What activities should be prohibited in an IT Acceptable Use Policy?

It should prohibit unauthorised access, malware, illegal downloads, harassment, discriminatory content, misuse of confidential data, copyright infringement, and any activity that may compromise security or breach the law.

Can employees use company IT systems for personal use?

Yes. It should state whether personal use is allowed, any limits on that use, and when personal activity may be monitored or restricted.

What happens if an employee breaches an Acceptable Use Policy?

It should explain that breaches may lead to access restrictions, investigation, disciplinary action, dismissal, legal claims, or reporting to regulators or law enforcement where appropriate.

Should employees sign an Acceptable Use Policy?

Yes. Employees should be told about the policy, given access to it, and asked to confirm they have read and understood it.

How often should a UK Acceptable Use Policy be reviewed?

It should be reviewed regularly, especially after changes to UK data protection law, cybersecurity risks, working practices, business systems, or internal procedures.

How does an Acceptable Use Policy help with cybersecurity compliance?

It helps demonstrate that the organisation has clear rules and controls for safe use of IT systems, reducing risks from phishing, malware, weak passwords, data leaks, and unauthorised access.

Can an Acceptable Use Policy apply to contractors and third parties?

Yes. The policy can apply to employees, contractors, consultants, temporary workers, and other users who access company IT systems, subject to their contract terms.

EN-GB>Governance>Acceptable Use Policy>UK Acceptable Use Policy Compliance

UK Acceptable Use Policy Compliance Considerations

Created: 9 Jun 2026

This article highlights key UK compliance considerations for acceptable use policies, helping readers understand relevant risks, obligations, and practical safeguards. It complements our AI Generated Acceptable Use Policy for use in the United Kingdom resources.

