Template · Policies and handbooks
Acceptable use and BYOD policy
In short
An acceptable use policy sets the rules for company devices, accounts, networks and data, and a BYOD section covers personal phones and laptops used for work. This template covers permitted and prohibited use, passwords, AI tools, monitoring notice, personal devices, mobile phones on production floors, off-hours messages and what happens at separation.
Acceptable Use of Technology and Bring Your Own Device (BYOD) Policy template
Acceptable Use of Technology and Bring Your Own Device (BYOD) Policy
Replace each [Placeholder]. Work through it with IT and security, who own the technical controls; HR owns the people side. Add any state monitoring notice your locations require.
1. Scope
This policy applies to all employees, temporary workers, contractors and interns who use [Company Name] technology: computers, phones, headsets, networks, email, chat, cloud applications, customer systems and data, whether at a company site, at home or anywhere else. It also applies to personal devices used to access company email, chat or data.
2. Acceptable use
Company systems are provided for business. Brief, occasional personal use (checking a personal email, a quick message home) is fine if it does not interfere with work, use significant bandwidth or break any other rule in this policy. Production-floor and customer-facing staff should limit personal use to breaks.
3. Prohibited use
Do not use company systems to:
- Access, store or send material that is illegal, sexually explicit, or harassing or discriminatory under our [Anti-Harassment Policy] - Share passwords, use another person's login, or let anyone else use your account - Install software, browser extensions or apps that IT has not approved - Copy customer, candidate or employee data to personal email, personal cloud storage, USB drives or personal devices except as this policy allows - Take photos, screenshots or recordings of customer data or screens - Bypass security controls, VPN, filtering or monitoring tools - Run a personal business, mine cryptocurrency or send chain messages - Enter confidential, customer or personal data into AI tools that IT has not approved
4. Passwords, access and security
Use a unique password for company accounts and turn on multi-factor authentication where offered. Lock your screen whenever you step away. Report lost or stolen devices, suspected phishing and any accidental data exposure to [IT or security contact] immediately, and in any case within [1 hour]. Reporting quickly will not lead to discipline for an honest mistake.
5. AI tools
Approved AI tools are listed at [location]. You may use them for work within the limits IT sets. Check AI-generated output before relying on it. Do not use AI tools to make or recommend decisions about hiring, pay, discipline or termination unless HR has approved that specific use.
6. Monitoring and privacy
Company systems, accounts and devices belong to the company. To protect customers, meet legal obligations and maintain security, the company may monitor, log and review use of its systems, including email, chat, internet activity, call recordings, screen activity and system access, to the extent the law allows. Employees should not expect privacy in anything created, sent or stored on company systems. The company will not access personal accounts or personal content on a personal device except as described in section 8. [Insert any state-required notice, e.g. New York, Connecticut or Delaware electronic monitoring notice, and how employees acknowledge it.]
7. Mobile phones in work areas
Personal mobile phones and smartwatches with cameras are not permitted [on the production floor / in secure areas where customer payment data is handled]. Store them in [lockers or designated area] and use them during breaks and in [break areas]. Employees who need to be reachable for an emergency, such as childcare, can give [supervisor desk phone number] to family members. Exceptions for medical devices or disability-related needs can be requested from [HR contact].
8. Bring your own device (BYOD)
Employees may use a personal phone, tablet or computer for work only if [IT] has approved the device and the employee has signed the BYOD agreement below. Approved devices must:
- run a supported operating system with current updates and a screen lock - have the company's [mobile device management or work-profile app] installed, which separates company data from personal data - not be shared with family members while logged in to company apps
The company can see and remove company apps and data in the work profile. It cannot see personal photos, messages, browsing or apps. If a device is lost or stolen, or employment ends, the company will remove company data and may, only if a full wipe is the only option and the employee has been told in advance, reset the device. [Monthly stipend or reimbursement: $[amount] per month / reimbursement of a reasonable share of the employee's plan.]
9. Off-hours use and timekeeping
Non-exempt (hourly) employees should not check or respond to work email, chat or messages outside scheduled hours unless a manager has asked them to. Any work done outside scheduled hours, including reading and answering messages, counts as time worked and must be recorded and will be paid. Managers should not message hourly staff after hours except for schedule changes or emergencies.
10. Separation and violations
On the last day of employment, return all company equipment and allow removal of company data from personal devices. Violations of this policy may lead to loss of access and discipline up to termination, and serious violations may be reported to law enforcement. Effective date: [Date]. Questions: [IT contact] or [HR contact].
Employee acknowledgment and BYOD agreement
- I have read and agree to follow the Acceptable Use and BYOD Policy, including the monitoring notice in section 6.
- I want to use a personal device for work
- NoYes: phoneYes: tabletYes: computer
- Device make and model (if using BYOD)
- I agree to the removal of company data from my device as described in section 8.
