What Is Acceptable Use Policy?

An acceptable use policy sets out what people may and may not do with the organisation's systems, data and networks. It is the policy staff are most likely to encounter and the one with the clearest employment consequences.

It serves two purposes that are frequently confused: guiding behaviour, and providing a basis for action when behaviour is unacceptable. The second requires precision the first does not.

What it needs to address

Personal use of corporate systems, and where the boundary sits. Prohibited activity, stated specifically. Handling of sensitive data, including where it may and may not be stored.

Use of personal devices and personal accounts for work. Installation of software. Monitoring — what the organisation logs and reviews, which is a notice requirement rather than a courtesy. And the consequences of breach.

Enforceability depends on notice

A policy relied upon in a disciplinary process has to have been communicated, acknowledged and applied consistently. Selective enforcement undermines it entirely, and a policy that has been ignored for years is difficult to invoke suddenly.

Monitoring in particular depends on notice. In most jurisdictions employee monitoring is lawful with appropriate notice and proportionality, and unlawful without — and the notice belongs here.

Personal use and realism

Prohibiting all personal use is common and almost never enforced, which makes it an unenforceable clause weakening the document. Permitting reasonable personal use, with specific prohibitions, is both more honest and more defensible.

Precision matters more than breadth. Reasonable is a word people interpret differently; a short list of what is specifically not permitted is not.

The topics that have moved fastest

Generative artificial intelligence services, where the concern is staff pasting confidential or regulated data into tools with unclear retention and training practices.

Personal cloud storage and messaging for work content, personal devices accessing corporate data, and personal accounts used for business purposes. Most existing policies predate these and are silent on all of them.

Make the compliant path easier

Where the policy prohibits something people need, they will find a way. A rule against personal file sharing, without a sanctioned alternative that works, produces both non-compliance and no visibility of it.

Providing an approved tool alongside each prohibition is what makes the policy hold. Prohibition without provision is a request for shadow systems.

Bring your own device needs its own answer

Where staff use personal devices for work, the policy has to address what the organisation may do to that device — enrol it, apply policy, wipe it — and what happens to personal data in the process.

That is a consent question as much as a security one, and it is the clause most likely to be disputed later. Containerised corporate data, which permits selective removal without touching anything personal, is usually the arrangement that survives scrutiny. See bring your own device.

Where to start

Check whether your policy says anything about generative AI services and personal cloud storage. Those are where data is leaving now, and most policies are silent.

See shadow AI detection and policy. GuardsArm delivers policy review.