Acceptable Use Policy Template with Employee Monitoring Clause (2026 Edition)

Why Does an AUP Need a Dedicated Monitoring Clause?

Most generic acceptable use policy templates cover permitted and prohibited computer uses, but omit the monitoring disclosure that transforms an AUP from a usage policy into a legally defensible monitoring notice. That omission creates a specific legal gap: courts have held that employers who monitor activities not explicitly described in advance may face privacy tort claims even on company-owned systems.

The Electronic Communications Privacy Act (ECPA) permits employer monitoring on company networks with a legitimate business purpose, but places the evidentiary burden on the employer to demonstrate that employees had advance notice. A written AUP with a monitoring clause is the most direct way to satisfy that burden. According to a 2025 Littler Mendelson survey, 61% of employment attorneys reported that the absence of a written monitoring policy was a contributing factor in at least one client lawsuit in the prior 24 months.

For EU employers, GDPR Article 13 requires that organizations inform employees about automated processing activities at the time data is first collected. Article 88 permits member states to set more specific rules for employee data, which most EU countries have done through works council consultation requirements, Data Protection Impact Assessment (DPIA) obligations, and proportionality constraints. An AUP with a monitoring clause that addresses Article 13 disclosure satisfies the transparency requirement that underpins most EU monitoring enforcement actions.

The template on this page is designed to cover both frameworks in a single document, with jurisdiction-specific commentary guiding employers on where to add or modify language based on where their employees work.

Complete Acceptable Use Policy Template with Monitoring Clause

The following template is ready to copy, customize, and distribute. Every section includes a brief legal commentary note (in italics, inside brackets) explaining the legal purpose of that section. Remove all commentary notes before distributing the final document to employees.

ACCEPTABLE USE POLICY — ELECTRONIC SYSTEMS AND EMPLOYEE MONITORING

[ORGANIZATION NAME]
Policy Number: [XXX-XX]
Effective Date: [DATE]
Last Revised: [DATE]
Approved By: [NAME, TITLE]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 1: SCOPE AND PURPOSE

1.1 Purpose

This Acceptable Use Policy ("Policy") establishes the rules governing employee
use of electronic systems, devices, and networks owned or operated by
[ORGANIZATION NAME] ("Company"). It also provides advance notice of the
Company's electronic monitoring practices on Company systems.

[Legal note: Stating "advance notice of monitoring" in the purpose section
establishes that the document serves as monitoring notice, which satisfies
ECPA's notification requirement and state statutes in Connecticut, New York,
and Delaware that require written notice before electronic monitoring begins.]

1.2 Scope

This Policy applies to:
  (a) All employees, contractors, consultants, temporary workers, and
      other personnel ("Covered Persons") who access Company systems.
  (b) All devices, networks, servers, applications, email accounts,
      and communication platforms owned, leased, or operated by the Company
      ("Company Systems"), whether accessed from a Company facility, a
      remote location, or while traveling.
  (c) Any personal device used to access Company Systems, Company email
      accounts, or Company data networks ("Personal Devices").

[Legal note: Explicitly including personal devices in scope is critical if
you conduct any monitoring on BYOD devices. Monitoring a personal device
that is not listed in scope exposes the Company to wiretapping claims under
ECPA Title I. If you do not monitor personal devices at all, remove clause (c).]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 2: PERMITTED USES OF COMPANY SYSTEMS

Covered Persons may use Company Systems for:

  (a) Conducting work directly related to their job duties and responsibilities.
  (b) Limited personal use that does not interfere with work performance,
      violate this Policy, or consume excessive Company resources.
  (c) Professional development activities approved by a manager or HR.
  (d) Communications necessary to perform job functions.

[Legal note: Explicitly permitting limited personal use is recommended because
it prevents employees from arguing that any personal use on a company device
constitutes a waiver of the employer's right to monitor. Courts have held that
allowing some personal use does not eliminate the employer's monitoring rights
when a clear written policy is in place.]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 3: PROHIBITED USES OF COMPANY SYSTEMS

Covered Persons may NOT use Company Systems for:

