Acceptable Use Policy, Personal Use, And Employee Privacy: Ten Questions Answered

User behaviour is central to maintaining strong organizational data security. The "Acceptable Use Policy" (AUP) has long been a key tool for guiding user behaviour, protecting networks, and asserting strong control over organizational data. Courts and labour arbitrators now recognize a limited employee right to privacy when using organizational networks for personal purposes. While this right does not compromise network security, it must be carefully addressed in AUPs.

Below are answers to ten common questions organizations ask about maintaining effective AUPs while respecting employee privacy.

1. What should organizations do to ensure their AUPs address personal use?

Organizations should ensure their AUPs (1) clearly state all reasons management may access and use information stored on the system, and (2) emphasize that personal use is a voluntary choice that involves giving up some privacy. This recent arbitration decision highlights the benefits of