Acceptable Use Policy

Acceptable Use Policy: Set Clear Rules for Your IT and Internet

An acceptable use policy (AUP) tells staff and other users what they can and can't do with your computers, email, internet access, Wi-Fi and online services. It protects your systems and data, sets expectations for behaviour online, and explains how use is monitored. Robot Lawyer drafts the policy from your answers, for the law of the country or state you choose, and on the Verified plan a qualified legal professional checks it within 24 hours before you share it.

CONTENTS

What Is an Acceptable Use Policy?

An acceptable use policy is a set of rules for anyone who uses your organisation's IT and network resources. It covers everyday things, such as keeping passwords secret and spotting phishing emails, as well as what is never allowed, such as accessing illegal material or sharing confidential data.

A good AUP is short enough for people to read, clear about what is monitored and why, and fair about what happens if the rules are broken.

When Do You Need One?

• Employers
  Any organisation that gives staff laptops, email or system access.
• Schools, colleges and libraries
  Where students, staff or the public use your network.
• Hybrid and remote teams
  When people connect from home or on their own devices.
• Guest Wi-Fi
  Offices, venues and shops that offer internet access to visitors.
• Regulated sectors
  Healthcare, finance and other organisations handling sensitive information.

What's Included in Your Policy?

• Policy details
  Your organisation's name and address, who to contact, who owns the policy, its effective date, version and next review date.
• Scope
  Who the policy applies to and the resources it covers.
• Accounts and security
  Passwords, access, locking devices and reporting incidents.
• Email, internet and social media
  Professional, safe use of communication tools.
• Software and data
  Licensed software, intellectual property and protecting personal and confidential data.
• Personal devices and remote access
  Rules for working on your own devices or away from the office, where you need them.
• Prohibited activities
  Your list, plus the standard rules on unlawful and harmful use.
• Monitoring
  What you may monitor, why, and how it stays lawful and proportionate.
• Breaches
  How concerns are handled and the possible consequences.
• Optional forms
  A user acceptance form, a security incident report form and a personal device registration form, if you want them.

How It Works on Robot Lawyer

1. Answer the questions
   Tell us about your organisation, your users, the resources you provide and any activities you want to ban.
2. Generate your policy
   We draft a clear, plain-English policy users can follow.
3. Get it verified
   On the Verified plan, a qualified legal professional checks your policy within 24 hours and makes amendments where needed. The Essentials plan does not include this check. See how our documents are verified.
4. Share it with users
   Add it to your handbook, intranet or sign-in process, and record acceptance in the way you choose.

How It Works in Different Countries

• UK
  Monitoring staff must comply with the UK GDPR and be necessary, proportionate and transparent. Unauthorised access to computer systems is a criminal offence under the Computer Misuse Act 1990.
• EU and Ireland
  The GDPR applies to monitoring, and employees have strong expectations of privacy at work.
• United States
  Employers can usually monitor their own systems, but some states, including New York and Connecticut, require notice to employees about electronic monitoring.

These notes are general. Check the current rules where your users are.

Acceptable Use Policy FAQs

Can staff use work IT for personal things?

That's your choice. Many organisations allow limited, reasonable personal use outside working time. Your policy sets out the rule you choose.

Can we monitor emails and internet use?

Usually yes, if you have a legitimate reason, keep it proportionate and tell users about it in advance. Your policy explains what is monitored in general terms.

Does the policy cover personal phones and laptops?

It can. If people use their own devices for work or on your network, the policy can set security rules for them.

Do users need to sign the policy?

Not necessarily. You can record acceptance by a click-through, email or signed form. Your policy uses the method you choose.

Can I use this policy outside the UK?

Yes. Your policy is drafted under the law of the country or state you choose. Our lawyers are qualified in England and Wales and, on the Verified plan, check documents for good practice, clear formatting and the law of England and Wales. They are not qualified in other countries' law, so if your policy is governed by another country's law, we recommend having a local lawyer check it too.

Create an Acceptable Use Policy

Keep your systems and data safe with clear rules for every user. You can start with a 7-day free trial. See our pricing for the plans. Related documents: Privacy Policy, Compliance Policy, Safeguarding Policy and Cookies Policy.