Sanctions in an acceptable use policy

The sanctions section of an acceptable use policy (AUP) sets out what happens when a member of staff, or anyone else the policy covers, breaks the rules. It defines the process that will be followed and the penalties that can be applied, so nobody is treated unfairly or surprised.

The process usually starts informally with a quiet word. If the behaviour continues or is serious, it moves through formal stages, so the penalty matches how serious the behaviour was. A formal case normally begins with a disciplinary hearing: a meeting where the evidence is presented, the member of staff can explain what happened, and a decision is made.

Sanctions the organisation can apply

• A verbal or written warning. A written warning is kept on the person's file and used if the behaviour continues.
• Further training, where the problem was a lack of knowledge, such as not knowing how to report a data breach.
• Demotion or a reduction in pay, moving the person to a less senior job or lowering their pay.
• Suspension, sending the person home for a set period, sometimes without pay.
• Termination of employment, dismissing the person, for severe or repeated breaches.

Fines and legal action are not sanctions on the staff member. A fine or a court case is aimed at the organisation, for example from a regulator or a customer, and any police case is separate and is not run by the organisation.

The section matters because staff know the consequences before they break a rule, so the organisation can act consistently and staff cannot claim they did not realise how serious the behaviour was.