It depends how much of a chance you want to give her.
Obviously the first thing you do is give HR a heads up that this conversation is happening. They might be pretty hands off in your org, or they might want to take an active role in planning the conversation. If they want to follow your lead, and you think your colleague could learn to do better, you might opt for the gentle 1:1.
So you'd need a script for that, as it's going to be a difficult conversation. Then book a private meeting room.
Bit of chitchat at you get settled, then straight into it.
"Annie, thanks for taking the time to speak with me. I've spoken to HR, and they know we're having this conversation. The reason for this meeting is that I wanted to reassure you that your personal life and what you do outside of work is your own business, not ours, and we have no reason to get involved or make your work life difficult, as long as your personal life and professional life are kept separate and it's all lawful, and there's no risk to the company's reputation. Does that sound fair?
"Great. This is the sort of thing that can be - but doesn't need to be - a disciplinary matter, so I just want to be absolutely clear on where we both stand. As I say, keeping it separate is a significant part of it, and that means a few ground rules. I'll go over a few things - it might be helpful if you want to write these down?
The first one is no work on your second job during work hours. This is actually a legal warning I think I need to give you, as it's a breach of your contract of employment. If you're posting during time you're paid to be here, it's defrauding the organisation and not something we can really look past - this relates especially to monetising opportunities. So you'll need to keep your personal activities to your own time before or after work hours.
"The second one is keeping work out of it. That means not talking about where you work or what you do here, and not sharing any content about the organisation. It also means not creating or sharing content while on work premises, even during breaks. If you do have any content that's taken or shared while at work, it would be a good idea to take that down. I'm not going to look at your socials unless I absolutely have to, so if you can give me your assurance on this, that would be great.
"The last thing I'm going to say is more for your privacy really. I'd recommend you use separate and non-identifying contact details for anything you don't want to be common knowledge at work. The way the big social media businesses work is that when you have an account on your phone, they search your phone contacts for other numbers who also have accounts, and then they recommend those accounts to each other. So if you give your phone number to colleagues for a group WhatsApp about the Christmas party, and some colleagues have (for example) Twitter, your twitter account can pop up in their feeds as a recommended account. You might be ok with this, but you should be aware that this means some of your colleagues will share this information with HR and management as they will think we should know. [If you have client-facing work: This will also happen with any clients you share your contact details with, and if that happens, we will have to think seriously about whether this affects the company's reputation.] You might also want to think about whether you choose to use other identifying features, such as your name or face, if you're not happy with the idea of clients and colleagues knowing more about you.
I know this is probably a lot to take in, so I'm going to give you some time to think about what we've discussed and what steps you can take. I'm going to put in some time for a follow up chat in a couple of days and I'd be grateful if you could let me know then what assurances you can give me that we won't need to have this conversation again. As I said, I've spoken to HR and I'd like to be able to let them know what we can expect."
That's the playbook I'd script, anyway.
There's a lot more that could be said but I'd keep it to the big three: work hours, work confidentiality, and use of PII.