Social Media Crisis Response for Saudi Businesses
- Define complaint, issue and crisis levels in advance, with a named lead, approver and legal reviewer for each.
- In the first hour: assess the facts and severity, pause content that could worsen the incident, brief relevant teams, and issue an approved holding statement if the matter is public.
- Keep tone respectful and calm; never sarcastic, and take personal details into private channels.
- If a personal data breach may cause harm or conflict with data subjects' rights or interests, the controller must notify SDAIA within 72 hours of becoming aware of it, so bring in legal counsel immediately.
Sooner or later, a post, a product fault, a staff comment or a false rumour will spread faster than your team can reply. Preparation decides whether that becomes a bad day or lasting damage: knowing what counts as a crisis, who decides, what to say first and what to stop. This playbook is for businesses in Saudi Arabia, covers incidents on X, Snapchat, Instagram and TikTok, and treats tone and cultural sensitivity as central to the response.
Complaint, issue or crisis? Draw the line before you need it
Not every angry comment is a crisis. Agree on severity levels in advance and write them down.
| Level | What it looks like | Who leads |
|---|---|---|
| 1. Complaint | An individual customer problem: late delivery, a billing error, a rude interaction. Contained to one person or thread. | Community or customer-care team, using approved replies. |
| 2. Issue | The same complaint repeated by many people, a critical post from a well-followed account, or a mistake in your own content. Visible but still factual and manageable. | Social media lead plus the relevant department head; management informed. |
| 3. Crisis | Anything touching safety, health, religion or national symbols, alleged illegal conduct, a data leak, a hacked or impersonated account, or coverage by news outlets. Reputation, customers or legal position are at risk. | Crisis team: management, communications and legal counsel, with the affected department. |
If an incident could reach beyond your customers or carry legal consequences, treat it as level 3.
Who decides, who approves, who speaks
- Crisis lead (usually the head of communications or marketing): runs the response, keeps the log, and is the single point of contact.
- Management approver: signs off on any public statement at level 3. Name a backup for evenings, weekends and holidays.
- Legal counsel: reviews statements that involve allegations, defamation, regulators, contracts or personal data before they are published.
- Subject owner: operations, IT, HR or product, whoever holds the facts.
- Community team: posts only approved wording and routes everything new to the crisis lead.
Agree that nobody posts, deletes or comments on the incident from an official account without the crisis lead's go-ahead.
The first hour
- Establish the facts and severity. What happened, when, who is affected, which severity level applies, and what you do not yet know. Screenshot the original posts with visible dates and links.
- Pause content that could make things worse. Review scheduled posts, running ads, automated replies and chatbot flows, pause anything that could read badly in context, and ask influencers or partners to hold planned posts about you where relevant. A cheerful promotion published in the middle of a crisis can read as indifference.
- Publish a holding statement if the issue is already public and the wording has been approved, rather than staying silent while you investigate.
- Brief the front line (social, call centre, branches) with the same wording so customers hear one message.
Holding statements (templates)
A holding statement acknowledges the situation, shows you are acting, and promises an update. It does not speculate, assign blame or admit liability; have counsel review it where legal exposure is possible. Adapt these templates to the facts and your brand voice.
English template:
We are aware of [brief description of the issue] and are looking into it as a priority. We understand the concern this has caused, and we will share an update here by [time]. If you have been directly affected, please contact us at [channel] so our team can help you personally.
Arabic template:
نتابع ما يتم تداوله بخصوص [وصف مختصر للموضوع]، ونعمل على مراجعته بكل اهتمام. نقدّر قلق عملائنا ومتابعيكم، وسنوافيكم بالتحديث هنا خلال [الوقت]. ومن تأثّر بشكل مباشر نرجو التواصل معنا عبر [القناة] ليخدمه فريقنا بشكل شخصي.
Tone: respectful, calm, never sarcastic
- No sarcasm, jokes, memes or defensive replies, even to hostile accounts.
- Be especially careful with anything touching religion, the Royal family, national symbols, national occasions or religious seasons. Review imagery and wording, not just text.
- Apologise clearly when you are at fault; avoid conditional apologies such as "sorry if anyone was offended".