  (a) Accessing, downloading, storing, or transmitting content that is
      sexually explicit, obscene, harassing, or discriminatory.
  (b) Engaging in activities that violate federal, state, or local law,
      including unauthorized copying or distribution of copyrighted material.
  (c) Installing unauthorized software, applications, or browser extensions
      on Company devices without IT department approval.
  (d) Sharing, transferring, or storing Company confidential information
      on personal cloud storage, personal email, or unapproved third-party
      platforms.
  (e) Accessing or attempting to access systems, networks, or data for
      which the Covered Person has not been granted authorization.
  (f) Conducting outside business activities or self-employment on Company
      time or using Company resources.
  (g) Gambling, gaming, or streaming entertainment content during work hours
      unless expressly approved by a manager for business purposes.
  (h) Accessing or using Company Systems in a manner intended to circumvent
      monitoring, logging, or security controls (including use of VPNs,
      proxy servers, or anonymization tools not approved by IT).
  (i) Sending communications that are threatening, defamatory, or that
      constitute workplace harassment.
  (j) Using Company accounts or systems to engage in political activity,
      campaigning, or fundraising unrelated to Company-approved programs.

[Legal note: Clause (h) prohibiting circumvention of monitoring tools is
important for organizations that have experienced employees using VPNs or
browser extensions to avoid detection. Making circumvention a policy violation
subjects it to disciplinary action independent of what the underlying behavior was.]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 4: MONITORING DISCLOSURE AND NO EXPECTATION OF PRIVACY

4.1 Monitoring Disclosure

THE COMPANY RESERVES THE RIGHT TO MONITOR, ACCESS, REVIEW, AUDIT, AND
DISCLOSE ALL ACTIVITY, COMMUNICATIONS, AND DATA TRANSMITTED, STORED, OR
ACCESSED ON COMPANY SYSTEMS. EMPLOYEES HAVE NO EXPECTATION OF PRIVACY WITH
RESPECT TO THEIR USE OF COMPANY SYSTEMS.

Monitoring includes but is not limited to:

  (a) Application usage: which applications are open, active, or idle,
      and the duration of use for each application.
  (b) Website visits: URLs visited during work hours on Company devices
      or Company networks, including browsing history and search queries
      made through Company accounts.
  (c) Email communications: metadata (sender, recipient, timestamp, subject
      line) and content of email sent or received on Company email accounts.
      [Note: Remove "and content" if your organization does not read email
      content, only metadata. Accuracy is required.]
  (d) Screen activity: periodic or continuous screenshots or screen recordings
      captured on Company devices during work hours.
      [Remove this item if you do not use screenshot monitoring.]
  (e) Time tracking: records of active work time, idle time, login and logout
      times, and application focus time used for payroll and productivity
      analysis.
  (f) File access and transfers: logs of files accessed, created, modified,
      deleted, or transferred on Company systems or to external storage.
  (g) Network traffic: metadata of network activity on Company networks,
      including connection logs and bandwidth usage.
      [Note: This covers network metadata, not content of encrypted traffic,
      unless your organization uses a TLS inspection proxy. Adjust accordingly.]
  (h) Keyboard and mouse activity: aggregate activity metrics indicating
      whether a device is in active use. [Remove if not applicable.]

4.2 Scope of Monitoring

Monitoring is conducted on Company-owned or Company-operated systems only,
during established work hours. The Company does not intentionally monitor
personal devices, personal email accounts, personal social media accounts,
or off-duty activities on personal networks, except where Personal Devices
are used to access Company Systems or Company accounts.

[Legal note: This scope limitation is important under GDPR (proportionality
under Article 5(1)(c)) and under US state law frameworks that require
monitoring to be reasonably related to a legitimate business purpose.
Do not remove this limitation; it demonstrates proportionate monitoring.]

4.3 Purpose of Monitoring

The Company conducts electronic monitoring for the following legitimate
business purposes:

  (a) Protecting confidential Company information and trade secrets from
      unauthorized disclosure or exfiltration.
  (b) Ensuring compliance with applicable laws, regulations, and industry
      standards (including HIPAA, SOX, PCI-DSS, and applicable state laws,
      as relevant to the Company's operations).
  (c) Maintaining the security and integrity of Company networks, systems,
      and data against malware, intrusion, and unauthorized access.
  (d) Verifying accurate recording of work hours for payroll, billing,
      and compliance purposes.
  (e) Measuring and managing employee productivity in accordance with
      performance management practices.
  (f) Investigating alleged violations of this Policy or other Company
      policies.

