Acceptable use policy template (staff IT)
An acceptable use policy (AUP) sets the rules for how staff use the company's computers, phones, email, internet and data, and what happens when someone breaks them. This free Word template covers devices, passwords, email, internet and personal use, social media, personal devices, monitoring and reporting, and ends with an acknowledgement for each person to sign.
Running a company of 30 to 200 people? Documents like this are now worth money.
It's written for UK employers of roughly 10 to 250 people. The monitoring section follows the ICO's guidance on monitoring workers, because telling staff what you check is a legal duty, not a courtesy.
What's in the template
IT acceptable use policy
| Company | |
|---|---|
| Applies to | Everyone with a company account or device, including contractors and temporary staff |
| Policy owner | |
| IT contact for questions and reports | |
| Version, date and next review |
1. Devices
- Lock your screen whenever you leave it
- Let updates install; keep security software switched on
- Install only software that IT has approved
- Report a lost or stolen device to IT immediately
2. Accounts and passwords
- Use only your own account; never share passwords or sign-in codes
- Use a long password just for your work account, such as three random words
- Keep passwords in the company password manager
- Tell IT at once if you think a password has been exposed
3. Email and messages
- Check recipients before sending personal or confidential information
- Don't forward work email to personal accounts
- Report suspicious messages using [button or address] without replying or clicking
4. Internet and personal use
- Brief personal use is allowed [when], if it doesn't affect your work
- Never view, download or share illegal, sexually explicit, violent or discriminatory material
- No pirated software, films or music
- Don't copy company data to personal storage or accounts
5. Social media
- Never post confidential information about the company, customers or colleagues
- Make clear that personal views are your own
- Only [roles] speak for the company
- Online harassment of colleagues is treated as workplace misconduct
6. Personal devices used for work
- Only with IT's approval
- Screen lock on, updates installed, apps from official stores only
- IT may remove company data from the device, but not your personal data
7. Monitoring
| What we monitor | Why | How | Who sees it | Kept for |
|---|---|---|---|---|
No covert monitoring except in exceptional cases authorised by senior management. You can ask for monitoring information about you through a subject access request.
8. Breaking this policy
Breaches are handled under the disciplinary procedure; serious ones may be gross misconduct. Promptly reporting your own mistake is never in itself a disciplinary matter.
Acknowledgement
| Name | |
|---|---|
| Signature and date | I have read this policy and will follow it |
How to write an acceptable use policy
- List what it covers: laptops and phones, cloud apps, shared logins, and personal phones that receive work email.
- Draw the personal-use line in plain words (when, how much, what's never allowed) so every manager applies it the same way.
- Write the monitoring section from what your systems actually do. Ask your IT provider what is filtered, logged or recorded today.
- Do a DPIA before adding intrusive monitoring.
- Match it to your disciplinary procedure, with examples of gross misconduct.
- Get every user to acknowledge it at induction and after each change, contractors included.
- Leave the company's own controls out. Firewalls, updates and backups belong in the IT security policy.
Monitoring staff: what the ICO expects
The ICO's guidance covers monitoring at work and at home:
- Tell people. Workers must be told about monitoring in a way that's accessible and easy to understand; your policy should explain its nature, purpose and extent.
- Purpose first. You need a clear purpose and a lawful basis, and must use the least intrusive means.
- Assess it. The ICO says you must complete a DPIA before monitoring emails and messages, and before any monitoring likely to be high risk.
- Covert monitoring is only for exceptional cases, such as suspected crime or gross misconduct, authorised by senior management and limited to the investigation.
- Keep and share. Hold monitoring data no longer than necessary, and include it in subject access responses unless an exemption applies.
Interception. Under the Investigatory Powers (Interception by Businesses etc.) Regulations 2018, a business intercepting communications on its own systems must, among other conditions, have made all reasonable efforts to tell every user that communications may be intercepted. A signed acknowledgement helps show you did.
Example: a fictional 45-person architecture practice
Section 7 as the practice filled it in:
| What | Why | How | Who sees it | Kept for |
|---|---|---|---|---|
| Email filtering | Block malware and phishing | Automatic scanning of all mail | IT provider | 30 days |
| Web filtering | Block malicious and illegal sites | Blocked categories; no browsing reports on individuals | IT provider | 30 days |
| Sign-in logs | Spot account takeovers | Alerts on unusual sign-ins | IT provider, practice manager | 90 days |
| Mailbox access during absence | Keep client work moving | Director's approval; the person is told | Practice manager | Not kept |
Personal use is allowed at lunch and outside working hours, on the guest wifi. Its DPIA ruled out keystroke and screenshot monitoring: sign-in alerts met the security purpose with far less intrusion.
Common mistakes
- Banning all personal use while everyone messages from work phones. Unenforced rules weaken the ones you need.
- "We may monitor anything at any time" as the whole monitoring section. It says nothing about what, why or for how long.
- Monitoring that the policy doesn't mention.
- Forgetting personal phones that receive work email.
- Punishing staff who report clicking a phishing link, so the next click goes unreported.
Frequently asked questions
Can we monitor staff emails?
Yes, if it's necessary and proportionate for a clear purpose, staff have been told, and you've completed a DPIA first, which the ICO says monitoring emails and messages requires. Reading content is harder to justify than checking traffic data when that would meet your purpose.
Do employees have to sign an acceptable use policy?
No law requires a signature, but an acknowledgement from each user, signed or clicked, is the simplest proof that they were told the rules and about any monitoring.
What if someone breaks the policy?
Use your disciplinary procedure, following the Acas Code of Practice, which employment tribunals take into account. Some breaches are also crimes: unauthorised access under the Computer Misuse Act 1990, or knowingly or recklessly obtaining or disclosing personal data without the company's consent (section 170, Data Protection Act 2018).
Treat the template as a base for your own rules, not as legal advice.
Sources
- ICO: Employment practices and data protection, monitoring workers
- ICO: Data protection and monitoring workers
- ICO: Specific considerations for different methods of monitoring workers
- legislation.gov.uk: Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, regulation 4
- NCSC: Three random words
- Acas: Code of Practice on disciplinary and grievance procedures
- legislation.gov.uk: Computer Misuse Act 1990, section 1
- legislation.gov.uk: Data Protection Act 2018, section 170