IT acceptable use policy: contents, legal value and the security policy
The IT acceptable use policy sets the rules users follow on the organisation's digital tools. What it contains, how a French employer makes it binding, and how it differs from the security policy.
An IT acceptable use policy (in France, a charte informatique) sets the rules users follow on the organisation's digital tools: what is allowed, what is forbidden, what the employer monitors and what happens when the rules are broken. No law requires one, but without it, monitoring IT use lawfully or sanctioning abuse is difficult. To have legal effect in France, it must follow the procedure for the internal rules (règlement intérieur). This article covers its contents, its legal value and how it sits alongside the information security policy.
IT acceptable use policy: definition and purpose
It is also called an IT charter, an information systems charter or a user charter. The idea is the same: a short text, written for non-specialists, that tells everyone how to use the organisation's computers, phones, email, applications and data.
It does three jobs at once:
- Protect the information system: many incidents start with a user action (a reused password, an opened attachment, a tool installed without approval). The policy makes the right reflexes explicit.
- Set rights and duties: whether personal use is tolerated, which software is approved, rules when working remotely, what to do when leaving the company.
- Inform staff about monitoring: the French Labour Code forbids collecting information about an employee through a system they were not told about beforehand (Article L1222-4). The policy is the natural place to describe the logs, filters and monitoring tools in place.
In 2017, ANSSI, the French national cybersecurity agency, published a guide to drafting such a charter in eight key points, aimed at small and mid-sized companies. It presents the charter as a basic step towards a culture of digital risk prevention, covering employees as well as partners and subcontractors who use your tools.
What goes into an acceptable use policy?
There is no mandatory official template. A useful policy usually covers the following sections, adapted to your tools and risks:
| Section | What it says |
|---|---|
| Scope | Who is covered (employees, interns, temporary staff, contractors) and which resources (computers, mobiles, email, applications, remote access). |
| Access and credentials | Personal, non-shared accounts, password rules, multi-factor authentication, session locking. |
| Devices | Use of computers and phones, removable media, personal devices (the CNIL has published good practices for BYOD), loss or theft. |
| Email and internet | Whether reasonable personal use is tolerated, how to mark a message as personal, forbidden sites and content. |
| Software and online services | No installing software or signing up to online services without approval, to prevent shadow IT; rules for generative AI tools (see shadow AI). |
| Data | Confidentiality, classification levels, approved storage, personal data, sharing outside the organisation. |
| Mobility and remote work | Connecting from outside, public networks, keeping screens and conversations private. |
| Incidents | Whom to alert and how when a message looks suspicious, equipment is lost or a computer behaves oddly. |
| Monitoring | What is logged or filtered, why, for how long, who has access, and how to exercise one's rights. |
| Sanctions and entry into force | Reference to the scale of sanctions in the internal rules, date of entry into force, review. |
| Leaving | Returning equipment, what happens to data and accounts, retrieving personal files. |
Do not copy the security policy or the administration procedures into it: users do not need to know how the firewalls are configured. A few pages with examples get read; thirty pages do not.
Legal value in France: when is the policy binding?
This is the question that matters: a policy sent by email informs staff, but on its own it does not allow an employer to sanction someone who ignores it. Everything depends on the link with the internal rules.
The internal rules regime
Internal rules are mandatory in French companies and sites with at least 50 employees (Article L1311-2). Among other things, they set general and permanent rules on discipline and the nature and scale of sanctions (Article L1321-1). The Labour Code treats service notes and any other document that lays down general and permanent obligations in these areas as addenda to the internal rules (Article L1321-5). A charte that forbids, requires and refers to sanctions is one of them: it follows the same regime, and the Code states that such documents remain subject to it in all cases.
The procedure
Under Article L1321-4, as in force in October 2026:
- the text is submitted to the works council (CSE) for an opinion before it is introduced;
- it is sent to the labour inspectorate, together with that opinion, at the same time as it is made known to employees;
- it states its date of entry into force, which must be at least one month after publication;
- the same rules apply to every amendment or removal of a clause.
If the policy describes tools for monitoring employees' activity, the works council of a company with at least 50 employees must also be informed and consulted before they are introduced (Article L2312-38). Both consultations can be held together.
What about smaller organisations?
Below 50 employees, internal rules are not mandatory. The charte is then usually handed to each user for signature, or annexed to the employment contract. ANSSI's guide points out that, to be enforceable, it must be accepted by users or annexed to the internal rules, after consulting staff representatives. The right set-up depends on your situation: have it checked by an employment lawyer, especially if you intend to rely on it for sanctions.
Contractors and temporary staff are not your employees: for them, the policy applies through the contract, with a clause in the service agreement or the security assurance plan and individual acceptance before access is granted.
Acceptable use and employee monitoring: the CNIL's position
The policy does not authorise everything. The monitoring it announces must respect the principle in Article L1121-1: any restriction on employees' rights must be justified by the task and proportionate to its purpose. The CNIL, France's data protection authority, draws several practical rules from this in its guidance on IT tools at work:
- Reasonable personal use of work tools is tolerated as long as it harms neither security nor productivity. The employer sets the limits and makes them known.
- Messages are presumed to be professional, but the employer cannot freely open those an employee has marked as personal (for example “Personal” or “Private” in the subject line or a folder with that name), even if personal use is banned. The policy should explain how to mark them.
- Some tools are excessive: automatically receiving a copy of every employee message, or installing a keylogger without an exceptional security reason.
- Information comes first: employees must know the purpose of the system, its legal basis, who receives the data, how long it is kept and their rights. The CNIL accepts that this information can be given through a charter, annexed to the internal rules or not, a service note or an individual note.
