IT Acceptable Use Policy
Template — South Africa
An attorney-drafted IT Acceptable Use Policy template designed specifically for South African workplaces. This comprehensive, legally compliant document governs employee use of company IT systems, networks, and devices — covering email and internet usage, BYOD arrangements, employer monitoring rights under RICA, data classification, cybersecurity responsibilities under the Cybercrimes Act 19 of 2020, POPIA-compliant data handling, and ECTA electronic communications compliance.
Drafted by qualified South African attorneys
Reviewed for compliance with current legislation · Last updated April 2026
Why Your Business Needs This Agreement
Ransomware Attacks Enabled by Employee IT Misuse
South Africa ranks among the top African countries targeted by ransomware attacks, with employee actions — clicking phishing links, downloading malicious attachments, installing unauthorised software — being the primary entry vector. Without a clear IT Acceptable Use Policy establishing security obligations, training requirements, and incident reporting procedures, the employer has no formal framework for preventing or responding to ransomware attacks. Average ransomware recovery costs for South African businesses exceed R5 million when downtime, data loss, and remediation are factored in.
POPIA Data Breaches from Uncontrolled Data Handling
Employees who store personal information on unsecured USB drives, forward client data to personal email accounts, or upload company files to personal cloud storage create uncontrolled copies of regulated data outside the employer's security perimeter. When these copies are compromised, the employer faces POPIA section 22 breach notification obligations, Information Regulator enforcement action with fines up to R10 million, and civil liability to affected data subjects. Without a data classification and handling policy, employees have no framework for understanding which data requires special protection.
Unlawful Monitoring Without RICA Compliance
Employers who monitor employee email, internet activity, or device usage without establishing themselves as "system controller" under RICA and without informing employees may be committing a criminal offence under RICA section 49. The IT Acceptable Use Policy is the mechanism that establishes the employer's lawful authority to monitor — without it, all monitoring evidence is potentially inadmissible and the employer faces prosecution. This is a critical gap that many South African employers have not addressed.
Software Piracy Liability for the Employer
When employees install pirated or unlicensed software on company systems, the employer faces vicarious liability under the Copyright Act 98 of 1978. The Business Software Alliance (BSA) actively investigates software piracy in South Africa, and settlements can run into millions of rands in licence fees, penalties, and legal costs. Without a policy prohibiting unauthorised software installation and establishing regular licence audits, the employer has no defence against BSA enforcement actions.
Cybercrimes Act Reporting Failure
Financial institutions and electronic communications service providers that fail to report certain cybercrimes to the SAPS within 72 hours under section 54 of the Cybercrimes Act face criminal prosecution. Without an IT Acceptable Use Policy that establishes incident reporting procedures aligned with the Cybercrimes Act, these organisations may miss mandatory reporting deadlines, creating regulatory exposure for the organisation and personal criminal liability for responsible officers.
What is a IT Acceptable Use Policy?
Company IT systems are the operational backbone of modern South African businesses, and their misuse exposes organisations to cybersecurity breaches, data protection violations, criminal liability, and significant financial losses. The legal landscape governing IT use in South Africa is shaped by four primary statutes: the Electronic Communications and Transactions Act 25 of 2002 (ECTA), the Protection of Personal Information Act 4 of 2013 (POPIA), the Cybercrimes Act 19 of 2020, and the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (RICA). Each imposes distinct obligations on employers and employees, and a failure to address any one of them creates legal exposure.
The Cybercrimes Act 19 of 2020, which became fully operational in phases from December 2021, is particularly significant for IT acceptable use. Section 2 criminalises the unlawful access of a computer system, section 3 criminalises the unlawful interception of data, section 5 addresses unlawful interference with a computer system, and section 7 criminalises cyber extortion. These offences carry penalties of up to 15 years' imprisonment. For employers, the Act creates both a shield (protecting company systems from employee misuse) and a sword (imposing obligations to report certain cybercrime offences under section 54, which requires electronic communications service providers and financial institutions to report certain offences to the South African Police Service within 72 hours).
