Safety Norms: Public Relations Strategy

1Purpose, Scope, and Safety Principles

These norms apply to anyone who sets communication objectives, researches audiences, drafts key messages, selects channels, briefs spokespeople, manages media contacts, or measures outcomes for an organization or client. They cover planning documents, press materials, social content, events, influencer briefs, crisis statements, and internal announcements.

Four principles guide every decision. Messages must be truthful and substantiated. People must not be harmed, exposed, or misled. Rights in content and data must be respected. The organization must be able to explain its choices publicly. Items marked mandatory must be followed unless a written exception is approved by the accountable owner. Items marked recommended describe good practice that teams should adopt unless a documented reason applies.

• Mandatory: no campaign element goes live without a completed plan record and approval from the accountable owner.
• Recommended: teams review these norms at the start of each campaign so that new staff and contractors understand the rules.

2Roles, Competence, and Accountability

The strategy lead is accountable for the plan, its objectives, and its risk record. A legal or compliance reviewer checks claims, privacy notices, disclosures, and contracts. A subject matter reviewer, such as a qualified clinician, engineer, or financial professional where relevant, checks technical statements. The spokesperson is responsible for the accuracy of anything they say in public. The creative lead clears rights for images, music, and trademarks. The data steward governs analytics, audience lists, and personal data. An executive sponsor approves high-risk decisions.

Competence matters as much as role title. Public relations practitioners do not provide medical, legal, or financial advice, and they must not imply that they do. Where a message touches those areas, the qualified professional must approve the wording.

• Mandatory: every campaign names one accountable owner and one deputy in the plan record.
• Mandatory: health, financial, environmental, or safety claims require review by a qualified subject matter professional before release.
• Mandatory: spokespeople receive a documented briefing and must not comment on topics outside their verified knowledge.
• Recommended: teams without in-house legal support use a written external review process with a named contact.

3Hazards and Risk Assessment

Realistic hazards in public relations strategy include misleading or unsubstantiated claims, undisclosed paid endorsements, messages that appear insensitive to current events, targeting that exposes vulnerable people to harmful content, leaked personal data in audience lists or customer exports, unauthorized use of photographs or music, misinformation amplified during a crisis, harassment in comment threads, and staff overload during launches. Each hazard can cause harm to a person, a legal breach, or lasting reputational damage.

Assess each campaign before approval. Score likelihood and severity on a simple scale from 1 to 5, then multiply the two numbers. This is an internal convention, not a regulatory standard. Scores of 15 or higher require executive and legal sign-off before launch. Scores of 20 or higher pause the campaign until the risk is reduced and the assessment is repeated.

• Example: a product launch that claims faster results than the testing supports has high severity and must be revised before approval.
• Example: a campaign that uses a photograph of a patient without a verified release is a high likelihood breach and must be removed from the plan.
• Example: a crisis holding statement drafted before facts are confirmed carries high severity and requires a verification step before use.
• Mandatory: the risk assessment is updated whenever the audience, channel, budget, or message changes.

4Preventive Controls and Safe Practice

Prevention starts with a substantiation file. Every factual claim in a release, advertisement, or social post links to a source document that the reviewer can check. Claims that cannot be substantiated are removed or rewritten. Teams maintain a claim log that records the claim, its source, the reviewer, and the approval date in the internal record system.

Safe practice also means testing messages before release. A pre-mortem exercise asks the team to imagine that the campaign has failed publicly and to list the most likely reasons. Each reason becomes a control, an owner, and a deadline. Campaigns avoid promoting content linked to recent tragedies, and they check the calendar of significant local events to avoid tone errors. Where platforms or laws restrict targeting by sensitive characteristics, teams do not attempt workarounds.

• Mandatory: all paid or sponsored content carries a clear disclosure that meets the platform rules and applicable advertising law in each market.
• Mandatory: no fake reviews, fake accounts, automated amplification, or undisclosed influencer payments.
• Mandatory: a holding statement and a correction template exist before launch for every campaign with public exposure.
• Recommended: spokespeople rehearse likely hostile questions and practice short, accurate answers.
• Recommended: moderation rotas are published so that comments are reviewed within a stated response window.

5Consent, Privacy, Copyright, and Platform Rules

Identifiable people must give informed consent before appearing in content, and consent must be recorded in a signed release or an equivalent verified record. Releases state the purpose, channels, duration, and right to withdraw. Minors require consent from a legal guardian and additional checks under local rules. Teams do not use images or stories of people receiving care, support, or services without verified consent and a review for dignity and risk of identification.

