An acceptable use policy (often called the company IT charter) tells everyone who uses your systems what they may do, what they may not do, and what the company may check. Acceptable Use Express is a self-service workshop that helps a European SME write one in plain language, tied to the GDPR and to ISO/IEC 27001, with remote work, personal devices and generative AI covered. You get a working draft in your company's name, to be validated by your own adviser.
A short, readable document that turns your security intentions into everyday rules for people
Most small and medium-sized companies have computers, a mailbox per person, shared files in the cloud, a few business applications and, increasingly, phones and laptops that leave the office. What they often lack is a single document that says, in words an employee understands, how those tools may be used. That document is the acceptable use policy. In France it is usually called a charte informatique; elsewhere you will see "IT usage policy", "computer use policy" or "IT charter". The name matters less than its three jobs.
Users cannot respect rules nobody has written down. An acceptable use policy states the expected behaviour for passwords, e-mail, internet browsing, file sharing, removable media, software installation, personal use of company equipment, travel and remote work. It is the user-facing part of your security, the bit that reaches every desk.
Logging, filtering, mailbox access during an absence, device management, backup of workstations: all of these involve personal data about employees. Under the General Data Protection Regulation, the people concerned must be informed of the purposes and the conditions of processing (Article 13). The acceptable use policy is a natural place to give that information in a single, coherent text rather than in scattered e-mails.
When a rule is broken, an organisation needs to show that the rule existed, that the person knew about it, and that any monitoring that revealed the breach was itself lawful and proportionate. A policy that was never communicated, or that hides monitoring the staff never heard of, gives you very little to stand on. How a policy becomes enforceable depends on national labour law, which is why we keep this page general and send you to your adviser for the last step.
The international security standard recognises this role explicitly. ISO/IEC 27001:2022, in its Annex A, includes control 5.10 "Acceptable use of information and other associated assets", which expects rules for acceptable use, and procedures for handling information and assets, to be identified, documented and implemented. An acceptable use policy is the most common way SMEs meet that expectation, whether or not they ever seek certification.
Sources: Regulation (EU) 2016/679 (GDPR), EUR-Lex · ISO/IEC 27001, public page on iso.org
The same handful of mistakes come back again and again. None of them need a large budget to fix.
A policy downloaded from the internet describes someone else's tools, someone else's country and someone else's risks. It mentions systems you do not use and is silent on the ones you do. Staff notice, and stop reading.
A document sitting in a shared folder has not been communicated. If you cannot show who received it, when, and in which version, it will be hard to rely on it later. In several countries, the employee information or consultation steps are part of what makes the rules applicable.
Web filtering logs, mail gateway logs, endpoint management and data loss prevention tools all observe people. The GDPR requires transparency (Article 5(1)(a)) and information of the persons concerned (Article 13). Monitoring kept quiet is a compliance risk in itself.
Many charters were written when everyone worked on a desktop in the office. They say nothing about home Wi-Fi, personal phones receiving company e-mail, or employees pasting customer data into a public chatbot. The gap is where incidents happen.
The chapters below are the backbone of the draft the workshop produces. Each one is adapted to your answers, and each one can be shortened or removed.
Employees, interns, temporary staff, contractors and anyone with an account. Which systems are covered: workstations, mobile devices, e-mail, collaboration suites, business applications, networks, printers, cloud storage. A clear scope avoids the classic argument "this didn't apply to me".
Personal, non-transferable accounts; password quality and storage; multi-factor authentication where the company has deployed it; locking the session when leaving the desk; what to do if a password may have been exposed.
Related: NIS2, Art. 21(2)(j) lists multi-factor authentication among the measures for entities in scope.
Professional use as the rule, reasonable personal use if the company allows it, and how personal messages should be identified. Phishing reflexes, attachments and links, forwarding rules, auto-forwarding to personal addresses, prohibited sites and content.
Which information is confidential, how it may be shared internally and externally, approved file-sharing tools, printing, clean desk, and the duty to process personal data only on the company's instructions.
GDPR Art. 29 and Art. 32(4): persons acting under the controller's authority process personal data only on its instructions.
Who may install software, use of personal USB keys and external drives, care of laptops and phones, reporting loss or theft, and the return of equipment and access when someone leaves (ISO/IEC 27001:2022 Annex A also has a control on return of assets, 5.11).
Working from home, from a client's site or on the move: trusted networks, VPN when required, screen privacy, physical protection of equipment, video calls in public places. ISO/IEC 27001:2022 Annex A has a dedicated control, 6.7 "Remote working".
Whether personal phones, tablets or computers may access company data, under which conditions (device lock, updates, separate work profile, remote wipe of company data only), and what the company may and may not see on a personal device.
Which AI tools are approved, which data must never be entered into them (personal data, customer secrets, source code, credentials), human review of outputs, and how to request a new tool. A policy that simply forbids everything tends to push usage out of sight.
