Postora

A handbook for people who run social media for a business or for clients

Client work and reporting

Social media client onboarding checklist for freelancers and small agencies

By the Postora editorial teamUpdated 13 min read

Short answer

A social media client onboarding checklist covers nine steps before the first post: scope, contract clauses on ownership, content rights and disclosure, GDPR processor terms, access by platform role, brand inputs, approval cadence, agreed measurement, a checked tool stack and offboarding terms.

This is general information, not legal advice. Rules change and depend on your country and situation; check the linked official sources or ask a qualified lawyer.

Silver pen on a sheet of paper beside a black computer mouse

Four questions cause trouble later if nobody answers them at the start: who owns the accounts, who owns the content you make, who answers for a missing ad label, and what happens to the client's customer data when the work ends. This checklist settles them in the order the work happens, links the law or help page behind each step, and ends with a list to copy.

Laws are quoted for the US, the UK and the EU; every source was checked on 29 September 2026.

1. What goes into the scope of work?

The scope decides which roles you request, which data you touch and what the reports measure. Write it as a list both sides sign:

  • Accounts: every platform and handle by name, for example @brand on Instagram and the Brand GmbH Facebook Page.
  • Deliverables: posts per month by format, and who supplies photos, footage and product facts.
  • Community management: comments, direct messages and reviews, on which accounts, in which hours, within what response time.
  • Paid social: in or out. If in, the client's own ad account and payment method keep step 2 simple.
  • Reporting: frequency, format and the metrics from step 7.
  • Revisions: rounds per post before a change counts as new work.
  • Out of scope: nearby jobs you are not doing, such as influencer sourcing or out-of-hours crisis response.
  • Contacts: one decision-maker and one deputy at the client, one lead on your side.

2. Which contract clauses need agreeing before access changes hands?

Account ownership, content rights, disclosure duties, and termination with handover.

Account ownership. The client owns every account, Page, business portfolio, ad account and pixel, and you hold a role on each (step 4). Platforms enforce ownership through the owning organisation: on Meta, a partner with full control of an asset can manage it but cannot share it with another business; only the owner can (Meta Business Help Centre). An ad account created in your business portfolio stays in it permanently and cannot be transferred (Meta Business Help Centre), so the clause says new assets are created in the client's portfolio and shared with you.

Content rights. The default owner is the person who made the work, so a transfer has to be written down.

Jurisdiction Default owner What moves ownership to the client
US The author: copyright "vests initially in the author" (17 U.S.C. §201(a)) A work-made-for-hire agreement signed by both parties, available for commissioned work in nine listed categories only (§101); otherwise a written transfer signed by the owner (§204(a))
UK The author (CDPA 1988 s.11(1)); the employer only for work made by an employee in the course of employment (s.11(2)) An assignment in writing, signed by or on behalf of the assignor (s.90(3))

Elsewhere, check the local rule. The clause lists what transfers and when (final posts, captions, edits and designs, for example on payment), what stays yours (reusable templates), what is licensed rather than owned (stock, music and fonts, where your licence decides whether the client may keep using them), whether source files are handed over, and any right to show the work in your portfolio.

Disclosure duties. Under the FTC's Endorsement Guides, the advertiser can be held liable for failing to disclose unexpected material connections with its endorsers, and should guide, monitor and correct them (16 CFR §255.1(d)). Advertising agencies, PR firms and similar intermediaries may be liable too, including for publishing ads without necessary disclosures or hiring and directing endorsers who omit them (§255.1(f)). Payment and free or discounted products can be material connections, and one the audience would not expect must be disclosed clearly and conspicuously (§255.5). The clause names who briefs creators, who checks their posts and who fixes a missing label, and obliges the client to tell you about connections you cannot see: gifted products, paid partners, affiliate links, staff posting about the brand. For wording and the UK and EU rules, see #ad disclosure rules for brands.

Termination and handover. Notice period and handover list, taken from step 9.

3. Do you need a GDPR processor agreement with the client?

Yes, when the GDPR applies and you handle personal data for the client: answering messages and comments, downloading leads from lead forms, uploading customer lists for ad audiences, collecting giveaway entries.

The GDPR covers processing in the context of an EU establishment of the controller or processor, and non-EU businesses that offer goods or services to people in the EU or monitor their behaviour there (Art. 3). The UK GDPR carries the same Article 28(3) terms (ICO).

The client decides why and how the data is processed, so it is the controller; you process on its behalf, so you are the processor (Art. 4(7) and 4(8)). Once you process personal data outside the client's instructions, you act as a controller for that part (ICO; Art. 28(10)). Reusing a client's follower data for your own marketing crosses that line.