Privacy controls apply to audience data, customer lists, and analytics. Collect only the data needed for the stated purpose, keep privacy notices accurate, and honor opt-out requests promptly. Privacy laws vary by jurisdiction, so the data steward confirms current requirements with a qualified professional. Copyright and trademark rules also vary. Keep a licence record for every third-party asset, including the scope of use and expiry. Platform terms set separate rules for music, branded content, political advertising, and data use, and these terms change, so verify the current version before each campaign.

• Mandatory: no identifiable person appears in content without a current, recorded release.
• Mandatory: third-party assets are used only under a licence record that covers the channel and time period.
• Mandatory: audience data is not shared with third parties without a documented legal basis and contract.
• Recommended: creative teams use a shared asset library with clear usage terms.

6Workspace, Tools, and Information Security

Public relations teams handle embargoed announcements, unpublished financial or product information, and sensitive stakeholder data. Access to content management systems, scheduling tools, customer relationship systems, and shared drives is granted by role and reviewed periodically. Strong authentication is mandatory where the organization policy requires it. Confidential or embargoed material must not be entered into unapproved AI writing tools or personal cloud storage.

Live events and workspaces create physical hazards. Cables, staging, and crowd flow need an approved event risk assessment, and any electrical work must be done by qualified personnel. Long editing sessions require screen breaks and adjustable seating to reduce strain. Devices are locked when unattended, and shared screens are cleared before media visits.

• Mandatory: access to publishing accounts is limited to named users, and shared logins are not permitted.
• Mandatory: embargoed material is shared only through approved channels with a recorded distribution list.
• Recommended: an external event contractor provides evidence of insurance and site safety procedures before setup.
• Recommended: teams take regular breaks from screen work and report eye strain or repetitive strain symptoms to their manager.

7Incidents, Crisis Escalation, and Corrections

Incidents include published factual errors, misattributed quotes, data breaches, rights complaints, coordinated harassment, threats to staff, and near misses where an error was caught before release. Report every incident to the accountable owner as soon as it is recognized, using the internal timeframe in the local policy. Pause scheduled posts and paid placements while the facts are confirmed.

Preserve evidence by capturing screenshots, timestamps, and message logs before changing or removing content. Do not delete content to hide it without a recorded decision. Correct confirmed errors visibly and promptly, in the same channel where the error appeared where practical. Where there is a threat to life, an immediate physical danger, or a criminal act, contact emergency services first. The communications team then supports the response but does not replace emergency responders.

• Mandatory: every incident receives a log entry with owner, facts, actions, and closure date.
• Mandatory: legal counsel is notified of any data breach, rights complaint, or regulatory inquiry.
• Recommended: harassment is handled with blocking, reporting tools, and support for the affected staff member.

8Records, Training, Monitoring, and Review

Keep records for each campaign: the plan, claim substantiation, releases, licence records, approvals, risk assessments, and incident logs. Retention periods are set by local policy and law, and the data steward confirms them with a qualified professional. Records must be accurate, dated in the internal system, and accessible to auditors.

Training is required before anyone receives publishing or data access. Refresher sessions should be held at a regular interval set by policy. Monitoring continues after launch. Track complaints, corrections, unsubscribes, comment sentiment, and signs of audience harm. Hold a review after each campaign and record lessons learned. Update these norms when a serious incident, a change in law, or a platform rule change reveals a gap.

• Mandatory: onboarding includes a sign-off on these norms before system access is granted.
• Mandatory: a post-campaign review is completed and filed for every campaign with public exposure.
• Recommended: the team reviews complaint trends at periodic meetings and assigns owners for recurring issues.

Implementation checklist

• Confirm a named accountable owner and deputy are recorded in the plan.
• Attach a source file to every factual claim and remove any claim that cannot be substantiated.
• Disclose all paid, sponsored, or influencer content as required by platform rules and local law.
• Obtain and record a current release before using any identifiable person.
• Verify licence scope and expiry for every third-party image, song, or trademark.
• Limit audience data to the stated purpose and confirm privacy notices are accurate.
• Complete the risk assessment and obtain required sign-off before launch or before any change.
• Pause scheduled posts and log the incident when an error, breach, or threat is identified.
• Preserve evidence before editing or removing content, and correct confirmed errors visibly.
• Schedule a post-campaign review and record lessons learned in the norms.