and customer data
• personal accounts: rules for mentioning your business on personal profiles
• offboarding: what happens to access when someone leaves

Your policy should also connect with your privacy processes. If you collect customer information through DMs, lead forms, competitions or bookings, make sure you're collecting and using that information in a way that lines up with the Privacy Act 2020 and your privacy policy.

For advertising and promotions, your policy should also help your team avoid misleading claims under the Fair Trading Act 1986. That includes claims about prices, discounts, availability, results, reviews and sponsored posts.

What Clauses Should Go In Employment And Contractor Agreements?

Your employment contract or contractor agreement should say, in plain words, that business social media accounts, content, login details, customer messages and related IP belong to your business where that's what you intend.

This is where tailored documents make a big difference. Generic templates often mention confidentiality and IP in broad terms, but they don't always deal with social media accounts, platform access, 2FA, raw content files or customer DMs.

Employment Agreement Clauses

For employees, consider clauses covering:

• ownership of business social media accounts created or managed during employment
• copyright ownership for content created in the course of employment
• confidential information, including customer lists, leads, DMs and analytics
• return or deletion of business information when employment ends
• passwords, admin access and account recovery details
• acceptable use of business systems and devices
• post-employment obligations around confidential information and customer contact
• reasonable restraints or non-solicitation terms where they're needed to protect legitimate business interests

Restraint clauses need careful drafting in New Zealand. A clause that goes too far may not work when you need it. Focus on protecting genuine business interests, such as confidential information and customer relationships, rather than trying to stop someone earning a living.

You should also keep the Employment Relations Act 2000 in mind. Employment relationships in New Zealand carry duties of good faith, and your policies and processes should be consistent with that.

Contractor Agreement Clauses

For contractors, be even more direct. New Zealand's default copyright rules aren't one-size-fits-all. Contractors can own copyright in some work they create, particularly written copy and other original material, unless your contract assigns it or gives your business a clear licence. For some commissioned works, including photographs, films, computer programs, drawings, diagrams and similar works, the person commissioning and paying for the work may be the first owner unless agreed otherwise.

Your contractor agreement should cover:

• assignment of copyright and other IP in content created for your business, or a clear licence where assignment isn't the right approach
• ownership and control of accounts, pages, ad accounts and business manager assets
• access to raw footage, design files, copy drafts and campaign materials
• confidentiality and handling of customer data
• approved subcontracting, if the contractor uses other people
• handover of passwords, files and admin rights at the end of the engagement
• limits on using your brand, case studies and customer examples

From 2026, the Employment Relations Act 2000 includes contractor gateway changes designed to give more certainty about when a worker is treated as an independent contractor. Even with those changes, calling someone a contractor doesn't automatically deal with social media ownership. You still need clear written terms for IP, confidentiality, access and handover.

How Can You Lock Down Business Social Accounts Before Someone Leaves?

You can reduce most of the risk by setting up access properly, keeping records and making account handover part of your normal offboarding process.

Start with the practical controls. A legal clause helps, but it won't help much on a Friday night if only one person can receive the login code.

Set Up Access The Right Way

• Use a business email address for every platform account.
• Keep recovery emails and phone numbers under business control.
• Use role-based access where the platform allows it, rather than sharing one password.
• Give staff the lowest access level they need to do their job.
• Use a password manager and remove access when someone changes role or leaves.
• Keep a register of all accounts, handles, ad accounts, admins and recovery details.
• Make sure 2FA isn't tied only to one employee's personal phone.

Build Handover Into Offboarding

When someone resigns or their contract ends, your checklist should include social media access alongside laptops, email and company files.

Ask for confirmation that they have:

• returned or transferred admin access
• handed over passwords, backup codes and recovery details
• transferred drafts, content calendars, raw files and analytics reports
• deleted business information from personal devices and accounts where appropriate
• stopped using your brand assets, customer data and internal materials

For higher-risk roles, such as a marketing manager, sales lead, community manager or external agency, do a mini access audit before their last day. That gives you time to fix issues while everyone is still cooperating.

Protect Your Brand Name Early

If your brand is valuable, think about trade mark protection through IPONZ. A registered trade mark won't magically recover a hacked account or guarantee a social handle, but it can strengthen your position if someone uses your brand name in a confusing way.

Also reserve obvious handles where you can, even if you don't plan to use every platform straight away. That small step can save headaches later when your business grows.

Key Takeaways

• Social media account ownership in New Zealand depends on the facts, including who created the account, how it was used, what your documents say and who controls access.
• Employee-created copyright will often belong to your business when it's made in the course of employment, but contractor-created content needs careful written terms because New Zealand default rules vary by work type.
• Your social media policy should cover account ownership, passwords, approvals, customer privacy, personal accounts and offboarding.
• Client lists, customer DMs and lead data can be confidential information and personal information, so don't treat them like ordinary followers.
• Good access control matters just as much as good legal drafting. Use business emails, role-based access, password tools and a clear handover checklist.
• Employment agreements and contractor terms should deal directly with social media accounts, content, IP, confidentiality and post-exit access.

If you'd like help with your social media policy, employment clauses, contractor terms or IP ownership arrangements, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.