Acceptable Use Policy (UK)

An Acceptable Use Policy in the United Kingdom sets out the standards, responsibilities, and procedures the organisation expects everyone to follow, and is governed by the Computer Misuse Act 1990.

In England and Wales, an AUP operates against the backdrop of several important statutory frameworks. The Computer Misuse Act 1990 criminalises unauthorised access to computer material and unauthorised acts that impair the operation of computer systems. By defining the scope of authorised access and the conditions attached to it, the AUP helps delineate what constitutes 'authorised' use — an important consideration if disciplinary or criminal proceedings are ever required. The UK General Data Protection Regulation (UK GDPR), retained in UK law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 impose obligations on organisations to implement appropriate technical and organisational security measures to protect personal data. The Information Commissioner's Office (ICO) regards documented acceptable use policies, employee training, and access controls as core organisational measures required to demonstrate compliance with the accountability principle (Article 5(2) UK GDPR). The Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016 govern the lawful interception of communications, including business communications on employer-provided systems. Employment law, including the Employment Rights Act 1996 and the ACAS Code of Practice on Disciplinary and Grievance Procedures, requires that employees be clearly informed of conduct standards before disciplinary sanctions can be imposed.

The legal framework governing the Acceptable Use Policy (UK) in United Kingdom draws on several key statutes and regulatory bodies. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Parties executing a Acceptable Use Policy (UK) in United Kingdom should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies Act 2006 sets the foundational requirements.

An Acceptable Use Policy is appropriate for any organisation in England and Wales — whether a business, charity, public authority, or educational institution — that provides employees, contractors, volunteers, or other authorised users with access to IT systems, email, the internet, or any shared digital resources. The policy should be implemented before granting system access to users, and reviewed and updated whenever there are material changes to the organisation's technology, working practices, or legal obligations.

An AUP is particularly important in the following situations. Where employees work remotely or use personal devices for work purposes (bring your own device, or BYOD), the policy must make clear which rules apply to work use of personal devices and what the organisation's rights are with respect to accessing or wiping data on those devices. Where staff handle personal data as part of their role, the AUP complements the organisation's data protection policy by setting out the rules for accessing, storing, transferring, and deleting personal data from systems. Where the organisation is subject to sector-specific regulatory requirements — for example, under the Financial Conduct Authority (FCA) rules, the NHS Data Security and Protection Toolkit, or Cyber Essentials certification — the AUP provides documented evidence of the organisational controls required to meet those requirements. Where the organisation wishes to preserve its right to monitor employee use of systems for security, compliance, or productivity purposes, the AUP provides the transparency and informed consent mechanism required by UK data protection law. Where there is a risk of insider threat — intentional or accidental data loss, sabotage, or exfiltration of confidential information — a clearly communicated AUP, supported by technical controls and audit logging, strengthens the organisation's ability to detect, investigate, and act on such incidents.

Parties in United Kingdom should prepare a Acceptable Use Policy (UK) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A well-drafted Acceptable Use Policy for an organisation in England and Wales should contain a number of essential elements that reflect both legal requirements and practical governance needs.

The scope clause defines who the policy applies to — typically all employees, contractors, agency workers, and visitors with access to the organisation's systems — and which systems are covered, including workplace devices, personal devices used for work, cloud services, email, and internet access.

The permitted use clause sets out what the systems may be used for. Most policies permit use for legitimate business purposes and may allow limited, reasonable personal use if the organisation chooses to do so. Clarity here prevents disputes about whether a particular use was authorised.

The prohibited activities clause is the core of the policy. It should address: accessing, storing, or distributing unlawful, offensive, discriminatory, or sexually explicit content; circumventing security controls or installing unauthorised software; sharing passwords or access credentials; using systems to conduct personal business for profit; accessing systems or data beyond the user's authorised scope; and any activity that would constitute an offence under the Computer Misuse Act 1990, the Fraud Act 2006, or the Bribery Act 2010.

The internet and email use clause addresses personal use of the internet and company email during working hours, expectations around professional conduct in external communications, and the prohibition on using company email for personal correspondence that might create legal liability.

The social media clause sets out the rules for posting content that relates to the organisation, its clients, or colleagues, and the distinction between personal and professional use of social media platforms.

The data protection clause reinforces the organisation's obligations under the UK GDPR and the Data Protection Act 2018 in the context of system use — including rules about storing personal data on personal devices, transferring data outside the organisation, and the obligation to report suspected data breaches.

The monitoring clause is legally essential. Under the UK GDPR, employees must be informed that monitoring takes place, what is monitored, the purpose, and the legal basis. Without this transparency, monitoring may be unlawful.

The enforcement clause explains the consequences of a breach, including the right to suspend system access pending investigation, and the range of disciplinary outcomes up to and including dismissal for gross misconduct.

Additional compliance elements for a Acceptable Use Policy (UK) used in United Kingdom include: Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Forms-legal.com provides this template as a starting point for United Kingdom-compliant documentation.