List of active policies

Full policy

IT Acceptable Use Policy – Higher Education Provision

1. Policy Statement and Purpose

London Brookes College (“LBC”, “the College”) is committed to providing secure, reliable and appropriate access to its information technology systems to support learning, teaching, research and College operations. This policy establishes the standards expected of all users when accessing College information, systems, networks and digital services. The College expects all users to use information technology responsibly, ethically and lawfully, and in a manner that protects the confidentiality, integrity and availability of College information and systems.

The purpose of this policy is to:

•       Protect College information assets and maintain cyber security;

•       Support compliance with the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and with the other legislation listed in Section 5;

•       Promote the responsible use of digital technologies, including artificial intelligence;

•       Protect students, staff and College systems from cyber threats and online harms;

•       Meet the expectations of regulators, awarding organisations and the College’s university partners.

2. Scope

This policy applies to all users of London Brookes College IT facilities and services, including:

•       Students enrolled on Higher Education (HE) programmes;

•       Academic and support staff;

•       Governors and volunteers;

•       External contractors, visiting lecturers, and partners using College systems;

•       Guests using College computers or Wi-Fi.

IT facilities include all College-provided hardware, software, network access, cloud-based services (e.g. Microsoft 365, Moodle and approved conferencing tools) and digital credentials issued by the College. The policy applies to College-owned devices and to personally owned devices used to access College information or services.

3. Definitions

Users: all individuals within the scope of Section 2.

IT facilities: the hardware, software, networks, cloud services and credentials described in Section 2.   

Personal data: information relating to an identified or identifiable living individual, as defined in the UK GDPR.

Confidential information: any non-public College information, including student records, staff records, assessment materials and commercial information.

Removable media: USB memory sticks, portable hard drives, memory cards and similar portable storage devices.

AI tools: software that generates or transforms content or makes predictions using artificial intelligence, including generative AI services and AI assistants.

DSL: the College’s Designated Safeguarding Lead.

4. Governance and Related Policies

Use of IT systems at LBC is governed by UK law and College policies including:

•       Data Protection and Privacy Policy;

•       Academic Integrity Policy;

•       Safeguarding Policy and Prevent Policy;

•       Filtering Decision Record, Sensitive Material Access Process, Prevent IT Incident Procedure and Log Retention Schedule;

•       External Speakers Policy;

•       Staff and Student Disciplinary Procedures;

•       Any information security or bring-your-own-device (BYOD) policies in force.

All users must act responsibly, ethically and lawfully when using College IT resources.

5. Relevant Legislation

Users must comply with all applicable UK laws, including:

•       Computer Misuse Act 1990;

•       Data Protection Act 2018 and UK GDPR, as amended by the Data (Use and Access) Act 2025;

•       Investigatory Powers Act 2016 and the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018;

•       Counter-Terrorism and Security Act 2015;

•       Terrorism Act 2000, Terrorism Act 2006 and Counter-Terrorism and Border Security Act 2019;

•       Online Safety Act 2023;

•       Copyright, Designs and Patents Act 1988;

•       Equality Act 2010;

•       Human Rights Act 1998;

•       Defamation Act 2013;

•       Malicious Communications Act 1988 and section 127 of the Communications Act 2003;

•       Protection of Children Act 1978 and section 160 of the Criminal Justice Act 1988;

•       Fraud Act 2006.

The Higher Education (Freedom of Speech) Act 2023, the principal duties of which came into force on 1 August 2025, applies to the College’s higher education delivery through its partnership arrangements and is relevant to Section 10 of this policy.

6. Authorisation, Accounts, Passwords and Multi-Factor Authentication

Access to IT systems is permitted only when authorised by the College through user credentials, assigned access rights or open-access facilities. Unauthorised access is a criminal offence under the Computer Misuse Act 1990. Accounts are personal and non-transferable. Access is provisioned on enrolment or employment and is revoked promptly when a user leaves the College.

All users must:

•       Create strong, unique passwords and keep them secure and confidential;

•       Never share passwords, multi-factor authentication (MFA) codes or authentication approvals with any other person;

•       Enable MFA on all College accounts where the College provides it; MFA is mandatory on College Microsoft 365 accounts;

•       Never approve unexpected authentication requests;

•       Log out of shared devices, and lock devices whenever left unattended;

•       Report suspected account compromise immediately to IT Services.