Compliance Topic	Relevance to Policy	Implementation Method	Compliance Sensitivity	Related Documents
Data protection
Lawful, fair and transparent processing	Employee IT rules may involve processing personal data such as logs, emails and browsing records.	Policy wording Employee notice	High	Employee privacy notice, monitoring notice, data protection policy.
Data protection, Communications monitoring
Lawful basis for monitoring and IT logs	Monitoring, security logs and access records need a lawful basis before personal data is collected.	Employee notice Record keeping Management approval	High	Legitimate interests assessment, DPIA, employee privacy notice.
Special category data in communications	Emails, web history or chat content may reveal health, union, religion or other sensitive data.	Policy wording Employee notice Technical control	High	Special category data policy, monitoring notice, DPIA.
Data minimisation in IT monitoring	Logs and monitoring should be limited to what is necessary for security or business purposes.	Policy wording Technical control Record keeping	High	Monitoring policy, retention schedule, security logging standard.
Data protection, Records management
Retention of monitoring logs	IT logs and misuse investigation records should not be kept for longer than needed.	Policy wording Record keeping Technical control	Medium	Data retention policy, investigation procedure, deletion schedule.
Data protection, Information security
Security of personal data	Users must handle systems and personal data securely to reduce unauthorised access or disclosure.	Policy wording Training Technical control	High	Information security policy, access control policy, cyber incident plan.
Personal data breach reporting	Users should promptly report lost devices, misdirected emails and suspected account compromise.	Policy wording Training Record keeping	High	Data breach procedure, incident response plan, reporting form.
Data protection, Communications monitoring
DPIA for intrusive monitoring	High-risk monitoring, such as systematic activity tracking, may require a documented DPIA.	Record keeping Management approval Employee notice	High	DPIA template, monitoring policy, risk assessment procedure.
Data protection, Records management
Accountability for monitoring decisions	Organisations should evidence why monitoring and IT restrictions are necessary and proportionate.	Record keeping Management approval	Medium	ROPA, LIA, DPIA, governance approvals.
Communications monitoring, Employment practices, Data protection
Worker transparency about monitoring	Employees should be told what IT activity is monitored, why, how and for how long.	Employee notice Policy wording Training	High	Monitoring notice, employee privacy notice, staff handbook.
Communications monitoring
Interception of communications	Monitoring emails, calls or messages may engage interception rules and should be carefully authorised.	Policy wording Management approval Employee notice	High	Communications monitoring policy, lawful interception procedure.
Lawful business monitoring of communications	Employers may monitor certain communications for defined business purposes if users are informed.	Employee notice Policy wording Management approval	High	Monitoring notice, telecoms use policy, call recording procedure.
Communications monitoring, Employment practices
Respect for private life and correspondence	Monitoring personal communications at work should be necessary, proportionate and clearly notified.	Employee notice Policy wording Management approval	High	Monitoring policy, privacy notice, disciplinary procedure.
Employment practices
Disciplinary consequences of IT misuse	The policy should state that serious misuse may lead to disciplinary action or dismissal.	Policy wording Training	Medium	Disciplinary policy, staff handbook, employment contract.
Employment practices, Records management
Fair handling of IT misconduct allegations	IT misuse investigations should follow fair process and keep appropriate evidence records.	Record keeping Management approval Policy wording	Medium	Investigation procedure, disciplinary procedure, evidence handling guidance.
Employment practices, Communications monitoring
Harassment and discriminatory IT use	Email, messaging and social platforms should not be used for harassment or discriminatory conduct.	Policy wording Training	High	Equality policy, anti-harassment policy, social media policy.
Preventing sexual harassment via IT systems	Work messaging, email and collaboration tools can be channels for harassment that employers must address.	Policy wording Training Management approval	High	Anti-harassment policy, reporting procedure, disciplinary policy.
Confidentiality, Information security
Confidential business information	Users should not disclose confidential information through email, cloud services or public tools.	Policy wording Training Technical control	High	Confidentiality agreement, NDA, information classification policy.
Protection of trade secrets	IT rules should restrict unauthorised copying, sharing or exporting commercially sensitive know-how.	Policy wording Technical control Training	High	Information classification policy, NDA, leaver process.
Information security, Employment practices
Unauthorised access to computer systems	Employees should be prohibited from accessing systems, accounts or data without authorisation.	Policy wording Training Technical control	High	Access control policy, disciplinary policy, privileged access procedure.
Information security
Malware and system interference	Users should not introduce malware, disable security tools or damage systems or data.	Policy wording Technical control Training	High	Malware protection standard, incident response plan, security policy.
Information security, Asset management
Password and authentication rules	Users need clear rules on password secrecy, sharing, password managers and account protection.	Policy wording Technical control Training	High	Access control policy, password standard, MFA procedure.
Information security
Multi-factor authentication use	Users should use MFA where required and not bypass or weaken authentication controls.	Technical control Policy wording Training	High	MFA standard, access control policy, remote access procedure.
Phishing and suspicious email reporting	Employees should verify suspicious messages and report phishing attempts promptly.	Training Policy wording Technical control	Medium	Cyber awareness training, incident response plan, email security standard.
Information security, Asset management
Unauthorised software installation	Unapproved software can create malware, licensing and data leakage risks.	Policy wording Technical control Management approval	Medium	Software asset policy, procurement procedure, application allowlist.
Asset management, Information security
Software licensing compliance	Users should not install pirated, unlicensed or personally licensed software on business systems.	Policy wording Record keeping Technical control	Medium	Software asset register, procurement policy, licence management process.