[Legal note: Listing specific business purposes is required under GDPR
Article 13(1)(c) and is recommended for US employers to establish legitimate
business purpose under ECPA. Courts evaluate whether monitoring is
proportionate to its stated purpose. Vague justifications ("to improve
operations") are regularly challenged in litigation.]

4.4 Data Retention

Monitoring data is retained for [INSERT RETENTION PERIOD, e.g., 90 days]
for routine productivity monitoring. Data associated with open investigations,
litigation holds, or regulatory inquiries is retained until the matter is
resolved. Data is stored on secure Company or third-party servers with
access restricted to authorized personnel only.

[Legal note: GDPR Article 5(1)(e) requires that personal data not be kept
longer than necessary. Specifying a retention period in the policy satisfies
this requirement. For US employers, retention periods should be consistent
with your litigation hold policy and any applicable industry regulations.]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 5: CONSENT AND ACKNOWLEDGMENT

5.1 Consent

By accessing Company Systems, each Covered Person acknowledges that they
have read, understood, and agreed to the terms of this Policy, including
the monitoring practices described in Section 4. Use of Company Systems
after distribution of this Policy constitutes implied consent to monitoring
as described herein.

5.2 State-Specific Notice (US Employees)

  Connecticut Employees: Pursuant to Conn. Gen. Stat. Section 31-48d, the
  Company is required to provide advance written notice that it may monitor
  electronic devices and systems. This Policy constitutes that written notice.
  A copy of this notice will be posted in a conspicuous location at the
  Company's Connecticut workplaces.

  New York Employees: Pursuant to New York Labor Law Section 52-c (SWEM Act,
  effective May 7, 2022), the Company provides notice that it monitors
  telephone conversations, email, and internet access or usage on Company
  systems. This Policy constitutes written notice as required by the Act.
  New York employees will receive a separate written acknowledgment at the
  time of hire.

  Delaware Employees: Pursuant to 19 Del. C. Section 705, the Company
  provides advance notice that electronic monitoring of Company systems
  occurs. This Policy constitutes that notice. An electronic notice will
  also be displayed at the first login to Company systems.

  California Employees: Pursuant to the California Privacy Rights Act
  (CPRA), the Company provides this Notice at Collection describing the
  categories of personal information collected through monitoring, the
  business purpose for collection, and your rights under CPRA including
  the right to access, correct, and delete personal information.
  Contact [privacy@yourcompany.com] to exercise CPRA rights.

5.3 EU and UK Employee Notice (GDPR / UK GDPR)

  For employees subject to GDPR or UK GDPR, the Company processes
  monitoring data under the lawful basis of legitimate interests
  (Article 6(1)(f) of the GDPR) in protecting Company assets, maintaining
  network security, and managing workforce productivity, having conducted
  a Legitimate Interests Assessment (LIA). A Data Protection Impact
  Assessment (DPIA) has been completed where required by Article 35.

  EU and UK employees have the following rights regarding monitoring data:
    - Right of access (Article 15): request a copy of monitoring data held.
    - Right to restriction (Article 18): request processing be restricted
      in certain circumstances.
    - Right to object (Article 21): object to processing based on legitimate
      interests where personal circumstances justify it.

  Contact [dpo@yourcompany.com] or our Data Protection Officer for data
  subject rights requests.

[Legal note: GDPR Article 88 permits EU member states to adopt more specific
rules. Germany requires works council agreement before monitoring deployment
(Betriebsverfassungsgesetz). France requires CNIL notification. The Netherlands
requires works council consultation. If you have employees in these countries,
additional steps beyond this policy are required.]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 6: VIOLATION CONSEQUENCES

Violations of this Policy may result in disciplinary action up to and
including termination of employment or the applicable service agreement.
The Company reserves the right to report violations to law enforcement
where the conduct may constitute criminal activity.

Specific violation tiers:

  Category A (Minor Violations): Informal counseling and written warning.
    Examples: Excessive personal use of social media during work hours;
    installing unauthorized browser extensions.

  Category B (Moderate Violations): Formal written warning or suspension.
    Examples: Accessing prohibited content; installing unauthorized software.

  Category C (Severe Violations): Immediate termination and possible
    legal referral.
    Examples: Attempting to circumvent monitoring controls; unauthorized
    transfer of Company confidential data; accessing systems without
    authorization.