7. Acceptable Use and Limited Personal Use

Internet access and IT facilities are provided for legitimate educational and administrative purposes. Acceptable use includes research, online learning, academic communication and collaboration.

Limited personal use of College IT facilities is permitted provided that it:

•       Does not interfere with work or study;

•       Does not incur additional cost to the College;

•       Does not materially degrade network performance or College services;

•       Does not breach this policy or any other College policy.

8. Unacceptable Use

Users must not:

•       Access or distribute offensive, obscene or illegal material;

•       Engage in harassment, bullying or discrimination;

•       Download or share unauthorised copyrighted content;

•       Bring the College into disrepute through online behaviour or social-media activity;

•       Use College systems for commercial activity unrelated to College business, or in any way that materially degrades College services;

•       Use College systems, branding or identity for political campaigning;

•       Attempt to bypass, disable or circumvent security controls;

•       Install unauthorised software or connect unapproved devices;

•       Introduce malware or otherwise interfere with College networks or services;

•       Access, download, store, create or share material that promotes or glorifies terrorism, invites support for a proscribed organisation or encourages violent extremism, other than through the approved route in Section 10;

•       Use College systems for any unlawful purpose.

9. Internet, Email and Communications

College email, messaging and internet services must be used responsibly and professionally. Users must not:

•       Open suspicious attachments or click unknown or unverified links;

•       Send offensive, abusive or inappropriate communications;

•       Circumvent email or messaging security controls;

•       Misrepresent themselves or impersonate others in College communications.

10. Prevent Duty and Safeguarding Online

London Brookes College recognises its statutory obligations under the Counter-Terrorism and Security Act 2015, which places a duty on further and higher education providers to have due regard to the need to prevent individuals from being drawn into terrorism.

The College maintains proportionate technical and procedural safeguards on its networks, informed by its Prevent risk assessment. Its decisions on web filtering and automated alerting, and the reasons for them, are recorded in the Filtering Decision Record, which is signed by the Head of IT Services and the Prevent Lead and reviewed at least annually in line with government guidance. Users remain responsible at all times for their conduct online, on any device, when using a College account or network.

The College’s Internet Service Provider (ISP) may retain standard network connection data (e.g. connection times, IP addresses and bandwidth usage) in line with national legislation, including the Investigatory Powers Act 2016. The College does not routinely access or review these records, but may cooperate with law-enforcement or regulatory authorities that hold lawful powers to request such information.

College Approach

To uphold its Prevent and safeguarding responsibilities, LBC will:

1.     Educate and inform users about responsible, lawful online behaviour and the risks of extremist or harmful content.

2.     Embed digital literacy and critical evaluation skills into teaching and induction.

3.     Provide clear reporting mechanisms for concerns through the Prevent Lead, the Designated Safeguarding Lead (DSL) or the Safeguarding Team.

4.     Respond to concerns under the Prevent IT Incident Procedure. IT Services log the concern and pass it to the Prevent Lead the same working day, with the DSL copied. IT staff do not investigate or contact the person concerned. The Prevent Lead decides the response, which may be no action, a welfare conversation, a safeguarding referral or a Prevent referral, in accordance with the Prevent Policy and data-protection procedures.

5.     Work with external agencies such as law enforcement or Prevent partners where risk to safety or legality is identified.

User Responsibilities

All users must:

•       Use the internet and College IT facilities responsibly and for legitimate academic purposes;

•       Not access, download, store or distribute material that promotes or glorifies terrorism or violent extremism, or discriminatory, violent or illegal content, other than through the approved route below;

•       Not attempt to bypass security settings or anonymise browsing for unlawful purposes;

•       Report immediately any material or behaviour that may contravene this policy.

•       Not investigate a concern about another person. Note what was seen and tell the Prevent Lead or the DSL the same day. If there is an immediate risk to life, call 999 first.

Safeguarding and Academic Freedom

The College values academic freedom and lawful freedom of speech, consistent with its obligations, including those arising from the Higher Education (Freedom of Speech) Act 2023 through its partnership arrangements. Studying terrorism, extremism and radicalisation is a legitimate part of education. Staff or students who need to access material covered by this section for a module, a dissertation or research must apply in advance through the Sensitive Material Access Process. The Programme Lead confirms the academic need and the Prevent Lead, or the DSL, approves or declines. Decisions will normally be given within five working days. Approved access is time-limited, may be given effect through a named exception on the College filter, and is recorded in the Sensitive Material Access Register. The record protects the individual concerned by evidencing that access was for legitimate academic purposes. Approved material is stored only in the user’s College OneDrive, is not shared beyond the approved purpose, and is deleted when the work is complete.

