Which users should an IT Acceptable Use Policy cover?

It commonly covers employees, directors, agency workers, contractors, temporary staff, consultants, volunteers, interns and any third party given access to the organisation’s IT resources.

Which IT assets and systems should be included in the policy scope?

It can help you decide whether to cover laptops, desktops, mobiles, tablets, removable media, personal devices used for work, network equipment, cloud platforms, business applications and communication tools.

Should BYOD and personal devices be included?

Yes. If staff use personal phones, laptops or tablets for work, the scope should usually address BYOD approval, security controls, acceptable use, data access, loss reporting and separation of personal and business data.

Does the decision tree cover remote and hybrid working?

Yes. Remote and hybrid working usually require rules on secure connections, home networks, device protection, confidential information, screen privacy, cloud access and reporting security incidents outside the office.

Should data protection be considered when defining policy scope?

Yes. A UK IT Acceptable Use Policy should normally reflect UK GDPR and Data Protection Act 2018 obligations where employee monitoring, personal data, confidentiality, access controls or data handling are involved.

Should employee monitoring be included in an Acceptable Use Policy?

Often, yes. If the organisation monitors email, internet use, devices, logs or network activity, the policy should explain the nature and purpose of monitoring and link to privacy and employee monitoring notices where appropriate.

Does an Acceptable Use Policy need cybersecurity rules?

Yes. The scope should normally address phishing, passwords, multi-factor authentication, malware, unauthorised software, patching, suspicious emails, incident reporting and prohibited security circumvention.

Should the policy cover email, messaging and social media?

Usually yes. It should define acceptable and prohibited use of email, messaging apps, video conferencing, social media, file sharing and collaboration tools where these are used for business purposes.

How does the decision tree help with confidential information?

If staff access customer records, HR files, financial data, intellectual property or confidential business information, the policy should set access, storage, sharing, transfer and deletion rules.

Should workplace AI tool use be covered in an IT Acceptable Use Policy?

Yes. It can prompt you to include rules on approved AI tools, confidential inputs, personal data, verification of outputs, copyright risks, security and unauthorised automated decision-making.

Is the IT Acceptable Use Policy Scope Decision Tree legal advice?

The decision tree is an informational scoping aid, not legal advice. For high-risk processing, regulated sectors, complex monitoring or disciplinary issues, UK legal or HR advice may be needed.

How often should an IT Acceptable Use Policy be reviewed?

Review it whenever technology, working practices, cyber risks, monitoring arrangements, data processing, regulatory requirements or business systems change, and at regular intervals as part of policy governance.

What should I do after using the decision tree?

Use the decision tree to define the required scope, then generate or draft the full UK IT Acceptable Use Policy on the main Acceptable Use Policy category page and tailor it to your organisation’s practices.

EN-GB>Governance>Acceptable Use Policy>United Kingdom IT Acceptable Use Policy Scope

United Kingdom IT Acceptable Use Policy Scope Decision Tree

Created: 11 Jun 2026

Use this flowchart to decide when an IT acceptable use policy is relevant, who it should cover, and what workplace technology risks to address. For more guidance, see our AI Generated Acceptable Use Policy for use in the United Kingdom resources.

IT AUP Scope Decision Tool

10%

Who should the policy apply to?

Employees only

Employees and contractors

Wider users, including visitors or volunteers

Decide who will use, access, or be affected by the organisation’s IT systems. An IT acceptable use policy should usually cover employees, workers, contractors, consultants, temporary staff, volunteers, directors, and any other person given access to company devices, networks, accounts, data, or online services.

