Acceptable use policy: a practical guide for Australian businesses

Monitoring, personal use, AI tools and dismissal consequences recur across Australian workplace forums. Governance and review-cadence questions appear less often, but are critical implementation gaps.

• business with employees, contractors or volunteers — Use one policy for every person who can access company systems or information, not only permanent employees.
• organisation using the ASD Information Security Manual — The ISM expressly calls for a system usage policy and a separate general-purpose AI usage policy.

This policy applies to every employee, contractor, labour-hire worker, volunteer and other person authorised to use the organisation’s systems, accounts, devices, networks, data or online services. Users must use those resources only for authorised, lawful and reasonable purposes, follow all related security requirements, protect company and third-party information, and promptly report suspected loss, misuse, compromise or unauthorised disclosure.

• NSW or ACT workforce — Add a compliant surveillance notice and the computer or data-surveillance details required by the applicable Act.
• business with annual turnover of $3 million or more, or another Privacy Act-covered entity — Link the AUP to privacy obligations for personal information, including information entered into AI systems.

This policy covers company and approved personal devices, user accounts, passwords and authentication, networks, internet and email, messaging and collaboration tools, software and cloud services, file transfers and removable media, remote access, social media, artificial intelligence tools, monitoring and logging, incident reporting, personal use, after-hours use and policy breaches. Any activity not expressly permitted must be approved in writing by the Policy Owner before it occurs.

• New South Wales — Apply Workplace Surveillance Act 2005 sections 10 and 12 before commencing employee computer surveillance.
• Australian Capital Territory — Apply Workplace Privacy Act 2011 sections 13, 14 and 16, including consultation and detailed logging disclosures.
• other Australian states and territories — Check local surveillance-devices, privacy, listening-device and employment laws before relying on the policy.

The organisation may conduct lawful, proportionate monitoring of company systems, accounts, devices, networks and services for security, compliance, operational, investigation and legal purposes. Monitoring will only be conducted in accordance with applicable Commonwealth, state and territory law and any required prior notice or consultation. This policy does not authorise covert, unlimited or otherwise unlawful surveillance. A breach may result in proportionate action, but no outcome is automatic and the organisation will follow applicable employment law and a fair process.

• small business without a CISO — The owner or chief executive remains accountable and may nominate the IT provider or senior manager as Policy Owner.
• ISM-aligned organisation — Organisational-level cyber security documentation is approved by the CISO; system-specific documentation is approved by the system authorising officer.

Policy Owner: [role]. Approver: [owner, chief executive, board or delegated executive]. The Policy Owner is responsible for implementation, questions, exceptions, training, monitoring of effectiveness and review. HR must review employment and disciplinary provisions, and suitably qualified privacy or legal advice must be obtained before introducing or materially changing workplace surveillance.

• business using employees, contractors and labour-hire workers — Include every user group in induction, access provisioning, acknowledgement and offboarding.
• remote or hybrid workforce — Use scenario training for home networks, personal devices, shared workspaces, cloud file transfer and after-hours separation.

Access to company systems and information is conditional on the user receiving this policy, completing required training and acknowledging that they understand and will comply with it. Users must ask the Policy Owner before taking an action they are unsure about and must immediately report suspected mistakes, security events, loss, unauthorised access or disclosure. The organisation will notify affected users of material policy changes and may require renewed acknowledgement or training.

• Privacy Act-covered business — The APPs apply when the business handles personal information through AI, including collection, use, disclosure and accuracy.
• business adopting general-purpose AI — Use an approved-tool list, use-case assessment, AI register, human oversight and incident process.

Users may only use artificial intelligence tools, accounts and use cases approved by the organisation. Unless expressly authorised for a protected enterprise service, users must not enter or upload personal information, sensitive information, confidential or client information, credentials, source code, security details, commercially sensitive material or legally privileged content. AI output must be checked by a competent person before it is relied on, sent, published or used to make or support a decision. Any accidental input, upload or disclosure must be reported immediately.

• ISM-aligned organisation — Review at least annually and record the current-as-at date.
• NSW or ACT employer changing surveillance — Assess whether a new notice period, revised policy and ACT consultation are required before implementation.

The Policy Owner must review this policy at least annually and whenever there is a material change to law, technology, business operations, workforce arrangements, monitoring, artificial intelligence use, information handling or threat conditions. An off-cycle review is also required after a material incident, audit finding, repeated breach or control failure. Every approved version must show its approval date, current-as-at date, owner and next review date, and material changes must be communicated before they take effect.

• multi-state employer — Use a national core policy plus jurisdiction-specific surveillance notices or schedules.
• small business with informal IT practices — Document personal-use, personal-account, device, file-transfer and AI boundaries instead of relying on unwritten expectations.

Nothing in this policy gives the organisation an unlimited right to monitor a person, device, account or communication. Monitoring, access to records and use of evidence must be authorised, necessary for a legitimate purpose, proportionate, restricted to appropriate personnel and conducted under applicable law and notice requirements. Possession of a work device or account does not, by itself, require a user to monitor or respond to contact outside working hours.

• small business employer under the Fair Work Act — Check the Small Business Fair Dismissal Code and obtain advice before dismissal.
• business with an incident-response plan — Run containment and evidence preservation through the incident process before deciding employment consequences.

Suspected breaches will be assessed according to their nature, seriousness, intent, risk, actual or potential harm, the user’s training and prior conduct, consistency with comparable cases and any mitigating circumstances. The organisation may take proportionate action including guidance, retraining, removal of access, a warning, disciplinary action or termination of employment or engagement. No outcome is automatic. The user will be informed of the substance of the allegation and given a reasonable opportunity to respond before a final disciplinary decision, except where immediate protective action is reasonably necessary.

This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.