AI Act, Regulation (EU) 2024/1689, Art. 4 on AI literacy of staff.
What is logged, filtered or checked, for which purpose, by whom, for how long logs are kept, and the rights of the persons concerned. This chapter is where the GDPR transparency and information duties are met.
GDPR Art. 5 and Art. 13.
How and to whom to report a suspicious e-mail, a lost device or a mistake, without fear of blame for a prompt report. Reference to the disciplinary framework that applies in your organisation (ISO/IEC 27001:2022 Annex A, control 6.4 "Disciplinary process"), and the date and version of the policy.
The legal route differs between Member States. What does not differ is the logic: lawful, proportionate, known in advance.
An acceptable use policy almost always describes processing of employees' personal data: account logs, connection records, filtering, device inventories, sometimes mailbox access. Three articles of the GDPR frame that processing everywhere in the European Union.
Article 5, principles. Personal data must be processed lawfully, fairly and in a transparent manner; collected for specified, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; kept no longer than necessary; and processed with appropriate security. Under Article 5(2), the controller must be able to demonstrate compliance with these principles (accountability). For an acceptable use policy, this means each control you describe should have a stated purpose and a reasonable retention period, and you should be able to show why it is proportionate.
Article 13, information to be provided. When data is collected from the person concerned, the controller must provide, among other things, its identity and contact details, the contact details of the data protection officer where there is one, the purposes and legal basis of the processing, the legitimate interests pursued where that is the basis, the recipients, the retention period, and the rights of the person. The acceptable use policy, or an information notice attached to it, is a practical vehicle for this information.
Article 88, processing in the context of employment. The GDPR allows Member States, by law or by collective agreements, to provide more specific rules for processing employees' personal data in the employment context. Article 88(2) requires such rules to include suitable and specific measures to safeguard the dignity, legitimate interests and fundamental rights of the persons concerned, with particular regard to transparency of processing, transfers within a group of undertakings, and monitoring systems at the workplace. In practice this is the reason the answer to "what may we monitor, and how?" partly depends on the country you operate in.
Across the EU, Directive 2002/14/EC establishes a general framework for informing and consulting employees in undertakings above thresholds that each Member State chooses within the limits set by the directive. National law and collective agreements then define whether a works council, a staff representative body or a trade union must be informed or consulted before rules on IT use or workplace monitoring are introduced, and in what form. In some countries, an acceptable use policy is attached to the internal work rules and follows the same procedure; in others it is part of the employment contract, a collective agreement or a stand-alone policy acknowledged by each user.
Take France as one example among many: the Labour Code (Code du travail) provides that the works council (CSE) is informed and consulted, prior to their introduction in the company, on the means or techniques that allow monitoring of employees' activity, and that no information concerning an employee personally may be collected by a device that has not first been brought to the employee's knowledge. The French data protection authority, the CNIL, recommends in its personal data security guide that a company drafts an IT charter and gives it binding force, for instance by attaching it to the internal work rules. Other countries have their own equivalents, which is why the workshop asks you where your staff are employed and flags the points to check with your adviser.
Whatever the national route, keep evidence: the version and date of the policy, the date it was communicated, how (e-mail, intranet, onboarding pack, signature), and who acknowledged it. Re-communicate when the policy changes. ISO/IEC 27001:2022 Annex A treats this as part of people controls, alongside terms and conditions of employment (6.2) and information security awareness, education and training (6.3).
Important. This section is general information about European and national texts. It is not legal advice and does not replace the analysis of an employment lawyer, a data protection officer or your HR adviser for your specific situation, country and collective agreements.
Sources: GDPR, Arts. 5, 13 and 88 (EUR-Lex) · Directive 2002/14/EC (EUR-Lex) · French Labour Code (Légifrance) · CNIL, personal data security guide · ISO/IEC 27001 (iso.org)
The acceptable use policy is not a security policy on its own. It is the part of it that speaks to users.
The information security policy is written for management and IT: it sets objectives, roles, risk treatment and the controls the company commits to. The acceptable use policy translates the user-facing parts of it into concrete behaviour. ISO/IEC 27001:2022 Annex A separates the two: control 5.1 "Policies for information security" and control 5.10 "Acceptable use of information and other associated assets". The two documents should use the same vocabulary, the same classification of information and the same contacts, so that an employee never receives contradictory instructions.
If you are building the security policy itself, see our sister page pssi-express.eu.
Remote work moves company data onto home networks, kitchen tables and train seats. The acceptable use policy is where you state the minimum expectations: use company equipment where provided, keep it updated, connect through the company's secure access when required, avoid public printing, protect screens and conversations, and report loss immediately. If you also have a separate telework agreement or policy, the acceptable use policy should refer to it rather than repeat it. ISO/IEC 27001:2022 Annex A control 6.7 "Remote working" covers the security side.
