Acceptable internet use
Internet Usage Policy for UK Businesses
An internet usage policy should tell staff what is acceptable without pretending there is no privacy interest at work. It should combine cyber-security controls with clear, proportionate rules on personal use, downloads, online services and monitoring.
What the policy covers
Business and reasonable personal use, prohibited activity, suspicious websites, credentials, software and browser extensions, cloud/file-sharing services, AI and online uploads, public Wi-Fi, BYOD, web filtering, bandwidth and worker-monitoring transparency.
Download the free policy template
Editable Internet Usage Policy Template covering acceptable use, downloads, cloud services, cyber security, personal use and worker monitoring.
Free 39Security download
Get the Internet usage policy.
Editable Internet Usage Policy Template and branded PDF copy.
- Branded 39Security template
- Editable Word document
- Secure email link - no attachment
- © 2026 Matthew Southgate. All rights reserved.
Frequently asked questions
12 practical answers.
What is an internet usage policy?
An internet usage or acceptable-use policy explains how staff may use company internet access, browsers, web services and online tools, including security, downloads, personal use, cloud services and monitoring.
Should personal internet use be banned at work?
Not necessarily. Many organisations permit reasonable personal use provided it is lawful, does not interfere with work or security and does not create excessive cost or bandwidth use. The rule should be clear and applied consistently.
Can a company monitor employee internet usage?
Monitoring needs a defined purpose, must be necessary and proportionate, and workers should receive clear privacy information about its nature and extent. High-risk monitoring may require a DPIA.
Can staff use personal email for work?
Normally business information should stay in approved organisational systems. Personal email can create uncontrolled storage, retention, access and data-loss risks.
Can staff upload files to online converters and AI tools?
Only if the service is approved for the information involved. Online converters, AI tools, transcription sites and browser extensions can receive a copy of the data and may have their own retention or reuse terms.
Should browser extensions require approval?
Yes. Extensions can receive extensive permissions to read pages, change content or access data. Treat them as software and subject them to the normal approval process.
Can staff bypass web filters if a site is blocked?
No unless an authorised technical process approves the exception. A legitimate business site that is incorrectly blocked should be submitted for review rather than bypassing security controls.
Can staff download software from the internet?
Only in line with the company’s software-approval process. Uncontrolled software and installers are a common route for malware, unwanted applications and licence problems.
Can staff use public Wi-Fi for work?
Yes if the organisation’s remote-working controls are followed. Use approved secure access or VPN where required and avoid exposing confidential information in public places.
What should staff do after clicking a suspicious website?
Stop interacting with the site, report it promptly and follow the incident process. If credentials were entered or a file was downloaded, say so immediately so containment can begin.
Does the policy apply to BYOD?
Yes where personal devices access business systems, but the organisation should also maintain a separate BYOD policy defining device eligibility, security controls and data separation.
Can I download an internet usage policy template?
Yes. Enter your email address on this page and 39Security will email you a secure link to the editable Internet Usage Policy Template.
Related guidance