TL;DR: An IT acceptable use policy sets the rules for using an organisation’s computers, email, internet, and data. It protects information, reduces cyber risk, and sets expectations staff can be held to. In NSW and the ACT it also matters legally, because monitoring computers or blocking email requires a policy staff have been told about.

Key takeaways

• An acceptable use policy covers devices, accounts, email, internet, data, personal use, and what happens when someone breaches it.
• In NSW and the ACT, computer monitoring and email or website blocking rely on a policy staff were told about in advance.
• According to ASD’s ACSC, the average self-reported cost of cybercrime for a medium business was $97,200 in 2024-25.
• The Fair Work Commission treats a substantial and wilful breach of policy as often a valid reason for dismissal.
• A policy staff never acknowledged is hard to rely on, so record who received each version.

What is in this acceptable use policy template?

The download is a sample IT acceptable use policy. It sets out the responsibilities and limits staff accept before using IT assets, such as computers and internet access. It is a starting point with placeholders for your organisation’s details. Adapt it to the systems you actually run, and check it against the law in each state where you employ people.

What is an IT acceptable use policy?

An IT acceptable use policy sets out how staff may use an organisation’s computers, phones, networks, email, internet access, and data. It also says what they must not do, and staff agree to it before they get access. Its purpose is to protect information, reduce security risk, and give clear expectations both sides can rely on.

In practice, the policy sits between two other documents. Above it, an information security policy sets the organisation’s overall approach, usually owned by IT. Beside it, a workplace surveillance policy explains what the organisation monitors. The acceptable use policy is the one every employee reads, so it should be written for them rather than for auditors.

Most acceptable use problems are ordinary rather than dramatic. For instance, someone forwards a client spreadsheet to a personal email account, installs an unapproved app, or reuses a password. A good policy names these everyday situations, explains why they matter, and tells staff what to do instead.

What should an IT acceptable use policy include?

An IT acceptable use policy should cover its scope, accounts and passwords, email and internet, personal use, and confidential data. It should also cover software, personal devices, remote work, incident reporting, monitoring, and the consequences of a breach. Each rule should state what staff must do, not only what is banned.

A practical structure looks like this:

• Scope: company laptops, phones, networks, email, messaging, cloud apps, and personal devices used for work.
• Accounts and access: unique logins, no shared passwords, and multi-factor authentication wherever it is offered.
• Email and internet: reasonable personal use, banned content, and how to treat suspicious messages.
• Data handling: where confidential and personal information may be stored, shared, and sent.
• Software and AI tools: who approves new apps, and whether work information may go into public AI tools.
• Personal devices: what staff must do before using their own phone or laptop for work.
• Remote work: secure home networks, locked screens, and care on public wifi.
• Incidents: how to report a lost device, a suspected phishing email, or a mistake, and how quickly.
• Monitoring: what is logged, who can see it, and how compliance is checked.
• Breaches: how a breach is handled, consistent with your disciplinary process.

The incident section deserves more weight than it usually gets. Staff who fear blame hide mistakes, whereas staff who know a fast report is expected give IT time to contain the damage. So say plainly that reporting a mistake quickly is the right thing to do.

Do Australian laws require an acceptable use policy?

No single Australian law requires every employer to have one. However, in NSW and the ACT, computer surveillance of staff is lawful only under a policy they were told about in advance. Blocking email or websites also requires a notified policy, and the ACT specifies what that policy must say.

Under the NSW Workplace Surveillance Act 2005, computer surveillance must follow an employer policy that staff were notified of in advance. The test is whether it is reasonable to assume they are aware of it and understand it. The same test applies before an employer blocks email or website access. In addition, a policy cannot block an email just because it comes from a union, or a website just because it discusses industrial matters.

The ACT Workplace Privacy Act 2011 is more specific. Its data surveillance policy must state how computer resources may and must not be used. It must also say what is logged, who may access the logs, and how compliance is monitored and audited. That is, in effect, an acceptable use policy with a monitoring section. Because the rules differ by state, see the workplace surveillance policy guide for the NSW, ACT, and Victorian detail.

Privacy law adds a further reason to write the rules down. Under Australian Privacy Principle 11, a covered organisation must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. Under the Notifiable Data Breaches scheme, it must also notify affected people and the OAIC when a breach is likely to cause serious harm. Clear rules for staff are one of the reasonable steps.

How does an acceptable use policy reduce cyber risk?

An acceptable use policy reduces cyber risk by turning basic security habits into expectations: multi-factor authentication, unique passwords, prompt software updates, caution with unexpected messages, and regular backups. According to ASD’s ACSC, these basics can prevent the majority of cyber incidents reported to it, which makes them the cheapest controls available.

The cost of getting it wrong is rising, according to ASD’s Annual Cyber Threat Report 2024-25. The average self-reported cost of cybercrime per report was $97,200 for a medium business, up 55%. For a large business it was $202,700, though ASD notes that low report numbers make that average sensitive to outliers. Meanwhile, ASD’s ACSC responded to over 1,200 cyber security incidents in the same year.