Allowing personal phones to receive company e-mail is convenient and common. It also raises two questions the policy must answer. What does the company require of the device (screen lock, supported operating system, a separate work profile or container)? And what may the company see or erase? Device management tools can be configured to manage only the company's data; the policy should say so, and should say what happens to company data when the person leaves. ISO/IEC 27001:2022 Annex A control 8.1 "User endpoint devices" frames the technical side.
Public AI assistants can be useful, and staff are often already using them. The risk is in the data entered and in outputs used without review. A short AI chapter typically lists approved tools, forbids entering personal data, confidential information or credentials into non-approved services, requires human review before reuse, and explains how to ask for a new tool. Where an external AI service processes personal data on your behalf, the GDPR rules on processors (Article 28) and on transfers outside the EU (Chapter V) apply. Article 4 of the AI Act, applicable since 2 February 2025, asks providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff (check the current consolidated wording, as amendments to this article have been proposed); an AI chapter in the acceptable use policy, plus a short awareness session, is a reasonable building block.
Regulation (EU) 2024/1689 (AI Act) · GDPR, Art. 28 and Chapter V
For essential and important entities under the NIS2 Directive, the cybersecurity risk-management measures of Article 21 include basic cyber hygiene practices and cybersecurity training (21(2)(g)) and human resources security, access control policies and asset management (21(2)(i)). An acceptable use policy does not make you NIS2-compliant, but it is one of the documents that support those measures.
A policy that is signed and forgotten changes nothing. The policy and the awareness programme should work together: the policy states the rule, short sessions explain why. Where a data protection officer exists, the GDPR lists awareness-raising and training of staff among the officer's tasks (Article 39(1)(b)). National agencies publish free material you can reuse, for example ENISA at EU level, and, in France, ANSSI and cybermalveillance.gouv.fr.
You stay in control from start to finish. A human consultant is an option, never a requirement.
A short questionnaire on your organisation: where your staff are employed, which tools they use, whether personal devices and remote work are allowed, whether you use AI assistants, whether you have staff representatives, whether you already have a security policy. It tells you which chapters you need and which points will require local legal validation.
You answer guided questions in your own words, chapter by chapter: what is allowed, what is not, what the company checks and why, how long logs are kept, who to contact. Each question comes with a short explanation and, where relevant, a link to the official source. You can save, come back later, and involve a colleague.
The policy is generated automatically from your answers, in your company's name, with a separate information notice on monitoring and an acknowledgement form. It is a working basis: have it reviewed by your own adviser (employment lawyer, data protection officer, HR) before you communicate it, consult representatives where required, and adopt it.
If you want someone to review your answers with you, adapt the draft to a specific context, or prepare the presentation to staff or their representatives, you can ask for support from a partner consultant. This is optional and separate from the self-service tool.
Working basis, not legal advice. The generated document is a draft built from your own answers and from public sources. It does not constitute legal advice. Its validity in your country, and the procedure to make it applicable to your staff, must be checked by a qualified adviser.
Documents you can edit, communicate and keep as evidence
The main document, in plain language, built from your answers.
A separate notice structured around GDPR Article 13.
What you need to communicate the policy and keep a trace.
Where each chapter connects to public texts.
A short, stand-alone annex you can update more often than the policy.
Your document stays yours, in formats you can change.
We cite only texts we can link to. Where something depends on national law, the draft says so instead of guessing.
Article 5 (principles and accountability), Article 13 (information of the persons concerned), Article 88 (processing in the employment context), and, where relevant, Article 28 (processors), Article 32 (security of processing) and Article 39 (tasks of the data protection officer).
Control 5.10 "Acceptable use of information and other associated assets", with the related controls 5.1 (policies for information security), 5.11 (return of assets), 6.2 (terms and conditions of employment), 6.3 (awareness, education and training), 6.4 (disciplinary process), 6.7 (remote working) and 8.1 (user endpoint devices). The standard is sold by ISO; we cite control titles only.
For entities in scope only: Article 21(2)(g) basic cyber hygiene practices and cybersecurity training, 21(2)(i) human resources security, access control policies and asset management, 21(2)(j) multi-factor authentication. National transposition laws apply.
Article 4 on AI literacy, applicable since 2 February 2025 to providers and deployers of AI systems (check the current consolidated wording before relying on it). Relevant as soon as your staff use AI systems in their work.
What each option contains. Availability will be announced on this page.
To find out what you need before you start
To produce your own draft policy
To add human review to the self-service draft
In every option, the document is a working basis to be validated by your own adviser. It does not constitute legal advice.
Short answers. Where a text is cited, the link goes to the official source.
Every regulatory or normative statement above links to one of these.
This page provides general information. It does not constitute legal advice.
The self-service workshop is being prepared. It will open on this page.
Questions in the meantime: contact@syaga.eu