Online Teaching and Events

A member of College staff hosts every Teams or other online session that includes an external speaker or external participants, and keeps the presenter, lobby and chat controls. External speakers for online events are approved under the External Speakers Policy in the same way as in-person events. Course areas on Moodle and Teams are moderated by the responsible lecturer. Content covered by this section that appears in any online session or College platform is reported to the Prevent Lead the same day under the Prevent IT Incident Procedure.

Consequences of Misuse

Breaches of this section may result in the sanctions set out in Section 21 and, where appropriate, referral to law-enforcement agencies.

11. Monitoring, Privacy and Data Protection

Protecting personal data and maintaining the integrity of College systems is a shared responsibility. The College complies with the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and processes personal data in accordance with its Data Protection and Privacy Policy. Sensitive data must be stored only on authorised systems, and unauthorised access to restricted systems is strictly prohibited.

The College does not carry out blanket surveillance of individual users’ activity. Where web filtering or automated alerting is in place, its scope and purpose are set out in the Filtering Decision Record (Section 10). College systems also generate records in the ordinary course of operation, including Microsoft 365 audit and sign-in logs, network and Wi-Fi access logs, Moodle logs, email and file metadata, and device records. The College may review such records, or cooperate with lawful investigations, where misuse is suspected or a safeguarding or Prevent concern is raised. Records are kept for the periods set out in the Log Retention Schedule, are accessible only to named administrators using multi-factor authentication, and may be shared with the police, the local authority Prevent team or a Channel panel where there is a lawful basis and a documented need.

Any such review will be:

•       Proportionate and for a legitimate reason, including protecting information security, investigating suspected misuse, maintaining system performance and meeting legal or regulatory obligations;

•       Authorised by the Head of IT Services, the Prevent Lead or the DSL;

•       Lawful, relying on the legitimate interests of the College or its legal obligations as the lawful basis for processing (the College does not rely on consent for this processing), and compliant with the Data Protection Act 2018 and UK GDPR, as amended;

•       Assessed, with a data protection impact assessment carried out before any new or intrusive monitoring is introduced.

The College respects user privacy and will inform users about the records its systems generate and the circumstances in which they may be reviewed, through this policy and the Data Protection and Privacy Policy.

12. Data Storage, Backups and Removable Media

All users are responsible for managing, storing and protecting their digital work safely. Students and staff must follow good data management practices to prevent data loss, protect intellectual property, and ensure continuity of learning or operations.

Requirements

•       Save work regularly and use reliable storage such as OneDrive, SharePoint or Moodle;

•       Keep at least one additional backup of important work (e.g. approved cloud storage or an encrypted device);

•       Do not store sensitive data on personal devices unless authorised and encrypted;

•       Access and store College data only within approved systems (see Section 14);

•       Do not copy or transfer College data without permission.

Removable Media

Removable storage devices present a significant security risk. Users must not:

•       Connect unknown or untrusted USB or other removable devices to College equipment;

•       Use removable devices found on College premises or received from unknown sources;

•       Store confidential or personal College information on removable media unless authorised and encrypted;

•       Transfer software or files from removable media without appropriate malware scanning.

13. Personal Devices (BYOD)

When using personal devices to access College systems, users must ensure:

•       Password protection and software updates are in place;

•       Antivirus software is active;

•       College accounts are logged out after use;

•       Data is not exposed to unauthorised access.

The College reserves the right to restrict or withdraw access to College systems from any device it considers to present an unacceptable security risk, including through conditional access or mobile device management controls where deployed.

14. Approved Cloud Services

College information must be created, stored and shared only within approved services. Approved services include the Microsoft 365 suite licensed by the College (including Teams, SharePoint, OneDrive and Outlook), the College virtual learning environment (Moodle), and conferencing tools approved by IT Services. College information must not be stored in unapproved personal cloud storage platforms or personal online services without prior authorisation from IT Services.