The contract must be in writing, and electronic form counts (Art. 28(9)). The European Commission's standard contractual clauses fulfil Article 28(3) and (4) and can serve as the base (Implementing Decision (EU) 2021/915).

Art. 28 requires What to write for social media work
Subject matter, duration, nature, purpose, types of data, categories of people (28(3)) Followers' comments, messages and profile names; lead-form entries; customer lists for ad audiences; for the term of the contract
Documented instructions, including transfers outside the EU (28(3)(a)) The signed scope and written briefs; the ICO accepts any written form, including email. Name tools that store data outside the EU
Confidentiality (28(3)(b)) Everyone on your side, subcontracted freelancers included
Security under Art. 32 (28(3)(c)) Two-factor sign-in, a password manager, access by role (step 4)
Sub-processors only with written authorisation (28(2), 28(3)(d), 28(4)) Every tool and subcontractor that touches the data (step 8). Under general authorisation, notice before adding or replacing one so the client can object. The same terms flow down, and you stay fully liable for them
Help with data subject requests (28(3)(e)) A route for passing on access or deletion requests that arrive in messages
Help with Arts 32 to 36 (28(3)(f)) Tell the client without undue delay about a personal data breach, such as a compromised account or tool (Art. 33(2)); the client must notify its regulator where feasible within 72 hours unless the breach is unlikely to put people at risk (Art. 33(1))
Delete or return all data at the end, at the controller's choice (28(3)(g)) The data part of step 9
Information and audits (28(3)(h)) What the client needs to show the terms are met

4. Which access role should you request on each platform?

The lowest role that covers the scope, never a password. The client keeps the top role everywhere, so it can remove you without your help. Steps and revocation per platform: how to give an agency access without sharing passwords.

Platform How the client grants it Role to request The client keeps
Facebook Page Meta Business Suite, Settings, Partners, using your business portfolio ID (Meta) Partial access with the Content task; Community activity, Messages and calls, Insights or Ads only if in scope (Meta) Full control of the business portfolio
Instagram, in the portfolio The same partner route Partial access with the Content task; Messages, Community activity, Insights or Ads as scoped Full access ("Everything"), the only level that gives and removes access
LinkedIn Page A super admin adds you under Manage admins (LinkedIn Help) Content admin; Sponsored Content poster or Lead Gen Forms manager only for ads (LinkedIn Help) Super admin
YouTube channel An Owner or Manager invites you by email (YouTube Help) Editor, or Editor (limited) without revenue data; both publish, neither manages permissions Owner
Google Business Profile An owner adds you (Business Profile Help) Manager: posts and edits, cannot add or remove users or remove the profile Owner
TikTok Business Center, Partners: an admin adds you by Business Center ID or ad account ID (TikTok) Partner access to the assets in scope; Business Center holds TikTok accounts as well as ad accounts, with the level set per asset (TikTok) Admin of its own Business Center
Pinterest Business Manager partner access, profile and ad accounts separately (Pinterest) Publisher on the profile (creates and edits Pins and boards); ad account permissions only for ads (Pinterest) Account owner

Check two conditions before the invitations go out. Meta tells the client to turn on two-factor authentication for its business portfolio before sharing assets with a partner. On LinkedIn, a new admin must be a 1st-, 2nd- or 3rd-degree connection and follow the Page, and holds one Page admin role but may hold several paid media roles.

5. Which brand inputs should you collect in the first week?

  • Voice guide, plus three posts the client likes and three it does not.
  • Logo files, colour codes, fonts and the font licence.
  • Product facts, and claims that need sign-off before use (prices, health, finance, comparisons).
  • Banned topics, competitors to avoid, words the brand never uses.
  • Written permission from people who appear in client-supplied photos or video.
  • Handles, hashtags and partners to tag.
  • Escalation contacts for complaints, press and account problems, including out of hours.

6. How should post approvals work?

These rules work in any tool or in plain email. Write them into the scope:

  1. Who approves: one named approver and one deputy. Nobody else's approval counts.
  2. What needs approval: every scheduled post; for ads, copy, creative and audience; replies only beyond an agreed reply guide.
  3. Rhythm: batches go to review on a fixed day, with a fixed deadline before publishing.
  4. Silence: a missed deadline means the post waits, or it goes out as submitted. The contract names one.
  5. Late changes: a change after sign-off restarts review.
  6. Record: approvals in writing, in one agreed place.
  7. Urgent posts: who approves a same-day post or a reply to a public complaint, and through which channel.