RICA governs the employer's right to monitor employee communications. Section 6 permits an employer who is the "system controller" of a telecommunications system to monitor communications conducted on that system, provided the monitoring is for purposes related to the system controller's business and one of the parties to the communication has consented. The IT Acceptable Use Policy serves as the mechanism for establishing the employer as system controller and for providing the required consent framework. Without a policy establishing these elements, employer monitoring of email and internet usage may be unlawful under RICA, exposing the employer to criminal prosecution.
POPIA requires employers to process employee personal information lawfully, and monitoring of IT usage constitutes processing. Condition 2 (purpose specification) requires a clearly defined purpose for monitoring, Condition 3 (further processing limitation) restricts the use of monitoring data for purposes other than those specified, and Condition 7 (security safeguards) mandates appropriate technical measures to protect the personal information collected through monitoring. The employer's POPIA impact assessment should specifically address IT monitoring.
This attorney-drafted template provides a comprehensive framework covering email etiquette and retention policies, internet browsing restrictions and acceptable use, BYOD security requirements including mobile device management, the employer's monitoring rights under RICA with POPIA-compliant disclosure, data classification (public, internal, confidential, restricted) with handling requirements for each level, password management and multi-factor authentication, software installation and licence compliance, incident reporting procedures aligned with the Cybercrimes Act and POPIA breach notification requirements, removable media and cloud storage restrictions, and a disciplinary framework for IT policy violations aligned with LRA Schedule 8.
Who Needs This
Want early access to the IT Acceptable Use Policy template?
We'll email you the moment early access opens
The Cybercrimes Act 19 of 2020 imposes penalties of up to 15 years imprisonment for unlawful access to computer systems — employees who access restricted systems without authorisation face criminal prosecution
Without an IT Acceptable Use Policy establishing the employer as RICA "system controller," all monitoring of employee email and internet activity may be a criminal offence under RICA section 49
POPIA section 22 requires notification of data breaches to the Information Regulator within 72 hours — IT policies that establish incident reporting procedures are essential for meeting this deadline
The Business Software Alliance actively investigates software piracy in South Africa — employers whose staff install pirated software face settlements running into millions of rands
Ransomware recovery costs for South African businesses average R5 million+ when downtime, data loss, legal costs, and remediation are included — employee IT misuse is the primary attack vector
Key Clauses Included
This IT Acceptable Use Policy template covers 12 essential sections, each drafted by South African attorneys.
Scope, Definitions & IT Systems Covered
Defines all IT systems covered by the policy — hardware (desktops, laptops, tablets, smartphones, servers), software (operating systems, applications, cloud services), networks (LAN, WAN, Wi-Fi, VPN), communication systems (email, instant messaging, video conferencing), and data storage (on-premise, cloud, removable media). Establishes the categories of users subject to the policy and defines key terms such as "authorised use," "personal use," "IT resources," and "system controller" as referenced in RICA.
Email & Electronic Communications
Comprehensive rules for professional email conduct, the extent of permitted personal email use on company systems, email retention and archiving requirements aligned with ECTA section 15 evidence provisions, prohibition on forwarding confidential information to personal email accounts, auto-signature standards, prohibition on mass unsolicited emails, and the handling of suspicious emails and phishing attempts. Addresses the legal admissibility of email communications as evidence under ECTA.
Internet & Web Browsing
Defines permitted and prohibited website categories during work hours, streaming and bandwidth restrictions, download rules and file size limits, the employer's right to filter, block, or restrict access to certain content categories, the prohibition on accessing illegal content (including child exploitation material, which must be reported to the Film and Publication Board), and the logging of internet activity for security and compliance purposes.
BYOD — Bring Your Own Device
Comprehensive requirements for personal devices used for work purposes including minimum operating system and security standards, mandatory mobile device management (MDM) enrolment, remote wipe consent for company data, separation of personal and company data through containerisation, liability for device loss or theft, the process for de-provisioning when the employee leaves, and the employer's limitation to managing only company data and applications on personal devices.
