IT Acceptable Use Policy

Department: IT Services
Document Author: Scott Morgan
Job Title: Director of Data & Digital Architecture
Date of Approval: SLT 12/05/2026 and RPC 18/06/2026
Review Date: July 2029
Version: 2.0

Policy Checklist:

Policy Positioning Statement

Our mission is simple – be all that you can be.

Bridgend College is a special place to learn and work. We want to create an inclusive environment which enables people to be innovative and passionate about what they do. We want to create inspirational opportunities which transform lives and celebrate the successes of every individual. We are committed to making decisions which are ethical and people-centred, for every person and in every interaction.

We know that the standards we walk past are the standards we accept, so by being a team player who is committed to our organisational values, we can ensure that everyone is ready to learn and work in an environment where they are respected and feel safe, to be all that they can be.

We want Bridgend College to be a place of sanctuary, providing a sense of belonging.

We recognise the significant impact of trauma on individuals’ lives and understand that a compassionate and understanding approach is essential to support our students and staff on their academic and personal journeys. We will do this by being calm, consistent and caring in our approach to communication and decision-making.

We want to be an anti-racist College. We are committed to fostering an inclusive culture where people are respectful and where this permeates all that we do. We want to develop a culture where people show up for one another with trust and integrity – a place of learning and work where people thrive.

As a place of education, we recognise our responsibility in developing the skills, knowledge and confidence of our students, staff and the communities we serve.

We know that we don’t always get things right, but we are committed to listening, learning and educating ourselves on our journey to becoming an extraordinary organisation.

1. Purpose and Objectives:

This policy aims to ensure that all users of the Group’s IT infrastructure comply with current UK legal requirements, Cyber and Information Systems best practices and in doing so, protects all users of the Group’s IT Systems.

The Policy applies to any user of the Group’s IT System irrespective of their location or the device on which they are accessing the Group’s resources including new and developing technologies and uses, which may not be explicitly referred to.

Users may be defined as, but not limited to: Staff, Students, Contractors, Guests, Governors, Student Teachers and Agency workers.

Any breach of this policy may result in disciplinary action, including in extreme cases suspension or expulsion from the Group. The Group also reserves the right to report any such breach if it deems necessary to the appropriate authorities.

2. Policy Details:

Passwords and/or other forms of authorisation must not be disclosed to other individuals either within or outside the Group. For reasons of security your individual password should not be printed, stored online or given to others. If a user knows or suspects that their password or account credentials have been compromised, leaked or accessed by an unauthorised party, they must immediately change their password and report the incident to the IT Service Desk. 

College Group systems and devices should only be used for work-related purposes and not for personal or commercial gain. 

The Group reserves the right to monitor any computer, e-mail, Google Chat, Google Gemini and internet usage to ensure adherence to this policy and all users should be aware that their use while on campus or on Group-managed devices is not private. 

Computers (including but not limited to laptops, Chromebooks, PCs, Macbooks, iMacs, tablets and mobile devices) and Google accounts provided for staff, learner and other stakeholder use are the property of the Group. 

College Group devices and Google accounts should be used for the sole purpose of carrying out your duties as a member of staff, a learner or other stakeholder.

Group IT facilities may not be used for the creation or transmission of material that might reasonably be considered defamatory or discriminatory on the basis of race, gender, religion or belief, disability, age or sexual orientation, nor cause harassment, bullying and/or victimisation, advocate or promote any unlawful act, promote or encourage extremism or radicalisation or cause any other action which may bring the Group into disrepute. 

Sensitive or Personally Identifiable Information should not be downloaded to any device at any time. Furthermore, users must not access, view, or process Sensitive or Personally Identifiable Information on unmanaged personal devices. Any interaction with this data must be conducted strictly on College-owned computers or personal mobile devices that are actively secured by the Group’s Google Endpoint Management tools. 

Staff should ensure that they adhere to the Group’s procedures on the Data Protection Act and Freedom of Information Act. 

The ability to connect to other computer systems through the network does not imply a right to connect to those systems or make use of those systems unless authorised to do so by the Director of Data & Digital Architecture. You should not alter or copy a file belonging to another user without first obtaining permission from the creator of the file. 

All external stakeholders covered by this policy, including external contractors, must complete a Systems Access Request Form and obtain authorisation from the Director of Data & Digital Architecture before accessing any Group systems or spaces which contain infrastructure or networking equipment, whether virtually or in person. 

