Internet and Email Policy (UK)

An Internet and Email Policy in the United Kingdom sets out the standards, responsibilities, and procedures the organisation expects everyone to follow, and is governed by the Computer Misuse Act 1990.

The legal framework underpinning a UK Internet and Email Policy draws on several overlapping statutes. The Computer Misuse Act 1990 (as amended by the Serious Crime Act 2015) creates criminal offences for unauthorised access to computer systems under sections 1, 2, and 3. The Investigatory Powers Act 2016 regulates the lawful interception of communications and requires employers to satisfy one of the statutory grounds before monitoring employee communications. The UK GDPR and the Data Protection Act 2018 impose obligations on employers as data controllers: any monitoring of employee email or browsing activity constitutes processing of personal data, requiring a lawful basis under UK GDPR Article 6 and, where special category data may be captured, Article 9 as well. A Data Protection Impact Assessment (DPIA) under UK GDPR Article 35 is required before implementing high-risk monitoring.

The Human Rights Act 1998, which gives domestic effect to the European Convention on Human Rights, protects employees' right to respect for private life and correspondence under Article 8. The Strasbourg Court of Human Rights established in Bărbulescu v Romania (2017) that employees retain a reasonable expectation of privacy even in relation to communications made on workplace systems. UK employment law, including the Employment Rights Act 1996 and the ACAS Code of Practice on Disciplinary and Grievance Procedures, requires that any disciplinary action taken for breach of an internet and email policy follows a fair process with appropriate investigation and the right to be accompanied at a disciplinary hearing under section 10 of the Employment Relations Act 1999.

The Information Commissioner's Office (ICO) supervises compliance with the UK GDPR and the Data Protection Act 2018 and has published employment practices guidance covering workplace monitoring. The ICO can impose fines of up to £17.5 million or 4% of annual global turnover for serious data protection breaches. The Network and Information Systems (NIS) Regulations 2018 impose additional cybersecurity obligations on operators of essential services and relevant digital service providers, requiring them to take appropriate and proportionate technical and organisational measures to manage network and information system security risks — obligations best addressed in part through a documented internet and email policy. Financial Conduct Authority (FCA)-regulated firms must also comply with FCA Conduct Rules requiring staff to act with integrity and to follow proper standards of market conduct, which a well-drafted internet and email policy supports.

The forms-legal.com Internet and Email Policy (UK) template reflects the requirements of the Computer Misuse Act 1990, the Investigatory Powers Act 2016, the UK GDPR, and the Data Protection Act 2018, and can be adapted to the specific needs of any UK organisation.

A UK Internet and Email Policy is needed by any organisation that provides employees, workers, contractors, or volunteers with access to company IT systems, email accounts, or internet connectivity. Any business with even one member of staff accessing the internet or email through company-provided systems should have a written policy in place before granting that access.

The policy is particularly important in the following circumstances. Where an employer wishes to monitor employee internet or email usage — whether to detect data breaches, investigate misconduct, or manage productivity — a pre-existing, communicated policy is the primary legal mechanism for limiting employees' reasonable expectation of privacy under the Human Rights Act 1998 and the Investigatory Powers Act 2016. Without such a policy, monitoring may constitute unlawful interception or breach the UK GDPR. The Employment Tribunal has consistently held that disciplinary sanctions for IT misuse are more likely to be upheld where the employer had a clear, published policy that the employee had acknowledged.

Organisations regulated by the Financial Conduct Authority (FCA) or the Prudential Regulation Authority (PRA) are expected to maintain documented IT policies as part of their operational risk management frameworks under the FCA's Senior Managers and Certification Regime (SM&CR). Similarly, businesses that handle personal data at scale are expected by the Information Commissioner's Office (ICO) to have documented controls over how employees access and process that data, and an internet and email policy is one of the foundational controls in any UK GDPR compliance programme.

Where a business has suffered a cybersecurity incident — such as a phishing attack, malware infection, or data breach notifiable to the ICO under UK GDPR Article 33 — the absence of a documented internet and email policy will be treated as an aggravating factor in any regulatory investigation by the ICO or the National Cyber Security Centre (NCSC). The ACAS Code of Practice on Disciplinary and Grievance Procedures confirms that workplace policies must be clearly communicated to employees before they can form the basis of a disciplinary sanction under the Employment Rights Act 1996.

A well-drafted UK Internet and Email Policy should cover the following key elements to be effective and legally compliant.

The scope clause defines the systems, devices, and staff covered — including company-owned devices, personal devices used for work (BYOD), remote access via VPN, and any cloud-based systems provided by the employer. Clear scope avoids disputes about whether a particular device or system was subject to the policy when disciplinary proceedings are brought under the ACAS Code of Practice on Disciplinary and Grievance Procedures.

The acceptable use clause sets out what employees may lawfully do with company IT systems, including any permitted limited personal use. Where personal use is permitted, the policy should state the boundaries — for example, no streaming, no large file downloads, and no access to websites that may generate legal liability for the employer under the Communications Act 2003.

The prohibited use clause lists categories of use that are absolutely prohibited, including: accessing, creating, distributing, or storing material that is illegal under the Computer Misuse Act 1990, the Obscene Publications Act 1959, or the Communications Act 2003; making defamatory statements; disclosing confidential information without authorisation; and circumventing IT security controls.

The monitoring notice clause is required to satisfy the transparency obligations of the UK GDPR (Articles 13 and 14) and the Investigatory Powers Act 2016. It must state: that monitoring may take place; the purposes for which monitoring is carried out; the types of monitoring used (e.g. email scanning, web filtering, keystroke logging); the legal basis for monitoring under UK GDPR Article 6; whether a Data Protection Impact Assessment (DPIA) under Article 35 has been carried out; and how long monitoring records are retained. Employers regulated by the Financial Conduct Authority (FCA) should note that FCA Conduct Rules under the Senior Managers and Certification Regime (SM&CR) require staff to act with integrity, which includes complying with documented IT policies.

The data security obligations clause requires employees to comply with the organisation's information security controls, including password policies, multi-factor authentication requirements, encryption of portable devices, and reporting of suspected security incidents to the IT department or Data Protection Officer (DPO). Compliance with the Network and Information Systems (NIS) Regulations 2018 may require specific incident reporting obligations for operators of essential services.

The social media clause addresses the use of personal social media accounts during working hours and the posting of content that may bring the employer into disrepute, disclose confidential information, or breach the UK GDPR and the Data Protection Act 2018 by sharing personal data about colleagues or clients without authorisation.

The email retention and deletion clause sets out the retention periods that apply to business email communications — typically two to seven years depending on the sector — and the process for deleting emails in accordance with UK GDPR Article 5(1)(e) data minimisation and storage limitation principles.

The breach and disciplinary consequences clause confirms that breaches of the policy may result in disciplinary action up to and including dismissal under the Employment Rights Act 1996, and that in serious cases involving criminal conduct under the Computer Misuse Act 1990 the matter will be referred to the police. All disciplinary proceedings must follow the ACAS Code of Practice on Disciplinary and Grievance Procedures. The forms-legal.com Internet and Email Policy (UK) template addresses each of these elements and can be customised to reflect the sector requirements of any United Kingdom employer.