How to write an IT acceptable use policy staff will actually read

What the policy is for

An acceptable use policy does three jobs. It tells staff what is expected, so they are not guessing whether it is fine to check personal email or install a free app. It gives the business something to point to if a serious problem arises, such as confidential files being sent to a personal account. And it shows insurers, auditors and larger customers that the business has thought about how its systems are used.

It is not a technical document and it is not a place to list every possible misuse. The policies that fail are the twelve-page templates downloaded from the internet, full of language nobody in the office understands and rules nobody enforces. A policy staff can read in five minutes and remember the next week is worth far more.

The sections most small businesses need

Start with ownership: work devices, accounts and data belong to the business, and the business may access them for legitimate reasons such as security, support and continuity. Then cover passwords and sign-in, including that staff must not share passwords, must use multi-factor authentication and must report a suspected compromise straight away. Next, email and messaging: be careful with links and attachments, don't forward business information to personal accounts, and treat customer details with care.

Add a short section on personal use. Most small businesses allow reasonable personal use of the internet and work devices, as long as it doesn't interfere with work, involve anything illegal or offensive, or put the business's systems at risk. Then cover software: staff should not install software or browser extensions without approval, and should not sign up for cloud services with their work email without checking first. Finish with devices and data away from the office: lock screens, keeping laptops safe in cars and cafes, using approved storage only, and reporting lost devices quickly. If you allow personal phones for work, either cover it briefly here or point to a separate BYOD agreement.

Monitoring and privacy

If the business monitors email, web traffic or device activity, say so plainly. Under the Privacy Act 2020, people generally need to know what personal information is being collected about them and why. A short statement such as 'We log web traffic and scan email for security purposes, and we may review an account's contents if we need to investigate a problem or keep the business running' is honest and usually sufficient for a small office.

Be careful not to promise more than you do, or claim less. If you say the business never reads staff email and then a manager opens a mailbox during an investigation, you have a problem. If you're unsure where the line sits for your situation, get advice from an employment adviser or lawyer rather than guessing. The policy should match practice exactly.

Writing it in plain language

Write as if you were explaining the rules to a sensible new starter over coffee. Use short sentences, 'you' and 'we', and real examples from your business. Instead of 'Users shall not utilise organisational resources for unauthorised purposes', write 'Don't use work email to sign up for personal shopping or social media sites'. Instead of a long list of banned file types, say 'Ask before installing anything; we'll usually say yes if it's needed for work'.

Include the reason behind each rule in a sentence. People follow rules they understand, and they push back on rules that seem arbitrary. 'Don't email customer files to your personal address, because if your personal account is hacked we have a privacy breach to report' is far more persuasive than a bare prohibition.

Rolling it out and keeping it alive

Introduce the policy in a team meeting rather than by email, take questions, and give everyone a few days to read it before signing. Add it to your new starter pack so it's part of day one. Store the signed copies with employment records. If you use Microsoft 365, a simple Microsoft Forms acknowledgement or a document in SharePoint with a sign-off list works well enough for a small team.

Review the policy once a year, or sooner if something changes, such as a move to working from home, a new device policy, or a security incident that showed a gap. Keep a version date at the top. When you change it, tell staff what changed rather than asking them to re-read the whole thing. Finally, enforce it consistently. A policy that is ignored for the owner and enforced for junior staff undermines itself. If a rule turns out to be unworkable, change the rule rather than letting everyone quietly break it.