The Director of Data & Digital Architecture must formally authorise the procurement, download or deployment of any IT equipment and software. This authorisation requirement extends to all free or paid cloud services, web applications, browser extensions and Artificial Intelligence tools. However, users may use public generative AI tools for general ideation, drafting generic communications or public research, provided that absolutely no specific Group data, staff/student details or proprietary information is included in the prompt or uploaded files. 

All Group IT equipment, including computer peripherals, should be treated with respect. Any loss or damage to IT equipment should be reported to IT Services at the earliest opportunity. 

Virus/malware or any program which may have a harmful effect on the IT Systems must not be introduced onto the network intentionally. Users share the responsibility for maintaining device security. Users must not delay, bypass, or block mandatory system updates and software patches. Devices must be restarted promptly when prompted by the system to ensure critical security patches are applied within the required 14-day window.

Any user granted an administrative account must use this account exclusively for authorised administrative duties. Administrative accounts must not, under any circumstances, be used for standard day-to-day activities such as web browsing, accessing standard email or generic document creation. 

All devices must be encrypted where possible. Irrespective of device encryption status, Multi-Factor Authentication (MFA) is mandatory for all users when accessing Group cloud services and data. Users must use a secure password, defined as a minimum of 12 characters. For personal mobile devices enrolled in the Google Endpoint Management system, users must comply with all forced security policies, including mandatory screen locks, device encryption and the separation of personal and work profiles where applicable. 

IT resources must not be moved from their installed location without prior authorisation from the departmental Manager and Director of Data & Digital Architecture. 

The filming of or recording of individuals using cameras or recording devices integrated with a mobile device is strictly prohibited unless it is part of the curriculum or with the person(s) express permission as outlined in the Social Media Policy. 

Copyright applies to all text, pictures, video and sound, including those sent by e-mail or on the Internet. Files containing such copyright protected material may be downloaded, but not forwarded or transmitted to third parties without the permission of the author of the material or an acknowledgement of the original source of the material, as appropriate.

Users are responsible for ensuring that information printed or copied must be removed immediately from the printer/copier once the job has been released. The Group adopts a “follow me print” policy that allows print jobs to be released at any device on any campus. These print jobs are held centrally on a print server and print queues are purged on jobs older than 3 days. 

Users must not input, upload, or process Personally Identifiable Information (PII), student records, confidential Group data or internal intellectual property into unauthorised, public-facing Artificial Intelligence (AI) tools or Large Language Models (LLMs) (e.g., ChatGPT, Gemini, Claude). Any processing of Group data using AI must be conducted exclusively through IT-approved, enterprise-grade AI solutions where the Group has a formal agreement that data will not be used to train public models. 

Deliberate action to circumvent any controls the Group has put in place to safeguard the security of its systems and users or disrupting or denying other users access to the Group’s network will be classed as a breach of this policy. 

Investigations will commence where reasonable suspicion exists of a breach of this or any other relevant policy. If an individual suspects there to be a breach of this policy, they must report it immediately to the Director of Data & Digital Architecture to allow investigation of the incident prior to taking appropriate action.

3. Responsibilities (if applicable):

The integrity of all central computer systems, the confidentiality of any information contained within or accessible on or via these systems is the responsibility of all users of the Group’s IT systems. 

Any data protection incidents must be reported to the Data Protection Officer at the earliest opportunity via email to data@bridgend.ac.uk, in line with the Data Management & GDPR Policy. 

All users of the Group’s IT systems are responsible for the immediate reporting of any IT incidents to the IT Service Desk at itsupport@bridgend.ac.uk.

4. Related Documents (if applicable):

• Data Management & GDPR Policy 
• Disciplinary Policy 
• IT Security Policy 
• Safeguarding Policy

5. Document Review

July 2029

Equality Impact Assessment Form

Date completed: 20/04/2026
Signed by Manager completing the assessment: S. Morgan

Welsh Language Impact Assessment

Welsh Language Standards

Action Plan

Actions should demonstrate steps to be taken to reduce or where possible, eliminate any negative impact on the Welsh Language.

Assessment Completion Date: 20/04/2026

Student finance

Studying at college may involve costs for you.

Find out more

Discovery Events

Throughout the year, we open our doors to the public and run a number of discovery events.

Find out more

Campus Tours

We offer over 20 different tours, all of which are focused on a specific subject area.

Find out more

Cyfleoedd

Cyfleoedd is our careers hub, and we work closely with students to enhance careers education and promote work-related opportunities.

Find Out More

Careers

We are a values-based organisation, and we look for people to join us who share those values.

Find Out More