Monitoring, Interception & Privacy
Establishes the employer as "system controller" under RICA section 6, defines the scope and purpose of monitoring (email, internet, file access, device usage), provides the required transparency notice under POPIA Condition 6, addresses the employee's limited expectation of privacy on company-owned systems, sets out the lawful basis for monitoring under POPIA section 11, and establishes the protocol for accessing monitoring data in disciplinary proceedings. Addresses the prohibition on covert monitoring except where serious misconduct is suspected.
Data Classification & Handling
Establishes four data classification levels — Public (freely distributable), Internal (not for external distribution), Confidential (restricted access, business-critical), and Restricted (highest sensitivity, legally protected) — with specific handling requirements for each level including storage locations, encryption requirements, transmission methods, access controls, and disposal procedures. Addresses POPIA classification of personal information and special personal information.
Password, Authentication & Access Management
Password complexity requirements (minimum 12 characters, mixed case, numbers, symbols), prohibition on password reuse and sharing, multi-factor authentication mandates for sensitive systems, session timeout settings, the employee's duty to report compromised credentials immediately, privileged access management for IT administrators, and account lockout policies after failed authentication attempts.
Software, Licensing & Hardware
Absolute prohibition on installing unauthorised software (including cracked or pirated software, which constitutes a criminal offence under the Copyright Act 98 of 1978), software licence compliance obligations, the process for requesting and approving new software, rules for connecting personal peripherals to company networks, and the prohibition on modifying company hardware without IT authorisation.
Removable Media & Cloud Storage
Restrictions on the use of USB drives, external hard drives, and other removable media — including mandatory encryption and approval for any data transfer to removable devices. Rules for approved and prohibited cloud storage services, the prohibition on storing Confidential or Restricted data on personal cloud accounts, and the requirement for approved cloud services to meet POPIA security standards.
Cybersecurity Incident Reporting & Response
Mandatory obligation to report suspected security incidents, phishing attempts, malware infections, ransomware attacks, and data breaches immediately to the IT department. Links to the organisation's incident response plan, POPIA section 22 breach notification obligations (72-hour notification to the Information Regulator), and Cybercrimes Act section 54 reporting obligations for electronic communications service providers and financial institutions.
Artificial Intelligence & Generative AI Tools
Guidelines for the use of AI tools including ChatGPT, Claude, Copilot, and other generative AI platforms. Prohibition on inputting Confidential or Restricted company data into public AI tools, requirements for approved AI tools, intellectual property considerations for AI-generated content, and the obligation to verify AI outputs before relying on them for business decisions.
Disciplinary Consequences & Enforcement
Progressive disciplinary framework aligned with LRA Schedule 8 for IT policy violations, ranging from verbal warnings for minor infractions (excessive personal browsing) to summary dismissal for serious offences (unauthorised access to systems, data theft, installation of malicious software). Addresses the employer's obligation to report criminal IT conduct to the South African Police Service under the Cybercrimes Act.
South African Law Compliance
Cybercrimes Act 19 of 2020
Creates criminal offences directly relevant to IT acceptable use: section 2 (unlawful access to a computer system — up to 15 years imprisonment), section 3 (unlawful interception of data), section 5 (unlawful interference with computer systems), section 7 (cyber extortion), and section 8 (unlawful acquisition of data, including personal information). Section 54 imposes reporting obligations on electronic communications service providers and financial institutions. The policy deters employees from engaging in conduct that constitutes a cybercrime and establishes the employer's reporting obligations.
Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002
Section 6 permits employers to monitor employee communications on company systems where the employer is the "system controller" and the monitoring is for business purposes with employee awareness. Section 5 prohibits unlawful interception of communications. The IT Acceptable Use Policy establishes the employer as system controller under RICA and provides the transparency required for lawful monitoring — without this policy, any employer monitoring of email or internet activity may constitute a criminal offence under RICA.
Electronic Communications and Transactions Act 25 of 2002
Governs electronic communications, provides for the legal recognition and admissibility of electronic evidence under section 15, and establishes offences for unauthorised access to computer systems (which complement the Cybercrimes Act provisions). Section 86 criminalises unauthorised access to, interception of, or interference with data. The policy relies on ECTA to define the boundaries of authorised and unauthorised use and to establish that electronic records (including email and system logs) are admissible evidence.