Nothing in this Policy limits the Company's right to seek civil or criminal
remedies for violations that constitute theft, fraud, or computer crimes
under applicable law.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 7: POLICY UPDATES

The Company reserves the right to modify, suspend, or terminate this Policy
at any time. Material changes to the scope of monitoring or the categories
of data collected will be communicated to Covered Persons with at least
[INSERT NOTICE PERIOD, e.g., 14 days] advance notice, except where an
immediate change is required for security or legal reasons. Continued use
of Company Systems after a policy update constitutes acceptance of the
revised terms.

Policy Revision Log:
  Version 1.0 — [DATE] — Initial policy
  Version [X.X] — [DATE] — [Description of change]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 8: EMPLOYEE ACKNOWLEDGMENT SIGNATURE BLOCK

I, the undersigned, acknowledge that:

  1. I have received a copy of the [ORGANIZATION NAME] Acceptable Use Policy
     (Version [X.X], dated [DATE]).

  2. I have read and understand the Policy, including the monitoring
     disclosure in Section 4 stating that Company Systems are monitored
     and that I have no expectation of privacy on Company Systems.

  3. I understand that violations of this Policy may result in disciplinary
     action up to and including termination of employment.

  4. I understand that this Policy may be updated and that I will be
     notified of material changes.

  [For New York employees only:]
  I acknowledge receipt of the notice required by New York Labor Law
  Section 52-c (SWEM Act) that the Company monitors telephone conversations,
  email, and internet access or usage on Company systems.

Employee Full Name (print): ___________________________________

Employee Signature: ___________________________________

Date: ___________________________________

Employee ID / Personnel Number: ___________________________________

Department: ___________________________________

Manager Name: ___________________________________

HR Representative Signature: ___________________________________

Date Received by HR: ___________________________________

What to Do After You Deploy the AUP

Deploying the AUP is the legal foundation. The monitoring program itself requires additional steps to ensure ongoing compliance. Here is the sequence organizations should follow after distributing and collecting signed acknowledgments.

Pair the AUP with a Consent Form

The AUP and the employee acknowledgment serve different functions. The AUP is the policy document. The signed acknowledgment form (Section 8 of the template) is the proof of notice. Some organizations use a standalone consent form as a separate one-page document for simplicity. The employee monitoring consent form template on this site provides a standalone version that references the AUP by name and version number.

Configure Your Monitoring Tool to Match the Policy

Every monitoring activity listed in your AUP must be active in your monitoring software configuration, and conversely, no monitoring activity should be active in the software that is not listed in the AUP. A mismatch between what the policy says and what the tool does is a legal liability. When configuring eMonitor features, use the AUP as a checklist: if screen capture is enabled, it must appear in Section 4(d). If it is not enabled, remove it from the template to avoid over-disclosure that creates confusion.

Communicate the Policy Before Activation

The monitoring communication plan template provides a step-by-step framework for notifying your workforce before monitoring tools go live. Communication best practice includes a manager briefing one week before launch, an all-hands or department-level communication three days before launch, and a FAQ document (using the employee FAQ template) distributed at the same time as the AUP.

Review and Update the AUP Annually

Employee monitoring law changes frequently at the state and federal level. The annual monitoring program review checklist includes a legal update review step covering new state statutes, federal agency guidance, and case law developments. Review the AUP at minimum once per year, and re-distribute to employees whenever monitoring scope, tools, or applicable law changes materially.

Related Policy Templates and Compliance Resources

An AUP with a monitoring clause is one component of a complete monitoring compliance program. The following resources cover the other components:

• Employee monitoring policy template: The broader workplace monitoring policy that this AUP monitoring clause feeds into, covering data governance, access controls, and grievance procedures.
• Digital nomad monitoring policy template: Extends the AUP framework to employees who work across international borders, with a country-by-country permissibility matrix.
• GDPR employee monitoring compliance guide: Detailed coverage of Article 13 disclosures, DPIA requirements, legitimate interests assessments, and works council consultation requirements by EU member state.
• Employee monitoring legal guide 2026: Federal and state law overview covering ECPA, state electronic monitoring statutes, NLRA collective bargaining requirements, and industry-specific regulations.
• Employee monitoring consent form: The standalone acknowledgment document to pair with this AUP.
• Data retention policy template: Specifies retention periods by data category, consistent with the retention language in this AUP.