Information security, Employment practices
Copyright-infringing downloads and sharing	Users should not use company systems for unlawful copying, streaming or file sharing.	Policy wording Training Technical control	Medium	IP policy, disciplinary policy, web filtering standard.
Employment practices, Information security
Illegal or offensive online material	The policy should ban using work systems for illegal, obscene, abusive or extremist material.	Policy wording Technical control Training	High	Disciplinary policy, safeguarding policy, web filtering procedure.
Extremist material and Prevent duty	Relevant public bodies and education providers should restrict access to extremist material on systems.	Policy wording Technical control Training	High	Prevent policy, safeguarding policy, web filtering standard.
Information security, Asset management
Remote working security	Remote users need rules on secure networks, device storage, privacy and reporting loss.	Policy wording Training Technical control	Medium	Remote working policy, homeworking risk assessment, VPN procedure.
Information security, Asset management, Data protection
Bring your own device use	Personal devices accessing work data need rules on enrolment, security, separation and wiping.	Policy wording Technical control Employee notice	High	BYOD policy, mobile device management procedure, privacy notice.
Lost or stolen devices	Prompt loss reporting helps containment, remote wipe and personal data breach assessment.	Policy wording Training Record keeping	High	Asset register, incident response plan, data breach procedure.
Information security, Asset management
Removable media use	USB drives and external media should be restricted, encrypted or approved before use.	Technical control Policy wording Management approval	Medium	Removable media policy, encryption standard, asset register.
Information security, Data protection
Encryption of devices and portable data	Encryption reduces harm if laptops, phones or removable media containing data are lost.	Technical control Policy wording	High	Encryption standard, mobile device policy, data breach procedure.
Information security, Confidentiality, Data protection
Cloud storage and file sharing	Users should use approved cloud services and avoid public links or personal storage accounts.	Policy wording Technical control Training	High	Cloud policy, data classification policy, supplier risk process.
Information security
Public Wi-Fi and network use	Users should protect work connections on untrusted networks, normally through approved secure access.	Policy wording Technical control Training	Medium	Remote access procedure, VPN standard, travel security guidance.
Employment practices, Confidentiality, Communications monitoring
Work-related social media use	Employees need rules on representing the business, confidentiality and inappropriate online conduct.	Policy wording Training	Medium	Social media policy, communications policy, disciplinary policy.
Information security, Confidentiality, Communications monitoring
Email use and business communications	Email rules help prevent misdirected messages, phishing, data leaks and inappropriate content.	Policy wording Training Technical control	Medium	Email policy, data breach procedure, records retention policy.
Information security, Employment practices
Internet use and web filtering	Rules should define permitted browsing, blocked content, personal use and security expectations.	Policy wording Technical control Employee notice	Medium	Web filtering standard, monitoring notice, disciplinary policy.
Employment practices, Communications monitoring
Limited personal use of IT systems	If personal use is allowed, boundaries and monitoring expectations should be clear.	Policy wording Employee notice	Medium	Staff handbook, monitoring notice, disciplinary procedure.
Information security, Asset management, Data protection
Least privilege and access rights	Users should only access systems and data needed for their role and authorised tasks.	Technical control Policy wording Record keeping	High	Access control policy, joiner-mover-leaver process, role matrix.
Information security, Asset management
Privileged account use	Administrator accounts need stricter use, logging and approval to prevent major security incidents.	Technical control Management approval Record keeping	High	Privileged access policy, admin account register, audit logging standard.
Information security, Asset management, Records management
Joiner, mover and leaver access changes	Access should be granted, changed and removed promptly as roles change or employment ends.	Record keeping Technical control Management approval	High	JML process, HR onboarding, leaver checklist, access review procedure.
Asset management, Information security, Records management
Return and disposal of IT assets	Users should return equipment and ensure data-bearing media is securely handled at end of use.	Policy wording Record keeping Technical control	Medium	Asset register, leaver process, secure disposal procedure.
Records management
Business records in email and collaboration tools	Users should save important business records outside transient chats or personal mailboxes.	Policy wording Training Record keeping	Medium	Records management policy, retention schedule, document management procedure.
Litigation hold for electronic records	Users may need to preserve relevant emails, files and messages during disputes or investigations.	Policy wording Record keeping Management approval	Medium	Legal hold procedure, records retention policy, investigation procedure.
Freedom of Information records	Public authorities should manage work emails and files because they may be disclosable records.	Policy wording Training Record keeping	Medium	FOI procedure, records management policy, retention schedule.
Environmental information records	Relevant authorities should retain and manage electronic environmental information for access requests.	Record keeping Policy wording Training	Low	EIR procedure, records management policy, retention schedule.
Data protection, Communications monitoring
Electronic marketing communications	Employees sending marketing emails or texts must follow consent, opt-out and suppression rules.	Policy wording Training Record keeping	High	Marketing compliance policy, CRM procedure, suppression list process.
Cookies and tracking technologies	Internal portals or monitoring tools using tracking may require notices and consent analysis.	Employee notice Policy wording Technical control	Medium	Cookie notice, employee privacy notice, monitoring notice.
Data protection, Information security
International transfers through IT services	Cloud, support and remote access tools may transfer personal data outside the UK.	Management approval Policy wording Record keeping	High	Supplier due diligence, transfer risk assessment, data processing agreements.
Data protection, Information security, Asset management
