Etoolio

Acceptable Use Policy Generator

Free acceptable use policy generator. Set rules for devices, personal use, passwords, data and email, and get a ready workplace IT policy to copy or download.

Updated

Devices for company work
Personal use of company systems
Sections to include

Your policy

Acceptable Use Policy

Owner: the IT team

Review: Every 12 months

1. Purpose

This policy explains how the Company's computers, networks, accounts and data may and may not be used. It protects our people, our customers and our business from security incidents, legal risk and misuse.

2. Who and what it covers

It applies to all employees, contractors, temporary staff and anyone else given access to company systems.

  • Company-owned laptops, desktops, phones, tablets and peripherals.
  • Company networks, Wi-Fi, VPN and internet connection.
  • Company accounts: email, chat, cloud storage, business applications and any system you sign in to with a company account.

3. Acceptable use

  • Use company systems for your job, in a lawful, professional and respectful way.
  • Keep company information inside approved company systems.
  • Lock your screen when you step away and keep devices with you or locked away.
  • Keep devices updated: install security updates when prompted, and restart when asked to.
  • Occasional, brief personal use (for example, checking a personal appointment during a break) is allowed, provided it does not interfere with work, use significant resources, or break any other part of this policy.

4. Prohibited use

You must never use company systems to:

  • Break the law, or create, store or share illegal, abusive, discriminatory, harassing or sexually explicit material.
  • Access accounts, systems or data you are not authorised to use, or try to get around security controls.
  • Share your password or sign-in codes, or let anyone else use your account.
  • Install or run malware, hacking tools, password crackers or network scanners, unless it is your approved job to do so.
  • Download, copy or share pirated software, films, music or other copyrighted material.
  • Mine cryptocurrency, or run personal businesses or side projects.
  • Send spam, chain letters or bulk messages that are not approved company communications.
  • Copy company or customer data to personal accounts, personal email or personal storage.

5. Personal devices

Company work must be done on company-provided devices. Do not access company email, files or systems from personal devices.

6. Email and messaging

  • Use your company email and chat accounts for company business, and never forward company email to a personal account.
  • Be careful with links and attachments. Check the sender's real address before acting on a request for money, passwords or data.
  • Confirm any request to change bank details or make an urgent payment by calling a number you already have, not one given in the message.
  • Write as if the message could be read by a customer or a court: messages may be retained and disclosed.

7. Internet and downloads

  • Do not visit sites that host illegal, explicit, gambling or pirated content on company systems or networks.
  • Download files only from trusted sources and only when you need them for work.
  • Do not use company systems to stream large amounts of non-work media that slow the network for others.

8. Installing software

  • Only install software, browser extensions or apps that the IT team has approved.
  • Do not sign up for cloud services with your company email, or upload company data to them, without approval.
  • Do not disable antivirus, firewalls, updates or device management.

9. Passwords and multi-factor sign-in

  • Use a unique password for every account, and use the company password manager where one is provided.
  • Use long passphrases: at least 14 characters is a good rule.
  • Turn on multi-factor sign-in wherever it is offered, and never approve a sign-in prompt you did not start.
  • Never share passwords or codes, including with IT staff. IT will never ask for your password.

10. Handling company and customer data

  • Only access the data you need for your job.
  • Store company and customer data only in approved company systems, never on USB drives or personal storage unless approved and encrypted.
  • Share confidential data only with people who need it and are allowed to see it, and use the approved secure sharing method.
  • Follow applicable data protection law (for example the UAE PDPL or the GDPR where they apply) when handling personal data.
  • Dispose of paper and devices containing company data securely, through the IT team.

11. Remote work and public Wi-Fi

  • Use the company VPN, or a trusted network, when working away from the office.
  • Avoid public Wi-Fi for company work where possible. If you must use it, use the VPN.
  • Make sure others cannot see your screen or hear confidential calls in public places.
  • Never leave company devices unattended in vehicles or public places.

12. Social media

  • Do not post confidential information about the Company, its customers or colleagues.
  • Make clear that personal views are your own, not the Company's, unless you are authorised to speak for the company.
  • Be alert to people using social media to gather information for scams or phishing.

13. AI tools

  • Only use AI tools that are approved for company work.
  • Do not enter confidential information, customer data, personal data, passwords or source code into AI tools unless the tool is approved for that data.
  • Check AI output for accuracy before you rely on it or share it. You remain responsible for your work.
  • Detailed rules are in the company AI acceptable use policy.

14. Monitoring notice

The Company may monitor and log the use of company systems, networks and accounts to protect security, investigate incidents and meet legal obligations. Monitoring is carried out in line with applicable law, is proportionate, and is limited to company systems. Do not expect privacy for personal material stored on or sent through company systems.

15. Reporting security incidents

Report these to the IT team immediately, even if you are unsure or think it was your mistake:

  • A lost or stolen device, ID badge or security key.
  • A suspicious email, call or message, especially if you clicked a link, opened an attachment or entered details.
  • Any sign that an account has been used by someone else.
  • Company or customer data sent to the wrong person or exposed.

