# Acceptable Use Policy Template — Email and Internet Monitoring

## Policy Information

| Field | Value |
|-------|-------|
| Organisation | [Atlas Manufacturing Group] |
| Policy Version | [1.0] |
| Effective Date | [DD/MM/YYYY] |
| Next Review Date | [DD/MM/YYYY] |
| Approved By | [Name, Title] |
| DPO Sign-Off | [Name, Date] |

## 1. Scope

This policy applies to all employees, contractors, and temporary workers who use the organisation's electronic communications systems, including:
- Corporate email systems
- Internet access via the corporate network
- Instant messaging and collaboration platforms (Microsoft Teams, Slack)
- Telephone systems
- Personal devices used to access corporate systems (BYOD)

## 2. Personal Use

[Select one]:
- [ ] **Option A**: Limited personal use of email and internet is permitted during break periods, provided it does not interfere with work duties, consume excessive bandwidth, or breach this policy.
- [ ] **Option B**: Personal use of corporate email and internet is not permitted. Employees should use personal devices on personal data connections for personal communications.

## 3. Monitoring

The organisation monitors the use of its electronic communications systems. This section explains what is monitored, why, and by whom.

### 3.1 What Is Monitored

| System | What Is Monitored | What Is NOT Monitored |
|--------|-------------------|----------------------|
| Email | [Metadata: sender, recipient, time, subject] / [Content: automated DLP scanning for data patterns] | [Personal email accounts accessed from corporate devices are not monitored] |
| Internet | [URLs visited, browsing duration, download activity] / [Categories of sites accessed] | [Content of encrypted personal banking/medical sites] |
| Messaging | [Messages on corporate platforms are retained per retention policy] | [Personal messaging apps on personal devices] |

### 3.2 Why Monitoring Takes Place

The organisation monitors electronic communications for the following specific purposes:
- [ ] Preventing data loss and protecting confidential business information
- [ ] Detecting and preventing security threats (malware, phishing)
- [ ] Ensuring compliance with regulatory obligations
- [ ] Enforcing this Acceptable Use Policy
- [ ] Investigating specific, documented suspected misconduct
- [ ] Other: _____________

### 3.3 Who Has Access to Monitoring Data

| Role | Access | Purpose |
|------|--------|---------|
| IT Security Team | Automated DLP alerts; metadata logs | Security threat detection |
| Compliance Officer | Regulatory investigation data | Regulatory compliance |
| HR (authorised cases only) | Escalated cases from IT Security | Disciplinary investigation |
| Line Managers | **No direct access** to monitoring data | N/A |

### 3.4 What Is Excluded from Monitoring

The following categories of communications are excluded from monitoring:
- Communications with legal counsel (legal professional privilege)
- Communications with medical professionals
- Communications with trade union representatives
- Communications marked as personal (where personal use is permitted)

## 4. Consequences

Violation of this policy may result in:
- Verbal warning
- Written warning
- Suspension of access to specific systems
- Disciplinary action up to and including dismissal for serious violations

**Important**: Monitoring data will not be used as the sole basis for any adverse employment decision. Human review is required before any disciplinary action.

## 5. Your Rights

As an employee, you have the following rights regarding monitoring data:
- **Right of access**: You may request a copy of any monitoring data held about you (Data Subject Access Request)
- **Right to challenge**: You may challenge any decision made using monitoring data through the organisation's grievance procedure
- **Right to complain**: You may complain to the Data Protection Officer or the supervisory authority ([ICO / CNIL / BfDI / etc.])

## 6. Retention

| Data Type | Retention Period |
|-----------|-----------------|
| Email metadata logs | [90 days / 1 year / as required by regulation] |
| DLP alert records | [1 year] |
| Internet browsing logs | [90 days] |
| Messaging retention | [1 year / 3 years / as required by regulation] |

## 7. Review

This policy is reviewed annually or when there is a material change to monitoring technology. Employees will be notified of any changes and required to acknowledge the updated policy.

## Employee Acknowledgment

I confirm that I have read, understood, and agree to comply with this Acceptable Use Policy. I understand that the organisation's electronic communications systems are monitored as described above.

| Field | Value |
|-------|-------|
| Employee Name | _________ |
| Employee ID | _________ |
| Date | _________ |
| Signature | _________ |