Use of IT service providers as processors	Acceptable tools should be approved where vendors process personal data on the organisation's behalf.	Management approval Record keeping Policy wording	High	Supplier onboarding, DPA register, approved applications list.
Data protection, Confidentiality, Information security
Use of generative AI tools	Users should not paste personal data, confidential information or code into unapproved AI tools.	Policy wording Training Technical control	High	AI use policy, data protection policy, confidentiality policy.
Information security, Data protection
Screen locking and unattended devices	Unattended logged-in devices can expose personal, confidential or business-critical information.	Policy wording Technical control Training	Medium	Information security policy, clean desk policy, device standard.
Information security, Asset management
Security updates and patching	Users should not delay, disable or interfere with required security updates.	Technical control Policy wording Training	Medium	Patch management policy, device management standard, change process.
Information security, Records management, Communications monitoring
Audit logging and log integrity	Users should know that security logs may be kept and must not be tampered with.	Policy wording Technical control Employee notice	High	Logging standard, monitoring notice, incident response plan.
Employment practices, Records management, Information security
Policy acknowledgement and training records	Keeping acknowledgement records helps evidence that users knew the IT rules and risks.	Training Record keeping	Medium	Training register, staff handbook acknowledgement, induction checklist.
Records management, Communications monitoring
Regulated communications recordkeeping	FCA-regulated firms may need rules on approved channels and retention of business communications.	Policy wording Technical control Record keeping	High	Communications policy, regulated records policy, mobile messaging procedure.
Confidentiality, Data protection, Information security
Patient and health information confidentiality	Health and care users need strict rules on accessing, sharing and discussing patient information.	Policy wording Training Technical control	High	Confidentiality policy, clinical systems access policy, IG training.
Information security, Confidentiality, Data protection
Payment card data handling	Users should not store or transmit card data through unapproved emails, chats or files.	Policy wording Training Technical control	High	PCI DSS procedure, payment handling policy, data classification policy.
Information security, Asset management
ISO 27001 acceptable use alignment	ISO-aligned organisations should define acceptable use of information and associated assets.	Policy wording Record keeping Management approval	Medium	ISMS policies, asset management policy, information security risk register.
Cyber Essentials user controls	Acceptable use should support secure configuration, access control, malware protection and updates.	Technical control Policy wording Record keeping	Medium	Cyber Essentials evidence, patch policy, access control standard.
Information security, Employment practices
Unauthorised security testing	Employees should not scan, probe or test systems unless formally authorised.	Policy wording Management approval Training	High	Penetration testing policy, change management, security testing approval process.
Data protection, Records management, Communications monitoring
Access requests for monitoring records	Monitoring logs and investigation files may be requested by workers as personal data.	Record keeping Policy wording	Medium	SAR procedure, retention policy, monitoring records register.
Information security, Asset management
Account sharing prohibition	Shared accounts weaken accountability and make misuse investigations harder.	Policy wording Technical control Training	Medium	Access control policy, password standard, audit logging policy.
Information security, Confidentiality, Data protection
Personal email and storage accounts	Sending work data to personal accounts increases loss, access and retention risks.	Policy wording Technical control Training	High	Data classification policy, email policy, cloud storage policy.
Confidentiality, Information security, Records management
Information classification and handling	Users need handling rules for public, internal, confidential and restricted information.	Policy wording Training Technical control	Medium	Information classification policy, records policy, data loss prevention rules.
Information security, Confidentiality, Data protection
Data loss prevention controls	Users should understand restrictions on copying, forwarding, uploading or printing sensitive data.	Technical control Policy wording Employee notice	High	DLP standard, information classification policy, monitoring notice.
Information security, Data protection, Records management
Printing and physical copies	Printing from IT systems can expose personal or confidential information if unmanaged.	Policy wording Technical control Training	Medium	Clear desk policy, secure printing procedure, records disposal policy.
Information security, Records management, Asset management
Saving work data in approved locations	Users should store work files where backups, retention and access controls apply.	Policy wording Training Technical control	Medium	Backup policy, records management policy, cloud storage standard.
Confidentiality, Information security
Restricted exports and sanctioned parties	Some technical data, software or communications may require controls before sharing externally.	Policy wording Training Management approval	High	Export control policy, sanctions procedure, external sharing approval process.
Employment practices, Confidentiality
Whistleblowing and protected disclosures	Confidentiality and monitoring rules should not prevent lawful protected disclosures.	Policy wording Training Employee notice	Medium	Whistleblowing policy, confidentiality policy, investigation procedure.
Information security, Employment practices
Insider threat and suspicious behaviour	Users should report suspicious access, unusual data transfers or attempts to bypass controls.	Training Policy wording Management approval	Medium	Insider threat process, incident response plan, HR investigation procedure.
Communications monitoring, Records management, Confidentiality
Collaboration and instant messaging tools	Chats can contain business records, personal data and confidential information requiring controls.	Policy wording Training Technical control	Medium	Collaboration tools policy, records policy, monitoring notice.
Communications monitoring, Data protection, Confidentiality
Video meetings and recordings	Meetings and recordings may expose personal, confidential or commercially sensitive information.	Policy wording Employee notice Technical control	Medium	Video conferencing policy, recording notice, records retention policy.

