While academics are now expected to engage with the use of social media as part of their professional roles – to support teaching and learning, research activities and scholarly communication beyond the academy, for example - it is typically done through the use of personal accounts. As an increasing number of studies show, this places individual academics in a position of personal risk, being potentially exposed to threats of online abuse, trolling and harassment. This raises a question of institutional responsibility and duty of care. In this paper, we present a systematic survey of the availability of social media policy documents in the context of the UK higher education sector. Furthermore, we examine the content and features of policies to explore how personal and professional identities are navigated, and the extent to which policies address risks to staff. The analysis shows that institutional social media policies are heavily skewed towards protecting the institution, rather than staff. As social media use is increasingly considered to be part of academic roles, this highlights a real need for a reframing of such policies to extend the duty of care of institutions.