Acceptable-use policy template
[!NOTE] This is a generic starting point, not legal advice. Replace every bracketed field, and get legal, privacy, security, and HR review for your deployment before you publish it.
[Organisation name] email acceptable-use policy
- Version: [version]
- Effective date: [date]
- Policy owner: [role or team]
- Report concerns: [private contact or reporting process]
1. Purpose
This policy sets out acceptable use of email accounts, personal mailboxes, shared mailboxes, and related records operated by [Organisation name] through [mail domain].
2. Scope
This policy applies to every user, administrator, contractor, service account, and system that accesses or sends mail through the service.
3. Acceptable use
You may use the service for lawful, authorised communication connected with your role. You must:
- communicate honestly, respectfully, and professionally;
- identify yourself and your organisation accurately;
- protect confidential and personal information;
- use only your approved mailboxes and sender addresses;
- follow applicable consent, marketing, privacy, retention, and records rules;
- report suspected compromise, misdelivery, or abuse promptly.
4. Prohibited use
You must not:
- send spam, or use scraped, purchased, or unauthorised recipient lists;
- phish, impersonate, defraud, threaten, harass, or distribute unlawful content;
- distribute malware, or send intentionally unsafe attachments or links;
- bypass authentication, authorisation, audit, retention, or delivery controls;
- disclose personal, confidential, regulated, or privileged information without authority;
- send as an organisation address through an unapproved service;
- access another user's or mailbox's information without a valid assignment and purpose;
- interfere with service availability or another user's work.
5. Shared mailboxes
You get shared-mailbox access based on operational need, and you may do only what your assigned permission — read, send-as, or full — allows. Your access must be reviewed when your responsibilities change, and removed promptly when no longer needed.
6. Security responsibilities
You must protect your identity-provider account, use multi-factor authentication where required, keep your devices reasonably secure, and never share sessions or credentials. Report suspected account compromise through [security process].
7. Privacy, monitoring, and records
The service records message metadata and administrative activity needed to operate, secure, and govern the system. [Organisation name] sets out what is collected, who can access it, how long it is kept, and how lawful requests are handled in its privacy and records policies.
You should not expect organisational mail to be private from authorised operational, legal, security, or compliance review, subject to applicable law and policy.
8. Deliverability and fair use
You must send only volumes appropriate to authorised activity, and respect opt-out, complaint, and correction requests. [Organisation name] may limit or suspend activity that threatens domain reputation, provider standing, service capacity, or recipient safety.
9. Enforcement
Suspected breaches are reviewed fairly and proportionately. Responses may include guidance, access restriction, mailbox suspension, disciplinary or contractual action, preservation of evidence, or referral to relevant authorities. Emergency containment may happen before a full review, when needed to protect people, data, or service availability.
10. Reporting
Report suspected abuse, privacy incidents, misdirected mail, compromised accounts, or unsafe requests through [private reporting process]. Good-faith reports are protected from retaliation.
11. Changes and acknowledgement
Material changes are versioned and communicated. You may need to acknowledge a new version before you can keep using mail.
Acknowledgement
I confirm that I have read and understood this policy and agree to follow it while using [Organisation name] email services.