- Employee name
- Employee signature
- Date
How to use this template
- Sit down with IT and security to confirm which tools, AI services and device controls actually exist, and edit the policy to match reality.
- Decide where phones are banned and why, usually areas handling payment card or health data, and fix storage before you publish the rule.
- Choose a BYOD model: no personal devices, work-profile only, or full device management, and set the stipend or reimbursement rate.
- Add any state monitoring notice your sites need and decide how employees acknowledge it.
- Write the off-hours rule for non-exempt staff and tell managers what it means for their messaging habits.
- Collect signatures at hire and when you change monitoring or BYOD terms, and file them in the personnel record.
What this policy covers and who owns it
An acceptable use policy is the people-facing half of your security program. IT sets the controls; the policy tells employees what is expected and what happens if they ignore it. The BYOD section matters more every year because most staff read work chat on their own phones whether you allow it or not, and a written rule beats a silent one.
Keep the rules concrete. "Use technology responsibly" gives a supervisor nothing to enforce. "Do not copy candidate data to personal email" does. Link this policy from your code of conduct and, for home-based staff, from your remote work policy, which covers home office setup and security.
Phones on the contact center floor
Clean desk and no-phone rules are standard in contact centers that take card payments, because a phone camera can capture a customer's card number in a second. PCI DSS, the card industry's security standard, expects tight controls over who can see cardholder data, and most clients put device restrictions in their contracts.
The rule works only if the logistics work. A 300-seat site needs enough lockers near the floor entrance, a reachable landline for family emergencies, and break areas where phones are allowed. Without those, agents keep phones in pockets and supervisors stop enforcing it. Say clearly how disability-related needs, such as a phone-linked glucose monitor, are handled.
For recruiters, the bigger risk is the opposite: they use personal phones constantly for texting candidates. Give them an approved texting tool tied to company records instead of personal numbers, so candidate messages are not lost or left on a phone when the recruiter leaves.
Monitoring, BYOD and pay: US legal points
Monitoring notice. Federal law (the Electronic Communications Privacy Act) generally allows employers to monitor their own systems, especially with consent. Several states add notice rules: New York has required written notice and acknowledgment of electronic monitoring since 2022, and Connecticut and Delaware have their own notice laws. Read more on employee monitoring.
Reimbursement. California Labor Code section 2802 requires employers to reimburse necessary business expenses, and California courts have applied that to personal phones used for work even on unlimited plans. Illinois and a handful of other states have similar rules. A flat monthly stipend is the simplest way to comply.
Off-the-clock work. Under the FLSA, time a non-exempt employee spends reading or replying to work messages is generally working time if the employer knows or should know about it. An hourly agent answering schedule chats from home every evening can add up to unpaid overtime claims.
Remote wipe. Wiping a personal device without clear consent can lead to claims for lost personal data. Use work profiles where you can and get written consent for any full wipe.
NLRA. Monitoring and use rules should not be so broad that they chill employees from discussing pay and conditions; the NLRB scrutinizes surveillance policies.
Rules vary by state and country; in the EU and UK, data protection law limits monitoring much more tightly.
Common mistakes
- A policy written by IT in security jargon that frontline staff never read.
- No rule on AI tools, so staff paste candidate resumes or customer records into public chatbots.
- Banning phones without lockers or an emergency contact number.
- BYOD without a reimbursement plan in states that require one.
- Monitoring without the notice your state requires.
- Forgetting to remove company data from personal devices when people leave, which is how candidate lists walk out the door.
Frequently asked questions
What is an IT acceptable use policy?
It is a written set of rules for how employees may use company computers, phones, accounts, networks and data, covering permitted personal use, prohibited activities, security duties such as passwords and reporting incidents, monitoring and the consequences of violations.
What should a BYOD policy include?
Which devices are allowed, the security requirements, the management software used and what it can and cannot see, how company data is removed, reimbursement or stipend terms, off-hours rules for hourly staff, and a signed agreement from each employee who opts in.
Can employers ban mobile phones at work?
In most cases yes, especially for safety or data-security reasons such as handling payment card data. Provide secure storage, allow use on breaks, give a way to be reached in emergencies, and handle disability-related exceptions as accommodation requests.
Do employers have to reimburse employees for using their personal phones?
Federal law does not require it unless the cost drops pay below minimum wage, but California, Illinois and some other states require reimbursement of necessary business expenses, which can include personal phone use for work.
Can my employer monitor my work computer?
Generally yes in the US, for company-owned systems, and the policy should say so. Some states, including New York, Connecticut and Delaware, require written notice of electronic monitoring. Monitoring of personal accounts and devices is far more limited.
Should an acceptable use policy cover AI tools?
Yes. Name the approved tools, ban putting confidential or personal data into unapproved ones, and require HR approval before AI is used in hiring, pay or discipline decisions, since those uses carry extra legal requirements in some places.