Acceptable Use Policies
Unacceptable behaviour in an acceptable use policy
The unacceptable section of an acceptable use policy (AUP) lists the behaviours that are never allowed when staff use the organisation's IT. It matters because staff need to see exactly where the boundary sits, and the organisation needs a rule written down before it can act on a breach.
What is ruled out, and the risk it creates
| Forbidden behaviour | Why it is a problem |
|---|---|
| Opening a customer's order history, or a colleague's file, out of curiosity rather than for a task | Unauthorised access breaks data protection law, and the organisation can be fined or sued |
| Emailing a supplier contract or a staff record to a personal account, or printing it at home | The data leaves the organisation's control, where it cannot be watched over, backed up or protected |
| Taking a work laptop or tablet off site without permission, or leaving it on show in a parked car | The device and its files leave the protected network, and a thief takes every file with it |
| Using work systems for illegal activity, including viewing illegal material | Police involvement, serious damage to reputation, and the internet service can be cut off |
| Posting about a named customer, a colleague or the business itself on social media | It identifies people without their consent and can harm the organisation's reputation |
Make every rule specific
A rule such as 'staff must not copy customer orders to a personal device or personal cloud account' can be checked and enforced. A rule such as 'staff must be careful with data' cannot, because nobody can say for certain whether it has been broken.
For example, a bakery chain might write: 'Staff must not look up a customer's order history unless they are handling that customer's order or complaint.' Someone browsing a celebrity's cake orders has plainly broken it, so the organisation can point to the exact sentence it relies on.
Practise this
Pearson BTEC Digital Information Technology · Acceptable use policies