Social media can be a great marketing tool for small businesses, but firms must be careful they don’t fall foul of data protection rules. Companies that use social networking to spread their word may be unaware that they are bound by the same privacy guidelines that dictate how every organisation should use and store people’s personal information.

The Information Commissioner’s Office, the UK’s data protection watchdog, has issued guidance on how firms can use people’s personal information on social networking sites and online forums.

It makes clear that companies can’t use the exemption in the Data Protection Act (DPA) that applies to individuals using personal data for their own personal purposes.

So, for example, if you collect the names, mobile phone numbers and email addresses of a number of mums to set up an informal mother and toddler group then you wouldn’t have to worry about the privacy law. But if you used their information to tell them about the new toddler gymnastics company you’ve set up you would be subject to the act.

Also, if you took someone’s glowing review of one of your products posted on an online forum and then put it on your company’s website or social networking page without informing them or asking their permission you could be in breach of the data protection rules.

The rules also apply if a firm uses one of its employees to process people’s personal data through their own social networking page. So if Sophie in sales asks her Facebook friends to tell her what they think of your firm’s customer service, you would only be able to use their responses as part of your marketing campaign in compliance with the DPA.

In fact, the ICO said it would take a dim view of companies that allow or encourage employees to use their personal networking pages for corporate purposes. It would consider it “poor practice”, the ICO says, although that’s likely to be controversial for many small businesses that may not have their own social media accounts.

Every small business that uses social media as part of its marketing campaign, or is thinking of it, should make sure they don’t unwittingly break the law by reading the guidance.