Protection of Personal Information Act 4 of 2013
Monitoring of IT usage constitutes processing of employee personal information, engaging POPIA's eight conditions for lawful processing. Condition 2 (purpose specification) requires a defined purpose for monitoring, Condition 6 (openness) requires transparent disclosure, and Condition 7 (security safeguards) mandates appropriate security measures for the personal information collected through monitoring. Data breaches caused by IT misuse trigger section 22 mandatory notification to the Information Regulator within 72 hours. Penalties include fines up to R10 million and imprisonment up to 10 years.
Copyright Act 98 of 1978
Section 27 criminalises the use of infringing copies of computer software — installing pirated or unlicensed software on company systems exposes both the employee and the employer to criminal prosecution and civil damages. The policy's prohibition on unauthorised software installation directly addresses copyright compliance and protects the employer from vicarious liability for software piracy.
South African businesses are lining up for My-Contracts — be first in when we launch
Create Your IT Acceptable Use Policy in Minutes
Our guided wizard walks you through every clause — no legal knowledge required. Attorney-drafted, South African law compliant.
Audit your current IT systems and identify risks
Catalogue all IT systems, devices, and networks used by employees, identify the current level of personal device usage (BYOD), assess existing security controls, and determine the data classification levels applicable to your business. Review any past IT security incidents for patterns and vulnerabilities.
Customise the template for your technology environment
Complete the template with your organisation's specific IT infrastructure details, approved software and cloud services, BYOD enrolment requirements, monitoring scope, data classification definitions, password policies, and incident response contacts. Ensure the policy reflects the actual technology environment rather than aspirational standards.
Establish RICA system controller status and POPIA compliance
Formally designate the employer as system controller under RICA for all company communication systems. Ensure the monitoring provisions comply with POPIA's conditions for lawful processing, including purpose specification, proportionality, and transparent disclosure. Document the lawful basis for each type of monitoring.
Communicate, train, and obtain acknowledgements
Distribute the policy to all employees and conduct cybersecurity awareness training covering phishing recognition, password security, data handling, and incident reporting. Obtain signed acknowledgements from every employee. Repeat training at least annually and whenever significant IT threats emerge.
Implement technical controls and review regularly
Implement the technical controls referenced in the policy — web filtering, email monitoring, MDM for BYOD, encryption for removable media, and access controls for classified data. Conduct regular policy compliance audits, update the policy for new technology and emerging threats, and ensure the incident response plan is tested annually.
Frequently Asked Questions
Yes. Under RICA section 6, an employer who is the "system controller" of the company email system may monitor employee emails, provided employees have been informed that monitoring takes place and the monitoring is for business purposes. The IT Acceptable Use Policy serves as this notice and establishes the employer as system controller. South African courts have held that employees have a limited expectation of privacy on company-owned systems when a clear monitoring policy is in place. Personal emails sent via company systems are also subject to monitoring, which is why the policy recommends that employees use personal devices and personal email accounts for private correspondence.
What You Get With This Template
Drafted specifically for South African law — addresses Cybercrimes Act 19 of 2020, RICA, ECTA, POPIA, and Copyright Act requirements in a single policy
Establishes the employer as RICA "system controller" with lawful authority to monitor employee email, internet, and device activity
POPIA-compliant monitoring provisions with transparent disclosure, purpose specification, and proportionality requirements
Comprehensive data classification framework (Public, Internal, Confidential, Restricted) with practical handling requirements for each level
BYOD security requirements including MDM enrolment, containerisation, and remote wipe provisions
Incident reporting procedures aligned with both POPIA section 22 (72-hour breach notification) and Cybercrimes Act section 54 obligations
Addresses emerging technologies including AI tools, generative AI, and cloud computing with practical security guidelines
Progressive disciplinary framework aligned with LRA Schedule 8 for consistent enforcement of IT policy violations