CDComplianceDesk
← All templatesStart free trial

Privacy and data

Acceptable Use Policy (IT and Internet)

A policy that tells employees how they may use company devices, email, internet and accounts, with rules on passwords, personal use, monitoring and consequences, written to work with POPIA and the Cybercrimes Act.

Starting point, not legal advice. It is general information and not legal advice. Have it reviewed by a South African attorney before you rely on it. Status: compiled from public sources, not reviewed by a lawyer. Wording last checked 2026-10-31.

1. Fill in your details

2. Download

5 fields still empty. They show highlighted in the document so you can finish them in Word.

Sign up free to download

Already have an account? Log in.

Preview

Acceptable Use Policy

[Employer name] ("we") adopts this policy from [Effective date]. It applies to all employees, contractors and anyone using our devices, networks, email, software, cloud accounts or data. Its aim is to protect the business, our clients and our people.

1. General rules

  • Use company systems and data for company business and to do your job.
  • Do not use them to break the law, to harass or discriminate against anyone, to view or share offensive or illegal material, or to infringe copyright.
  • Do not try to get into systems, accounts or data you are not authorised to use, and do not tamper with security controls.
  • Do not install software or connect devices without IT approval.

2. Accounts and passwords

  • Use a strong, unique password for each account, and a password manager where we provide one.
  • Turn on multi-factor authentication where available. Never share your password or let someone else use your account.
  • Lock your screen when you leave your device. Report a lost or stolen device to [IT contact (role or email)] straight away.

3. Email and internet

Be careful with links and attachments, especially from unknown senders. Do not send confidential information or personal information to unapproved addresses or services. Use company email for company business.

4. Personal use

Limited and reasonable personal use is allowed outside working hours, if it does not interfere with work, break the law or breach this policy.

5. Personal devices

Personal devices for work: [Personal devices (BYOD)]. Where allowed, the device must have a screen lock, up-to-date software and any security settings IT requires, and we may remove company data from it if you leave or the device is lost.

6. Personal information and confidential data

Handle personal information as the Protection of Personal Information Act and our privacy policies require. Store company data only on approved systems, not on personal cloud accounts or unapproved devices. Report any suspected data breach to [IT contact (role or email)] immediately.

7. Monitoring

We may monitor the use of company systems to protect security, check compliance with this policy and the law, and keep the business running. We currently monitor: [What you monitor]. Monitoring is limited to what is necessary, access to the results is limited, and personal information is handled under our privacy notice.

8. Breaches

A breach of this policy may lead to disciplinary action under our disciplinary code, which may include dismissal in serious cases, and may be reported to the police or a regulator where the law requires.

Acknowledgement

I confirm that I have read and understood this policy.

Employee

Signature: ____________________

Name: ____________________

Title: ____________________

Date: ____________________

For the employer: [Employer name]

Signature: ____________________

Name: ____________________

Title: ____________________

Date: ____________________

When to use it

  • You give employees company devices, email or system access
  • You want to set rules for personal use, remote work and bring-your-own-device
  • You monitor systems and need to tell employees how and why

Before you use it

  • Monitoring of employees' communications must be lawful and proportionate. Tell staff what you monitor, why and who sees it, and check the Regulation of Interception of Communications Act and POPIA before you do it
  • Match the rules to what you really allow (personal use, personal devices) so they can be enforced consistently
  • Link it to your disciplinary code, and have employees sign an acknowledgement
  • Have an attorney review before first use, in particular the monitoring section

Related laws and frameworks

POPIACYBERCRIMES ACTECTA

Sources

Keep this policy current and acknowledged

Store it in ComplianceDesk, track versions and collect staff acknowledgements.

Start free trial