Staff are often the target rather than the systems. For example, ASD warns that organisations letting employees access personal accounts on corporate devices need to be aware of the risk of information stealers. In addition, 71% of Australians name scammers seeking their personal information as a top privacy concern, according to the OAIC’s 2023 survey. So a policy that explains how to spot and report a suspicious message protects the organisation and its people.

Can you discipline an employee for breaching the policy?

Yes, but the policy alone does not make discipline fair. According to the Fair Work Commission’s unfair dismissal benchbook, a substantial and wilful breach of a policy will often be a valid reason for dismissal. However, the Commission still weighs all the circumstances, and widespread breaches the employer ignored count against it.

Three habits make a policy easier to rely on. First, make sure staff have received it and had a real opportunity to understand it. Second, keep each rule reasonable for the roles it covers. Third, apply it consistently, rather than overlooking breaches until it wants a reason to act.

Consider a common case, where an employer has tolerated personal streaming on work laptops for years, then dismisses one employee for it. A breach is real, but the history of tolerance undermines the argument that the rule mattered. As a result, enforce the policy from the start. If you have let a rule slide, reissue it and tell staff it will now be applied.

How do you roll out an acceptable use policy?

Roll out an acceptable use policy by agreeing the rules with IT, explaining them in plain language, and recording each person’s acknowledgement. Then add it to onboarding, so new starters accept it before they get access. Review it at least yearly, and whenever systems change.

A rollout that holds up usually includes:

• Plain language: short sentences, real examples, and no jargon a new starter would not know.
• A briefing: managers explain the main rules and the reasons, especially incident reporting.
• Acknowledgement: a record that each person received and accepted the version in force.
• Onboarding: the policy is accepted before accounts are issued, not weeks later.
• Review: a yearly check, plus an update whenever a new tool, such as an AI assistant, is introduced.

Acknowledgement is the step most often lost in a rollout. In NSW and the ACT, the legal tests turn on whether staff can be assumed to understand the policy. A dated acknowledgement for each version is the clearest evidence. For a wider view of why written rules earn their keep, see why workplace policies matter.

When is a template not enough?

Frequently asked questions

What is an IT acceptable use policy?

An IT acceptable use policy is a document setting out how staff may use an organisation’s computers, phones, networks, email, internet, and data, and what they must not do. Staff agree to it before getting access. It protects information, reduces cyber risk, and sets clear expectations for both the organisation and its people.

What should be included in an acceptable use policy?

An acceptable use policy should cover its scope, account and password security, multi-factor authentication, email and internet use, personal use, confidential data handling, software and AI tools, personal devices, remote work, incident reporting, monitoring, and how breaches are handled. Each rule should say what staff must do, not only what is banned.

Is an acceptable use policy a legal requirement in Australia?

No single law requires one for every employer. However, in NSW and the ACT, monitoring staff computer use, or blocking their email or websites, requires a policy staff were told about in advance. Privacy law also expects covered organisations to take reasonable steps to protect personal information, and staff rules are one such step.

Can an employee be dismissed for breaching an IT policy?

Sometimes. The Fair Work Commission says a substantial and wilful breach of policy will often be a valid reason for dismissal, but it still weighs all the circumstances. An employer that ignored widespread breaches, or never told staff about the policy, will find a dismissal much harder to defend.

How often should an acceptable use policy be reviewed?

Review an acceptable use policy at least once a year, and whenever systems change, such as when new collaboration software or AI tools arrive. After each revision, ask staff to acknowledge the new version, because in NSW and the ACT the law asks whether staff can be assumed to understand the policy.

Related reading

• Sample workplace surveillance policy and notice
• Sample working from home policy
• Worknice HR document management

Sources

1. NSW Parliamentary Counsel’s Office. “Workplace Surveillance Act 2005 No 47.” Current version for 28 March 2026 to date. Retrieved 8 October 2026. https://legislation.nsw.gov.au/view/html/inforce/current/act-2005-047
2. ACT Parliamentary Counsel’s Office. “Workplace Privacy Act 2011, Republication No 6.” Effective 23 June 2021. Retrieved 8 October 2026. https://www.legislation.act.gov.au/a/2011-4/
3. Office of the Australian Information Commissioner. “Australian Privacy Principles quick reference.” Retrieved 8 October 2026. https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-quick-reference
4. Office of the Australian Information Commissioner. “About the Notifiable Data Breaches scheme.” Retrieved 8 October 2026. https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme
5. Australian Signals Directorate. “Annual Cyber Threat Report 2024-2025.” Published 14 October 2025. Retrieved 8 October 2026. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025
6. Office of the Australian Information Commissioner. “Australian Community Attitudes to Privacy Survey 2023.” August 2023. Retrieved 8 October 2026. https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023
7. Fair Work Commission. “Conduct.” Unfair dismissals benchbook, last updated 12 December 2024. Retrieved 8 October 2026. https://www.fwc.gov.au/conduct