Further Reading: ICO: Employment practices and data protection, NCSC: Small business guide

Disclaimer:

I understand and accept that the flowchart, questionnaire, decision tree, and any results, guidance, classifications, or recommendations provided by Docaro are generated automatically for general informational purposes only and do not constitute legal advice, legal representation, or any other professional advice. No solicitor-client, attorney-client, or other professional advisory relationship is created through use of this service. I acknowledge that the tool operates using simplified rules and assumptions and may not take into account all facts, circumstances, exceptions, legal requirements, or jurisdiction-specific considerations relevant to my situation. The results may be incomplete, inaccurate, outdated, or unsuitable for my particular circumstances. I agree that any outcome or recommendation provided by the tool is indicative only and should not be relied upon as a substitute for independent legal advice. I am solely responsible for verifying the accuracy and suitability of any information provided and for obtaining advice from a qualified legal professional where appropriate. To the fullest extent permitted by applicable law, Docaro disclaims all warranties and liability arising from the use of, or reliance upon, any information, outcome, recommendation, or guidance provided by this service.

Why Is The Scope Of A UK IT Acceptable Use Policy Important?

Choosing the right scope for an IT acceptable use policy helps a UK organisation set clear rules for how people use its devices, networks, accounts, software, email, internet access, cloud services, and data. A policy that is too narrow may miss contractors, hybrid workers, volunteers, or personal devices. A policy that is too broad may create confusing obligations that are difficult to apply.

How Does A Clear Acceptable Use Policy Reduce UK Cyber Risk?

Clear rules help users understand what is allowed and what is prohibited. This is especially important for passwords, multi-factor authentication, phishing, downloads, removable media, personal devices, cloud storage, and incident reporting. The UK National Cyber Security Centre recommends practical controls and staff awareness as part of good cyber security governance.

Why Does UK Data Protection Law Affect Acceptable Use Policies?

Many IT systems contain personal data, HR records, customer details, or confidential business information. Under the UK GDPR and Data Protection Act 2018, organisations must use appropriate security and be transparent where worker monitoring is carried out. The Information Commissioner’s Office provides guidance on monitoring workers and handling employment data.

What Happens If Contractors Or BYOD Are Missed?

Contractors and personally owned devices often create the biggest scope gaps. If they are not covered, the organisation may lack clear rules on confidentiality, access control, device security, remote wiping, offboarding, and reporting loss or misuse. This can increase the risk of data breaches and disputes about responsibility.

How Can The Right Scope Support Enforcement?

An acceptable use policy should fit with employment contracts, staff handbooks, disciplinary procedures, privacy notices, and information security policies. In the United Kingdom, employers should also consider fairness, proportionality, and transparency when monitoring IT use. A properly scoped policy is easier to explain, acknowledge, train on, and enforce consistently.

Include all users who can access internal systems or data.
Address remote work and BYOD where they are allowed.
Reflect UK GDPR requirements for personal data and monitoring.
Align with cyber controls such as NCSC guidance and Cyber Essentials.
Connect to HR processes where misuse may lead to disciplinary action.

United Kingdom IT Acceptable Use Policy Scope Decision Tree

This flowchart provides a simplified overview of legal concepts and should not be relied upon as legal advice. Always consider the specific facts of your situation and seek professional advice where appropriate.

Want to Generate Your own Acceptable Use Policy?

Docaro AI can help you write your own Acceptable Use Policy for use in the United Kingdom in minutes.

Generate Your Document Now

FAQs

What is the United Kingdom IT Acceptable Use Policy Scope Decision Tree?

It is a flowchart-style guide that helps UK organisations decide what their IT Acceptable Use Policy should cover, including users, devices, systems, data, internet use, monitoring, remote working and security obligations.

When should I use the IT Acceptable Use Policy Scope Decision Tree?

How is the decision tree different from an IT Acceptable Use Policy?

Who is the decision tree for?

Can small UK businesses use this decision tree?

Show All FAQs

You Might Also Be Interested In

United Kingdom Acceptable Use Policy Clause Library

United Kingdom clause library for acceptable use policies, helping you draft clear, compliant IT usage rules.

UK Acceptable Use Policy Compliance Considerations

UK acceptable use policy compliance tips covering key legal, security, and workplace considerations for organisations.

IT Resources Covered By Acceptable Use Policies In The United Kingdom

Learn which IT resources are covered by acceptable use policies in the United Kingdom and why they matter for compliance.

United Kingdom Acceptable Use Policy Sign-Off Decision Tree

United Kingdom guide to acceptable use policy sign-off decisions, helping teams identify the right reviewers and approvers.