Reporting quickly limits the damage. You will not be penalised for an honest, prompt report.

16. Exceptions

Any exception to this policy must be approved in writing by the IT team before it applies.

17. Breaches

Breaking this policy may lead to access being removed and to disciplinary action, up to and including dismissal or ending a contract. Illegal activity may be reported to the authorities.

18. Acknowledgement

I have read and understood this Acceptable Use Policy and agree to follow it.

Name: ____________________

Signature: ____________________

Date: ____________________

This policy was drafted with a template. Have it reviewed by your HR and legal advisers before you adopt it.

A workplace IT policy in minutes, not weeks

An acceptable use policy (AUP) is the rulebook for your company's technology: laptops and phones, the network, email and chat, cloud accounts and the data inside them. It tells staff what is allowed, what is forbidden and what to do when something goes wrong. Insurers, auditors, clients and frameworks such as ISO 27001 and Cyber Essentials expect to see one. This generator builds a clear, plain-English AUP from a few choices, live in your browser.

How to use it

  • Enter your company name, the policy owner (who approves exceptions) and where staff report incidents.
  • Choose your device rule: company devices only, or personal devices allowed (BYOD) with conditions such as screen locks, encryption and remote removal of company data.
  • Choose how much personal use of company systems you allow: none, occasional, or reasonable outside working time.
  • Tick the sections you need, then copy the policy or download it as Markdown or plain text to finish in Word or Google Docs.

What every policy covers

SectionWhat it says
Purpose and scopeWhy the policy exists, who it applies to and which systems it covers
Acceptable useLawful, professional use; locked screens; security updates; your personal use rule
Prohibited useIllegal or abusive content, unauthorised access, shared passwords, malware and hacking tools, piracy, crypto mining, spam, copying data to personal accounts
Personal devicesEither "company devices only" or the BYOD conditions
Exceptions and breachesWritten approval for exceptions; consequences of breaking the rules
AcknowledgementA signature block for each employee

Optional sections

  • Email and messaging: phishing checks and confirming payment or bank-detail changes by phone, the control that stops most invoice fraud.
  • Internet and downloads, and installing software: approved sources and no disabling of security tools.
  • Passwords and multi-factor sign-in: unique passphrases, a password manager, and never approving a sign-in prompt you did not start.
  • Handling data: least access, approved storage and secure sharing, with a pointer to data protection law such as the UAE PDPL or the GDPR.
  • Remote work, social media and AI tools.
  • Monitoring notice: telling staff that company systems may be monitored is both fair and, in many countries, a legal requirement before you monitor.
  • Incident reporting: what to report, to whom, and a promise that honest, prompt reports are not punished, which is what makes people report early.

Making it stick

  • Have HR or a lawyer review the draft. Employment and monitoring rules vary by country.
  • Ask every employee to read and sign it when they join, and again when it changes.
  • Back it with technical controls: multi-factor sign-in, device management and a password manager make the rules easy to follow.
  • Review it at least once a year, and after any security incident.

Related tools

For detailed rules on ChatGPT, Copilot and other AI tools, use the AI acceptable use policy generator. Give staff a quick way to make strong passwords with the password generator, and to check whether one has leaked with the password leak check.

Good to know

Acceptable Use Policy Generator, frequently asked questions

What is an acceptable use policy?

An acceptable use policy (AUP) sets the rules for how staff may use a company's computers, networks, accounts and data. It covers what is allowed, what is forbidden (such as sharing passwords or installing unapproved software), how data must be handled, and what happens if the rules are broken.

What does this generator include?

Every policy has a purpose, scope, acceptable and prohibited use, personal devices, exceptions, breaches and a signature block. You choose whether personal devices (BYOD) and personal use are allowed, and which sections to add: email, internet, software, passwords and multi-factor sign-in, data handling, remote work, social media, AI tools, monitoring and incident reporting.

How is this different from the AI policy generator?

This policy covers all company IT. The AI policy generator goes deep on AI tools alone: which ones are approved, what data may be entered, and how AI output must be checked. Many companies use both, and the AUP's AI section points to the AI policy.

Is the policy legally binding?

It becomes binding when your company adopts it and staff acknowledge it, usually by signing. It is a well-structured template, not legal advice. Employment, privacy and monitoring law differs by country (for example the UAE PDPL or the GDPR), so have HR or a lawyer review it before you roll it out.

Is my information uploaded?

No. The policy is assembled in your browser as you type. Nothing you enter is sent to a server or stored.

Can I edit the result?

Yes. Copy it, or download it as Markdown or plain text, and paste it into Word, Google Docs or your HR system to adjust the wording.

Keep going

Related tools

Company AI Policy GeneratorAnswer a short wizard and get a tailored AI acceptable-use policy you can copy or download.Password GeneratorGenerate strong, random passwords with custom rules.Password Leak CheckCheck if a password has appeared in a data breach, privately, without sending it.PII Redactor for AIStrip names, emails, phones, cards and IDs from text before you paste it into AI.