Handling comments and DMs
Do not delete legitimate criticism: deleting it can create additional reputational risk, so base deletion decisions on documented moderation rules. Remove or hide only content that breaks your published community rules or the platform's rules, such as abuse, spam, or someone else's personal data. Reply to recurring questions with the same approved answer, and pin your statement where the platform allows it.
When to take a conversation private
Move to DMs, phone or email when the conversation requires order numbers, phone numbers, health or financial details, or discussion of a named employee. Say so publicly ("We've sent you a private message so we can check your order details") so onlookers see that the complaint was answered, not buried.
Fake accounts, impersonation and misinformation
Fake accounts may appear during a crisis, sometimes offering bogus refunds. Warn followers through your organisation's confirmed official channels, and report the account through each platform's official channel:
- Facebook: report the profile or Page from its menu; non-users can use a contact form (Facebook Help Center).
- X: brands or their authorised representatives can file an impersonation report, and trademark misuse goes through X's trademark policy (X Help Center).
- TikTok: report in-app via Report, then "Pretending to be someone", or online (TikTok Privacy Center).
- Snapchat: its community guidelines prohibit impersonating brands and organisations for harmful purposes; report the account in-app (Snap Community Guidelines).
For misinformation, correct it once, calmly, with verifiable facts and a single source-of-truth page or post, then point people to it rather than arguing thread by thread. Monitoring helps you catch rumours early; our guide on social listening in Saudi Arabia covers what to track. If content may be defamatory or unlawful, involve legal counsel before responding.
If personal data is involved
A leak of customer data is a legal matter as well as a communications one. SDAIA's breach notification service states that personal data breach incidents that may cause harm must be reported within a period not exceeding 72 hours of becoming aware of them (SDAIA personal data breach notification); SDAIA is the competent authority under the PDPL (SDAIA guide to the PDPL). Article 24 of the PDPL Implementing Regulation ties this duty to breaches that potentially cause harm to the personal data or data subjects, or conflict with their rights or interests. Your public statement must be consistent with what is reported, so bring in legal counsel and your data protection lead immediately, and do not announce details before they have reviewed them.
Employee social posts
Set a clear policy: employees should not comment on the incident on behalf of the company, should direct questions to official channels, and should never share internal documents, screenshots or customer information. Send a short internal note early in any crisis reminding them of this. If an employee's own post triggered the crisis, handle it through HR and counsel, not in public replies.
Document everything
Keep a timestamped incident log: screenshots and links of key posts, every statement and who approved it, platform reports filed, and decisions taken.
After the crisis: review and resume
- Resume scheduled content gradually, checking every post for anything that could read badly in context.
- Hold a review within days: what triggered it, how fast you detected it, where approvals stalled, and what you would change.
- Update the playbook, templates and contact sheet, and follow through on any promises made publicly.
Prepare with drills
Run a short tabletop exercise at least twice a year: pick a realistic scenario, such as a viral complaint video, a hacked account or a rumour about your products, and walk through who is called, what gets paused and what is posted. Test the backups, not just the main contacts, and make sure login credentials for every official account are held securely by more than one authorised person.
Eclipse offers social media management and crisis-response planning.
Frequently asked questions
Should we delete negative comments during a social media crisis?
No. Deleting legitimate criticism can create additional reputational risk, so deletion decisions should follow documented moderation rules. Remove or hide only content that breaks your published community rules or platform policies, such as abuse, spam or other people's personal data, and answer the rest with approved wording.
How quickly should a business respond publicly?
Once an issue is public, publish a short holding statement as soon as the basic facts are confirmed, rather than waiting for the full investigation. It should acknowledge the situation, say what you are doing and when you will update, without speculating or assigning blame.
What should we do if someone is impersonating our brand account?
Warn followers through your organisation's confirmed official channels, keep screenshots and links, and report the account through each platform's official impersonation or trademark channel. If the fake account is taking money or personal data from customers, involve legal counsel as well.
Sources: dgp.sdaia.gov.sa · dgp.sdaia.gov.sa · facebook.com · help.x.com · tiktok.com · values.snap.com · dgp.sdaia.gov.sa