IT, communications and social media policy

You should use this document if you employ staff who use your business’s IT devices and/or communication systems, including social media. It will help you to set a clear framework for using that hardware and software, helping you to ensure that they are used both securely and professionally.

If you plan on monitoring your staff member’s online activity or use of their communication systems, you should use this policy to make sure they are aware of this before you begin any monitoring. This will help you to comply with your data protection obligations.

Make sure you review this policy regularly and ensure it is updated if you start using any new IT or communications systems.

This policy sets out your business’s general rules regarding the use of IT equipment, communications systems and social media. This includes:

• measures that must be taken to ensure both the cyber security and physical security of equipment, including who suspicious incidents should be reported to;

• acceptable use of equipment, including to what extent systems may be accessed for personal use;

• applicable standards when communicating on behalf of the business, including via social media;

• the extent to which your business may monitor use of its equipment and communication systems; and

• consequences of breaching the policy.

Although you’re not legally obliged to have an IT, communications and social media policy it is best practice to put one in place to help to ensure that the security of your systems is not compromised. Equally, if you will be monitoring your staff members’ use of your IT and communication systems, in nearly all cases you must make them aware of this before you carry out any monitoring. This is a requirement under data protection law, breach of which could lead to significant fines for your business and/or your staff member suing you for invasion of their privacy. This policy will help you to comply with your legal obligations by alerting your staff to the possibility of them being monitored.

This policy will also help to ensure that professional standards are maintained when your staff are communicating on your behalf, including through social media channels.

For guidance about other HR policies that your business should put in place when you take on staff, see our Q&A on HR policies.

For information about your data protection obligations when you are monitoring your staff, see data protection issues when monitoring staff.

If you need a general staff privacy notice to let your staff know how you are processing their personal data during their employment by you, use our template staff privacy notice.

If you want to produce an entire staff handbook, which contains a copy of this policy, see our template staff handbook.