7. What should you agree on measurement before the first report?

  • Goals: one or two outcomes per platform, and the metric that stands for each.
  • Baseline: export each account's figures on day one.
  • UTM convention: GA4 files a visit under Organic Social when the source is on its list of social sites or the medium is social, social-network, social-media, sm, social network or social media. Paid Social needs a listed source and a medium matching ^(.*cp.*|ppc|retargeting|paid.*)$ (Analytics Help). So utm_medium=social qualifies organic links for Organic Social even when the source is not on the list, while utm_medium=paid-social qualifies ads for Paid Social only when the source value is on Google's list; the UTM guide for GA4 checks each platform's value.
  • Metric names: report each metric under the platform's own name and definition, and add figures across platforms only when they count the same thing.
  • Ownership: reports and raw exports belong to the client.

8. What should you check in a tool before client data goes in?

Examples are alphabetical, not ranked, and unpriced: a tool that fails a check is out whatever it costs.

Tool Job What to check Examples
Password manager Your logins, recovery codes, any credential a role cannot replace A vault per client; removing one person without touching others; export; a data processing agreement (DPA) 1Password, Bitwarden, Dashlane
Scheduler Publishing, on some tools comments and messages too Accounts connect through each platform's own authorisation screen, so nobody holds a password; a workspace per client; a publish result per account; removing a client's accounts and data; a DPA and sub-processor list; data location Buffer, Hootsuite, Schedchie
Design Templates and brand kit Whose account holds the files; whether stock, music and font licences cover the client after you leave; source-file export Adobe Express, Canva, Figma
File storage Assets, footage, the approval record A folder the client owns and shares with you, or one you hand over; access per person; deletion at the end Dropbox, Google Drive, Microsoft OneDrive
Reporting The monthly report The source of each figure; an export the client keeps; metric definitions labelled The platforms' own insights; GA4 for site visits

Any tool here that stores the client's customer data (messages, comments, leads, audience lists) is a sub-processor. Under Article 28(2) and (4) it needs the client's written authorisation and the same data protection terms, so list it in an annex to the step 3 agreement.

9. What offboarding terms should you agree on day one?

  • Notice: the notice period and last working day.
  • Access: the client removes your roles and partner links; you confirm in writing that you hold none.
  • Assets: anything created in your portfolio or accounts is transferred or recreated in the client's (step 2).
  • Content: final files, and source files if the rights clause includes them.
  • Personal data: deleted or returned at the client's choice, with your copies deleted unless EU or member-state law (UK law under the UK GDPR) requires keeping them (Art. 28(3)(g)); confirmed in writing.
  • Tools: you disconnect the client's accounts from your tools; the client checks each platform's connected apps.
  • Credentials: the client changes any password or recovery code you held.
  • Reports: the last report and raw exports go to the client.

Platform-by-platform steps, and what to do when access is not handed back: agency offboarding: how to take back your social media accounts.

The checklist to copy

  1. Scope signed: accounts by handle, deliverables, community hours, paid social, reporting, revisions, out of scope, contacts.
  2. Ownership clause: the client owns every account and asset; new assets are created in its portfolio.
  3. Content-rights clause, signed: what transfers and when, what stays yours, licensed assets, source files, portfolio use.
  4. Disclosure clause: who briefs, checks and fixes labels; the client discloses every material connection to you.
  5. Processor agreement in writing where the GDPR or UK GDPR applies, with every Art. 28(3) term.
  6. Sub-processor annex, authorised by the client.
  7. Breach route: who you tell at the client, and how fast.
  8. Two-factor authentication on every business portfolio and account, the client's and yours.
  9. Lowest sufficient role on each platform; the client keeps the top role.
  10. Brand inputs received, including claims that need sign-off and permissions for people in photos.
  11. Approver, deputy, review day, deadline and the rule for silence written down.
  12. Goals, one metric per goal, baseline exported, UTM convention tested in GA4.
  13. Every tool checked: no passwords, per-client separation, DPA, data location, export.
  14. Offboarding terms signed: access removal, asset transfer, content handover, data deletion or return, tool disconnection, credential changes, final exports.

Questions and answers

Is a social media agency a data processor under GDPR?

When it handles personal data on a client's instructions, such as followers' messages, comments, leads or customer lists, yes: a processor processes personal data on behalf of the controller (GDPR Art. 4(8)), and Article 28 requires a written contract. If the agency decides for itself why the data is used, it is a controller for that processing.

Who owns the content a freelancer creates for a client?

In the US and the UK, the freelancer, as author, unless the contract says otherwise. Ownership moves to the client through a written, signed transfer (17 U.S.C. §204(a); CDPA 1988 s.90(3)) or, in the US, a signed work-made-for-hire agreement in one of the nine categories listed in §101.

Sources

All checked on 29 September 2026.