Acceptable use and BYOD policy: what to include.

A guide, not legal advice

This article is a practical outline of what an acceptable use and bring-your-own-device (BYOD) policy usually covers. It is general information from an IT provider, not legal advice. Wording that touches employment terms, monitoring and personal data should be reviewed by a qualified legal adviser before you issue it. For the data-protection background, see our UAE PDPL basics for business.

Why have one

A written policy turns unspoken expectations into something staff can read, sign and be reminded of. It helps when an incident occurs, when you need to explain a decision to an employee and when a customer or insurer asks how you manage risk. It also protects staff by making clear what the company can and cannot see.

1. Purpose and scope

State in a short paragraph why the policy exists: to protect company data, systems and people. Then say who it covers (employees, contractors, temporary staff) and what it covers (company laptops and phones, personal devices used for work, email, Teams, cloud storage, company Wi-Fi, social media when speaking for the company).

2. Acceptable use

Describe normal, expected behaviour in plain language.

• Use company systems mainly for work, with any limited personal use clearly defined.
• Keep passwords private, use multi-factor authentication and lock screens.
• Store company files in approved locations, not personal accounts.
• Install only approved software, and keep devices updated.

3. Prohibited use

List what is not allowed, without trying to cover every case. Typical items include sharing credentials, bypassing security controls, using unlicensed software, forwarding company data to personal email, accessing unlawful or offensive material, and connecting unapproved devices to the network. Add a general line that other misuse may also lead to action, and explain the consequences in line with your HR process.

4. Personal devices (BYOD)

This is the section most likely to cause friction, so be specific. Decide first whether personal devices are allowed at all, and for what: email only, or also files and chat. Then set conditions.

• A screen lock, current operating system updates and device encryption.
• Company data accessed through approved apps, not copied to local storage.
• Enrolment in a management profile or app protection, where you use one.
• What the company can do if the device is lost: normally remove company data only, not wipe personal content.
• Who pays for what, if anything, such as data plans or accessories.

Our mobile device management guide explains the technical controls behind these choices.

5. Monitoring and privacy transparency

If the company monitors systems, say so clearly. Describe what is logged (for example sign-in activity, email security scanning, web filtering), why, who can see it and how long it is kept. Be explicit about what is not monitored on personal devices. Plain, honest wording builds trust and avoids surprises. Check this section carefully with your legal adviser, because privacy and employment expectations apply to it.

6. Incident reporting

Staff should know exactly what to do when something goes wrong: a lost phone, a suspicious email, a clicked link, an unexpected prompt for credentials. Give one named contact or mailbox, ask for reports promptly and state that reporting in good faith will not be penalised. Fast reports limit damage far more than blame does. If you want round-the-clock monitoring behind this process, see managed cybersecurity and MDR.

7. Leaver process

Explain that when employment ends, access is removed, company data is removed from personal devices, and company equipment is returned. Link the policy to your offboarding steps so that HR, the line manager and IT act together. The onboarding and offboarding checklist covers the sequence.

Roles and responsibilities

Spell out who does what. Staff follow the rules and report problems. Managers make sure their teams have read the policy and raise leaver and role-change requests promptly. IT applies the technical controls and handles incidents. HR or management owns the policy itself and decides on any disciplinary matter. Short, named responsibilities stop issues falling between teams.

Keep the language readable. A policy full of dense clauses is signed and forgotten, while one written in clear sentences with a few real examples gets followed. Consider a one-page summary for new starters alongside the full document.

8. Acknowledgement and review

Ask every user to read and accept the policy when they join and when it changes. Name an owner, record the version and date, and review it at least once a year, and after any significant incident or technology change. A policy that nobody updates quickly stops matching reality.

Where to start

Draft the policy in plain English, test it with a few staff and then have it reviewed. The free IT health check shows which devices and accounts the policy needs to cover. Missan Global has supported UAE organisations since 2004.