Monitoring involves processing personal data: it belongs in the record of processing activities and, depending on its scale, may require a data protection impact assessment (DPIA). Involve the data protection officer (DPO) from the drafting stage. The CNIL's page on monitoring employees' activity gives further examples of what is and is not allowed.
Acceptable use policy versus information security policy
The two documents are often confused. They complement each other: the security policy sets the direction for the whole organisation, and the acceptable use policy draws from it the rules that apply to each user.
| Information security policy | Acceptable use policy | |
|---|---|---|
| Audience | The whole organisation, first of all management, IT and security teams | Every user of digital tools |
| Contents | Objectives, organisation, responsibilities, security rules by domain | Everyday rights, duties and prohibitions, monitoring and sanctions |
| Written by | The CISO, approved by management | The CISO with HR, legal and the DPO |
| Force | Management commitment, reference for audits | Disciplinary force in France once it follows the internal rules procedure |
| In ISO 27001 | Information security policy and topic-specific policies | Annex A control 5.10, acceptable use of information and other associated assets |
In an information security management system (ISMS) under ISO 27001, the acceptable use policy is evidence for the control on acceptable use of assets, and publishing it contributes to the awareness the standard requires. Our article on the information security policy details the template and how to write the policy itself.
Writing and maintaining an acceptable use policy in six steps
- Start from the security policy and the risks. Every rule should address an identified risk or a rule in the security policy. A prohibition without a reason will be worked around.
- Bring the right people together. The CISO or IT for the substance, HR and legal for the procedure and sanctions, the DPO for monitoring, a few users to check the text is understandable.
- Keep it short and concrete. Plain sentences, examples (“do not forward a client document to your personal email”), links to detailed procedures.
- Follow the procedure. Works council opinion, notice to the labour inspectorate, publication, one-month delay; consultation on any new monitoring tools.
- Make it known. Hand it over at onboarding, recall it during security awareness training, keep it on the intranet. A policy signed and forgotten changes no behaviour.
- Review it and check it is applied. New uses (generative AI, remote work, new collaboration tools), incidents, changes to the security policy: plan at least a yearly review, and check regularly that the key rules are followed, in a continuous compliance approach.
To track these rules as requirements in their own right, you can load your security policy and acceptable use policy into Phinasoft's frameworks and knowledge bases module and use them in compliance campaigns over time.
Summary
A document for users
The acceptable use policy turns the security policy into practical rules: access, devices, email, software, data, incident reporting, monitoring and sanctions.
Binding if it follows the procedure
As soon as it sets disciplinary obligations, a French charte follows the internal rules regime: works council opinion, notice to the labour inspectorate, publication, entry into force one month later.
A way to inform staff about monitoring
The French data protection authority (CNIL) accepts the policy as a way to tell employees about monitoring. Monitoring itself must stay proportionate and be put to the works council first.
Frequently asked questions
What is an IT acceptable use policy?
It is the document that sets, for users, the rules for using the organisation's IT resources and digital tools: access and passwords, devices, email and internet, approved software, data protection, incident reporting, the monitoring in place and the sanctions for breaches. In France it is usually called a charte informatique.
Is an acceptable use policy mandatory in France?
No law requires one as such. However, an employer that wants to regulate the use of IT tools in a binding way and monitor that use must inform employees and follow the internal rules procedure for disciplinary rules: the charte is the simplest way to do both.
How does a French employer make the policy binding?
When it contains general and permanent disciplinary obligations, the charte is treated as an addendum to the internal rules (Article L1321-5 of the French Labour Code). It must then be submitted to the works council for an opinion, sent to the labour inspectorate and made known to staff, and it only comes into force at least one month after publication (Article L1321-4).
Must the works council be consulted?
Yes, whenever the charte falls under the internal rules. In addition, in companies with at least 50 employees the works council (CSE) must be informed and consulted before any tool or technique for monitoring employees' activity is introduced (Article L2312-38), which the charte usually describes.
Can an employer read employees' emails?
Messages sent or received with the work mailbox are presumed to be professional. According to the CNIL, however, the employer cannot freely open messages an employee has clearly marked as personal, for example with “Personal” or “Private” in the subject line, even if personal use of work tools is banned.
How does it differ from the information security policy?
The information security policy is addressed to the whole organisation and sets security objectives, responsibilities and rules; management approves it. The acceptable use policy is shorter, addressed to users, and sets out the rules that concern them, with their rights and duties; in France it has disciplinary force once it follows the internal rules procedure.
Sources (12)
- Code du travail — article L1311-2 (règlement intérieur obligatoire à partir de 50 salariés)
- Code du travail — article L1321-1 (contenu du règlement intérieur)
- Code du travail — article L1321-4 (avis du CSE, inspection du travail, entrée en vigueur)
- Code du travail — article L1321-5 (notes de service et autres documents assimilés)
- Code du travail — article L1121-1 (restrictions justifiées et proportionnées)
- Code du travail — article L1222-4 (information préalable sur les dispositifs de collecte)
- Code du travail — article L2312-38 (consultation du CSE sur les moyens de contrôle)
- CNIL — Les outils informatiques au travail
- CNIL — Le contrôle de l'activité des personnes employées
- CNIL — BYOD : quelles sont les bonnes pratiques ?
- ANSSI — Charte d'utilisation des moyens informatiques et des outils numériques, guide d'élaboration en 8 points clés pour les PME et ETI, juin 2017
- France Num — Charte d'utilisation des moyens informatiques et des outils numériques
A platform and service that adapt to you
Our platform is designed for fine-tuned configuration and broad adaptability to your needs.