Acceptable Use Policy (Canada)

An Acceptable Use Policy in Canada sets the rules for permitted use of the organisation’s systems, networks, or services, governed primarily by common-law and provincial employment principles.

In Canada, an AUP serves multiple legal functions simultaneously. It provides the electronic monitoring disclosure required by Ontario's Working for Workers Act, 2022 for employers with 25 or more employees. It documents the PIPEDA-compliant notice that employees have no expectation of privacy when using company systems. It sets out the CASL compliance obligations for employees sending commercial electronic messages. It establishes the workplace technology standards that support progressive discipline and, where necessary, termination for cause decisions.

The policy covers acceptable and unacceptable uses of company technology, internet and email standards, social media conduct, data handling obligations, software installation and licensing requirements, and the consequences of policy violations.

For federally regulated employers subject to the Canada Labour Code (R.S.C., 1985, c. L-2), an AUP is particularly important because it establishes the workplace rules that support just cause termination, which is subject to more rigorous scrutiny under the Code than under provincial employment standards legislation.

A well-drafted AUP that is distributed to all employees, acknowledged in writing, and consistently enforced forms a critical component of an employer's legal compliance framework.

The legal framework governing the Acceptable Use Policy (Canada) in Canada draws on several key statutes and regulatory bodies. Under the Canada Business Corporations Act (R.S.C. 1985, c. C-44), Corporations Canada maintains the federal registry. Section 12 of the CBCA governs corporate name requirements. The Competition Bureau enforces the Competition Act (R.S.C. 1985, c. C-34). Provincial securities commissions — including the Ontario Securities Commission (OSC) and British Columbia Securities Commission (BCSC) — regulate capital markets. The Federal Court of Canada has jurisdiction under the Federal Courts Act. Parties executing a Acceptable Use Policy (Canada) in Canada should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Canada Business Corporations Act (R.S.C. 1985, c. C-44) sets the foundational requirements.

An acceptable use policy is needed in the following circumstances:

Ontario employers with 25+ employees — Ontario's Working for Workers Act, 2022 requires a written electronic monitoring policy by January 1, 2023 for employers with 25+ employees as of January 1, 2022. An AUP incorporating the electronic monitoring disclosure satisfies this requirement.

Onboarding new employees — An AUP should be provided to every new employee during onboarding, with written acknowledgment obtained before providing access to company systems.

Technology rollout — When an employer introduces new technology (remote access systems, collaboration platforms, company mobile devices, BYOD programs), updating the AUP confirms employees understand the rules governing the new systems.

Cybersecurity incident — Following a data breach or phishing attack involving employee systems, updating and reissuing the AUP with strengthened security requirements demonstrates the employer's commitment to improved practices.

CAASL compliance — When employees regularly send commercial electronic messages on behalf of the organization, an AUP that includes CASL compliance requirements reduces organizational and personal liability.

Remote and hybrid work — When employees work remotely on company systems or personal devices, an AUP that addresses remote access security, use of personal devices (BYOD), and home network security is essential.

Disciplinary action — When an employer seeks to discipline or terminate an employee for misuse of technology resources, a clearly written and distributed AUP is essential evidence that the employee was on notice of the prohibited conduct.

Privacy complaints — If an employee complaints about monitoring or files a privacy complaint, a clear written AUP demonstrating prior notice is the employer's primary defence.

Parties in Canada should prepare a Acceptable Use Policy (Canada) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Canada Business Corporations Act (R.S.C. 1985, c. C-44), Corporations Canada maintains the federal registry. Section 12 of the CBCA governs corporate name requirements. The Competition Bureau enforces the Competition Act (R.S.C. 1985, c. C-34). Provincial securities commissions — including the Ontario Securities Commission (OSC) and British Columbia Securities Commission (BCSC) — regulate capital markets. The Federal Court of Canada has jurisdiction under the Federal Courts Act. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

Scope and Application — Identification of all technology resources covered (computers, email, internet, mobile devices, cloud services, telephone systems), all personnel to whom the policy applies (employees, contractors, volunteers, interns), and all locations (office, remote, home).

Electronic Monitoring Disclosure — A clear statement of whether the employer monitors employee use of electronic systems; the circumstances and methods of monitoring (email logs, internet browsing records, application usage, access logs, call recordings); and the purposes for which monitored information may be used. Required for Ontario employers with 25+ employees under Working for Workers Act, 2022.

Acceptable Uses — Business-purpose uses that are permitted; limited personal use parameters if permitted; remote access guidelines and security requirements for work-from-home environments.

Prohibited Activities — Activities that are never permitted regardless of circumstance: accessing, transmitting, or storing illegal content; harassment or discrimination of any kind; unauthorized disclosure of confidential information or personal information; circumventing security controls; unauthorized software installation; use of unlicensed software; fraudulent activities; unauthorized access to other systems; personal commercial activities.

Email and Internet Standards — Email content standards and professional communication requirements; prohibited attachments; phishing and social engineering awareness; internet browsing restrictions; streaming and bandwidth-intensive personal use restrictions.

CAASL Compliance — Requirements for commercial electronic messages including consent verification, required sender identification, unsubscribe mechanism compliance, and processing timelines; prohibition on bulk email without consent.

Social Media Standards — Permitted and prohibited social media activity during work hours; disclosure restrictions; confidentiality obligations; personal social media conduct that could affect the workplace.

Data Handling and Security — Password requirements; prohibition on sharing credentials; device security when using company systems remotely; reporting obligations for security incidents or lost devices.

Consequences — Statement that violations may result in disciplinary action up to and including termination for cause; reference to applicable provincial Employment Standards Act or Canada Labour Code provisions.

Acknowledgment — Requirement for signed acknowledgment confirming the employee has read and understood the policy.

Additional compliance elements for a Acceptable Use Policy (Canada) used in Canada include: Under the Canada Business Corporations Act (R.S.C. 1985, c. C-44), Corporations Canada maintains the federal registry. Section 12 of the CBCA governs corporate name requirements. The Competition Bureau enforces the Competition Act (R.S.C. 1985, c. C-34). Provincial securities commissions — including the Ontario Securities Commission (OSC) and British Columbia Securities Commission (BCSC) — regulate capital markets. The Federal Court of Canada has jurisdiction under the Federal Courts Act. Forms-legal.com provides this template as a starting point for Canada-compliant documentation.