What Should A UK Acceptable Use Policy Cover For Compliance?

A UK Acceptable Use Policy should do more than list prohibited IT behaviour. It should align employee technology use with UK GDPR, the Data Protection Act 2018, employment law, monitoring rules, information security expectations and records management duties.

When Is Employee Monitoring Lawful In The UK?

Monitoring is most sensitive where emails, web use, device activity or communications may reveal personal data. Employers should give clear notice, identify a lawful basis, assess proportionality, and consider a data protection impact assessment where monitoring is intrusive or high risk.

Why Should Personal Use Be Addressed Clearly?

UK employers commonly allow limited personal use of devices, email or internet access, but the policy should state boundaries, explain that misuse may lead to disciplinary action, and avoid creating an expectation of privacy that conflicts with lawful monitoring notices.

Which Related Policies Should Be Aligned?

The Acceptable Use Policy should be consistent with the privacy notice, employee monitoring notice, disciplinary procedure, information security policy, remote working policy, bring your own device policy, data retention policy, incident response plan and social media policy.

What Are The Highest-Risk Areas?

Data protection: personal data, special category data, access controls, transfers and breach reporting need precise rules.
Communications monitoring: monitoring must be transparent, necessary and proportionate under UK GDPR and workplace privacy expectations.
Information security: password use, MFA, malware, phishing, removable media and unauthorised software should be backed by technical controls.
Employment practices: misuse should link to disciplinary rules, equality duties and employee consultation where required.

UK Acceptable Use Policy Compliance Considerations

Want to Generate Your own Acceptable Use Policy?

Docaro AI can help you write your own Acceptable Use Policy for use in the United Kingdom in minutes.

Generate Your Document Now

FAQs

What should a UK Acceptable Use Policy include?

A UK Acceptable Use Policy should define permitted and prohibited use of company IT systems, internet, email, devices, software, data, security controls, monitoring, and consequences for breach.

Is an Acceptable Use Policy legally required in the UK?

Can a UK employer monitor employee IT use?

How does an Acceptable Use Policy relate to UK GDPR?

Should an Acceptable Use Policy cover remote and hybrid working?

Show All FAQs