IT, Email & Internet Policy UK: Employer Guide 2026

What this document is

A Computer, Email and Internet Policy is an internal document that tells staff how they can, and cannot, use the employer's IT systems. It usually covers company-issued laptops, desktops, mobile phones, email accounts, internet browsing, instant messaging, cloud storage, and increasingly things like personal devices used for work and generative AI tools.

The policy is not normally a contract in itself, but it is typically incorporated into the employment relationship through the contract or staff handbook, which means a serious breach can justify disciplinary action. The policy sits alongside other workplace rules such as the data protection policy, social media policy, disciplinary procedure and bring-your-own-device policy.

For small employers it can be a single short document. For larger organisations it tends to split into several connected policies. The key point is that it must be written down, communicated, and applied consistently, otherwise it will not hold up if you need to rely on it later.

How to use this document

1. Work out what you actually need to cover. Before drafting, map out how your people use technology day to day. Think about remote working, personal devices, shared inboxes, messaging apps, file sharing platforms, and whether staff handle personal data or confidential client information. This shapes the scope and stops you producing a generic document that does not reflect how your business really operates. 2. Set clear rules on acceptable and unacceptable use. Spell out what is allowed, what is banned outright, and where reasonable personal use is tolerated. Typical prohibitions include accessing offensive or unlawful material, installing unapproved software, sharing login details, using company systems to run a side business, and sending confidential information to personal email accounts. Be specific enough that a reasonable employee knows where the line is. 3. Address monitoring and privacy properly. UK data protection law allows employers to monitor IT use, but only where it is lawful, necessary and proportionate, and staff must be told what is happening. Explain what you monitor, why, how long logs are kept, and who has access. A data protection impact assessment is often sensible before introducing more intrusive monitoring such as keystroke logging or screen capture. 4. Cover confidentiality, security and data protection. Remind staff about their duty to protect company and client information, use strong passwords, lock screens, report phishing, and follow rules on encryption and removable media. Link the policy to your wider information security and data protection framework so employees see how email and internet use fits into the bigger picture of keeping data safe. 5. Communicate, train and enforce consistently. A policy sitting on a shared drive that nobody has read will not protect you. Issue it to all staff, ideally with a signed or electronic acknowledgement, cover it during induction, refresh training periodically, and apply it even-handedly through the disciplinary procedure. Review the document regularly as technology, case law and working patterns change.

Common questions