Chicago resident Amanda Bonnen had no clue that sending a tweet to a friend about her “moldy” apartment could lead to a $50,000 defamation lawsuit. She’s not the only one who has been taken aback by the liabilities of using social media. Courtney Love has been slapped with a suit for making comments about a fashion designer on her Facebook page and Twitter account.

Companies face similar risks as they and their employees get more heavily involved with sites such as Facebook, Twitter, and YouTube. Staffers can unwittingly reveal secret information in wide-open forums or expose the business to legal action by bad-mouthing the competition on a blog. Since social media is a relatively new phenomenon, there’s quite a bit of legal murkiness about it. But whether you’re diving into the social-media world as an organization or your employees are indulging in their free time, you should adopt protocols sooner rather than later. We talked to legal experts about the dos and don’ts for preventing an online crisis.

1. Make clear what’s acceptable in the office. And if you’re an employee, understand the rules. Company policies already cover porn (not allowed) and personal email (at the very least frowned upon). Before a personal Facebook status gets updated or a tweet gets blasted out, everyone should consider the same question: Is it OK to be doing this at work?

2. If you’re encouraging staffers to tweet, blog, etc. as part of their jobs, have specific guidelines. “If the employee appears to have the right to speak on behalf of the company, they need to disclose that fact when commenting about competitors or writing product reviews,” says Tom Bell, a partner at the Seattle office of law firm Perkins Coie, who focuses his practice on IT and the regulation of online content and business models. “If the employee decides to lift text from another source for use on the company-sponsored blog, not only will the employee be liable for infringement, but the company too may find itself facing a claim.”

3. Understand privacy issues. “The general rule of thumb is that an employee has no right to privacy over anything he or she writes, posts, or retrieves from the Web while using an employer’s computer,” says Jonathan Pink, an attorney with the Irvine, California, office of Bryan Cave and co-chair of the firm’s new Internet/Cyberlaw team.

4. Don’t be an open book, says Sid Fuchs, president and CEO of OAO Technology Solutions in Greenbelt, Maryland. That applies to personal and work-related activities. “It’s so easy now to inadvertently reveal proprietary information in a tweet or status update,” Bell warns. “Make sure that employees know what’s confidential, and keep training them on what not to disclose. You have to raise the level of awareness.”

5. Make sure that what your company puts out there is ready for public consumption, advocates Elizabeth Robinson, president, founder, and CEO of Volume Public Relations in Denver. “If you’re alerting people that you’re coming out with a new hand wash, time that announcement in a way that it generates enough presell buzz but doesn’t tip your hand.”

6. Protect yourself from defamation or defamation claims, the most common risks of using social media. Pink suggests having employees sign “a nondisparagement agreement, a confidentiality agreement, or the like,” to keep them from publishing false information about you or your competitors.

7. Realize that you don’t have total control. Companies can’t always regulate what employees say when they leave the office. “Companies have no absolute legal right to dictate what an employee can or can’t do, and, in fact, some states have statutes that affirmatively prohibit an employer from taking action against employees for lawful off-duty activity,” Pink advises. However, absent a contractual agreement to the contrary, an employer can look at a worker’s online persona and decide, “we really don’t want someone like that here,” he adds.

8. Understand the consequences. Ranting about the boss, your company, or a competitor could still lead to termination—especially since many workers are at-will employees and can be fired for no reason. A woman in the U.K. learned that lesson the hard way when she vented about her “wanker” boss, who was also her Facebook friend. The boss let her know right on her wall that her services were no longer required. If you don’t want the boss, the board of directors, or your co-workers to know something, don’t post it.