Acceptable Use Policy Template
How company systems, data and devices may be used — including AI services.
Details
acceptable use policy templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
| Applies to | [who it applies to] |
| Owner | [owner] |
| Effective from | October 14, 2026 |
| Next review | [date] |
1. What the systems are for
[the general principle]
2. The rules
| Area | The rule |
|---|---|
| [add one rule per line] |
3. Monitoring
[what is logged, when it is looked at, what you are told]
4. When something goes wrong
Report a lost device, a suspected phishing email, or data sent to the wrong person the same day. Reporting quickly is what limits the damage; nobody is disciplined for reporting a mistake promptly and honestly.
What is an IT Acceptable Use Policy?
An IT acceptable use policy states how staff may use company systems, data, devices and accounts — including the AI services many people now paste work into. It matters because without it, you have no agreed baseline: no clear line between careless and misconduct, no basis for a disciplinary decision that will survive challenge, and no answer when confidential material turns up somewhere it should never have been.
Every organisation with shared systems needs one, and it applies to more people than employees: contractors, temporary staff, interns, volunteers and often board members all get accounts. It is normally issued at induction and acknowledged in writing, then reissued when it changes. IT writes the technical content, HR owns the consequences, and someone senior signs it. The scope has widened — personal devices reading company email, home networks, cloud storage bought on an expense card, browser extensions, and generative AI tools that send whatever is typed into them to a third party.
Monitoring is where the law bites, and it varies. In the EU and the UK, monitoring employees involves data protection obligations — a lawful basis, transparency, and often a documented impact assessment — so a policy that simply asserts a right to monitor everything is unlikely to be enough. Australia has state-level workplace surveillance laws requiring notice. In the US, rules on monitoring and on recording differ by state. In India, the IT Act and its rules govern sensitive personal data. Whatever your location, take advice on what you may monitor and what you must tell people first.
This policy sets rules for people; it is not a security control. Nothing in it prevents a determined insider or an external attacker, which is what access controls, multi-factor authentication, patching and backups are for. It is also not a data protection policy, a records retention schedule or an incident response plan, though it should point at all three. And it is not self-enforcing: a policy that is never referenced in a disciplinary process, never updated and never acknowledged is treated by staff exactly as seriously as you treat it.
What to put in an IT Acceptable Use Policy
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Issuing organisation | For example: Maple Grove Homeowners Association |
| Organisation address | For example: 1420 Kinnear Road, Columbus, OH 43212 |
| Who this applies to | For example: All employees, contractors and anyone posting on a company account |
| Policy owner | For example: Head of People |
| Next review | Free text |
| Acceptable use | For example: Company systems are provided for company work. Reasonable personal use is allowed where… |
| The rules | One per line: Area | The rule |
| Monitoring | For example: The company logs access to its systems and may examine those logs where it has reason to.… |
| If the policy is not followed optional | For example: Unapproved absence may be treated as unauthorised and dealt with under the disciplinary… |
How to write an IT Acceptable Use Policy
Define scope, systems and who is covered
List what counts as a company system: laptops, phones, email, file storage, the accounting package, the VPN, and any account created with a work address. Say whether personal devices are in scope when used for work. Then name who the policy binds — employees, contractors, agency staff, volunteers — because a contractor who never signed anything is a gap you will find at the worst moment.
Separate prohibited from discouraged
Two lists, clearly marked. Prohibited means disciplinary action: sharing credentials, disabling security software, downloading the customer database to a personal drive. Discouraged means judgement: occasional personal browsing, installing a productivity extension. Blurring the two makes the whole document unenforceable, because a manager cannot say with a straight face that a personal email breached the same rule as exporting client data.
Write the rule for AI tools
Say which AI services are approved, and what may and may not be entered into them. Draft an email from these notes is different from paste the patient list and summarise it. Be concrete about categories: customer personal data, unpublished financial results, source code, credentials. Say who to ask about a new tool, because a blanket ban simply moves the usage out of sight.
State what is monitored and why
Describe what is logged and inspected — email metadata, web filtering, device management, access records — the purpose, how long records are kept and who may review them. Say what will trigger a look at an individual's activity and who authorises it. Confirm with a lawyer that what you are describing is lawful where your people work before publishing it.
Set consequences and get an acknowledgement
State plainly that breaches may lead to disciplinary action up to dismissal, and that serious cases may be reported to authorities. Cross-reference the disciplinary procedure rather than restating it. Then collect a dated acknowledgement from every person covered, and repeat it whenever the policy changes materially. Without that record, the policy is hard to rely on.
Common mistakes
- Writing a rule against all personal use that nobody enforces, which makes every other rule in the document look optional.
- Ignoring AI tools completely, so confidential material goes into third-party services with no guidance and no record of what was shared.
- Claiming a sweeping right to monitor without checking local data protection and surveillance law, which can make the monitoring itself unlawful.
- Never collecting signed acknowledgements, leaving no evidence the employee knew the rule when a dismissal is challenged.
- Failing to apply the policy to contractors and temporary staff, who often hold the same access as employees with none of the obligations.
Frequently asked questions
What should be in an acceptable use policy?
Scope and who it covers, what systems it applies to, acceptable and prohibited use, rules on passwords and access, personal use, personal devices, software installation, data handling and classification, AI tools, monitoring, incident reporting, and consequences of breach. Keep it to a length people will read, and put procedural detail into separate documents you reference.
Can employers monitor employee emails and internet use?
Often yes, within limits, and the limits differ by jurisdiction. In the EU and UK you generally need a lawful basis, transparency and proportionality, and sometimes a documented assessment. Australian states require notice under surveillance legislation. US rules vary by state. Blanket covert monitoring is the riskiest approach everywhere. Take legal advice for the countries your staff work in.
Should an acceptable use policy cover ChatGPT and other AI tools?
Yes — this is now one of the main routes by which confidential information leaves an organisation. Say which tools are approved, what categories of information must never be entered, and how to request approval for a new service. A rule people can apply beats a prohibition they will quietly ignore, and it gives you something to point at if something goes wrong.
Is an acceptable use policy legally binding on employees?
It depends on how it is issued. A policy incorporated into the employment contract or issued under a contractual right to set workplace rules, communicated and acknowledged, is normally enforceable through the disciplinary process. One that sits unread on a shared drive is much weaker. How this works varies by country and by the wording of your contracts, so check with an employment adviser.
How often should the policy be updated?
Review it annually and whenever something changes materially — a new class of tool, a move to different cloud services, a change in the law, or an incident that revealed a gap. Reissue and re-acknowledge when the change affects what people may do. Version and date every copy so it is obvious which one was in force on a given day.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.