IT Acceptable Use Policy

Clear, fair rules for staff on using work devices, email, the internet, cloud apps and AI tools – with monitoring, personal use and reporting set out in plain English.

Editable Word document
15
10pages
Guidance notes included
aml consultancy solutions

IT & cyber security

IT Acceptable Use Policy

About this document

What it’s for

An internal policy telling everyone who uses your IT what they may and may not do: devices, accounts, email, internet, software, cloud and AI tools, data handling, personal use and monitoring. It sits under your Information Security Policy and gives staff the day-to-day rules.

When to use it

  • Give it to every new starter, contractor and temporary worker before they get system access
  • Re-issue it when you bring in new systems, AI tools or monitoring
  • Use it as the benchmark if misuse or a security incident needs investigating

What’s inside

The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.

  1. Purpose
  2. Scope
  3. Definitions
  4. Roles and responsibilities
  5. General principles
  6. Accounts, passwords and multi-factor authentication
  7. Using our devices
  8. Email, messaging and phishing
  9. Internet use
  10. Personal use
  11. Prohibited use
  12. Software, apps and cloud services
  13. Artificial intelligence tools
  14. Social media and online communications
  15. Handling information and removable media
  16. Telephones and video calls
  17. Monitoring
  18. Reporting incidents and concerns
  19. Leaving us or changing role
  20. Breaches of this policy
  21. Training
  22. Review and related documents
  23. Purpose
  24. Scope
  25. Definitions
  26. Roles and responsibilities
  27. General principles
  28. Accounts, passwords and multi-factor authentication
  29. Using our devices
  30. Email, messaging and phishing
  31. Internet use
  32. Personal use
  33. Prohibited use
  34. Software, apps and cloud services
  35. Artificial intelligence tools
  36. Social media and online communications
  37. Handling information and removable media
  38. Telephones and video calls
  39. Monitoring
  40. Reporting incidents and concerns
  41. Leaving us or changing role
  42. Breaches of this policy
  43. Training
  44. Review and related documents

How to complete it

  • Fill in the placeholders and delete options that do not apply (for example personal use rules)
  • List your approved software and cloud services in Appendix C
  • If you monitor staff, complete a DPIA and describe the monitoring accurately in clause 17
  • Ask everyone to sign the acknowledgement in Appendix B

Key points to check

  • Monitoring must be lawful, proportionate and transparent – do not monitor in ways this policy does not describe
  • Make sure the disciplinary consequences match your disciplinary policy

Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.

Included in the pack

IT & cyber security

£20

for every document in this category

Editable Microsoft Word files

Guidance notes in every document

Written for UK businesses

Download and keep

Get the packSee every document in this pack →

Need more than one category?

Documents All-Access gives you every category for 12 months for £295.

Compare options →

Need it tailored?

We can adapt any template to your business, or write a document from scratch.

Talk to us →