15. Artificial Intelligence (AI) Use

LBC recognises that Artificial Intelligence (AI) technologies can enhance teaching, learning, research, and productivity when used responsibly.

Appropriate Use

AI tools may be used to:

•       Support learning and research (e.g. idea generation, data analysis, writing assistance);

•       Encourage creativity and digital literacy;

•       Enhance accessibility or productivity under staff guidance.

Data Protection and Confidentiality

•       Users must not enter personal data, student work, or confidential College information into consumer or publicly available AI tools;

•       Such data may be processed only in AI tools approved by the College that carry appropriate data-protection assurances (for example, enterprise-licensed Microsoft Copilot where deployed);

•       IT Services maintains and publishes the list of approved AI tools.

Prohibited or Restricted Use

Users must not use AI tools to:

•       Generate or substantially write assessments without permission;

•       Fabricate data, citations, or research outcomes;

•       Misrepresent AI-generated work as original;

•       Impersonate members of the College community or create deceptive synthetic media of them;

•       Breach confidentiality, copyright, or data-protection laws.

Staff Use in Assessment

•       AI must not be used as the sole means of marking student work or of making decisions about students;

•       Any AI-assisted marking or feedback requires meaningful human review, with the member of staff remaining fully accountable for the outcome;

•       Staff use of AI in assessment must comply with the requirements of the relevant awarding organisation (e.g. Pearson) and any validating university partner.

Transparency and Integrity

•       All use of AI in assessments must be declared and referenced in line with the Academic Integrity Policy;

•       Undeclared use will be treated as academic malpractice;

•       Users remain fully responsible for verifying the accuracy, legality and appropriateness of AI-generated content before relying upon or sharing it;

•       Staff should model ethical AI use and support student understanding of AI literacy.

16. Intellectual Property and Copyright

LBC respects the intellectual property (IP) rights of all users and third parties.

Key Principles

•       Students retain copyright in their original academic work unless otherwise agreed;

•       Staff must comply with the College’s IP and research policies;

•       Do not share or use copyrighted material without permission or a valid licence;

•       Do not download or distribute pirated software, images, or media;

•       Acknowledge and reference all sources accurately in line with the Academic Integrity Policy.

Permitted Use

•       Use open-access or Creative Commons (CC) materials according to licence terms;

•       Licensed digital resources provided by the College must not be shared externally.

17. Health, Safety and Accessibility

LBC promotes safe, inclusive and ergonomic use of technology.

Safe Use of Equipment

•       Take short breaks every 45–60 minutes;

•       Adjust chairs and screens for good posture;

•       Avoid glare and adjust brightness for comfort;

•       Keep food and drink away from computers;

•       Keep walkways and cables clear.

Accessibility

•       Students and staff with disabilities may request reasonable adjustments to digital systems or workspaces;

•       Assistive technologies (e.g. screen readers, speech-to-text) are available;

•       Requests should be directed to the Student Support and Wellbeing Team or IT Services.

18. Printing and Environmental Responsibility

LBC is committed to sustainable practice and responsible resource use.

Sustainable Printing

•       Print only when necessary;

•       Use double-sided, black-and-white printing;

•       Avoid printing documents that can be viewed electronically;

•       Collect printouts promptly to protect confidentiality.

Digital Sustainability

•       Use Teams, SharePoint and Moodle to share files digitally;

•       Dispose of devices and consumables responsibly via College recycling;

•       Power down IT equipment when not in use.

These measures support the College’s Environmental Sustainability Strategy.

19. E-Safety and Cyber Security Awareness

LBC promotes safe and respectful digital participation for all. Cyber security is everyone’s responsibility.

College Commitment

•       Provide e-safety training and guidance;

•       Embed e-safety in induction and tutorials;

•       Promote privacy, reputation and digital citizenship;

•       Support victims of online harm and collaborate with external agencies if required.

Safe Online Behaviour

All users must:

•       Communicate respectfully online;

•       Protect personal data;

•       Avoid posting discriminatory or harmful content;

•       Verify online sources;

•       Use privacy settings appropriately.

Cyber Security Awareness

•       Use strong passwords and MFA in accordance with Section 6;

•       Remain alert to phishing emails, fraudulent websites and social-engineering attacks, and verify unexpected requests for credentials, financial information or confidential data before responding;

•       Never disable antivirus software, endpoint protection or other security controls;

•       Install only software authorised by IT Services on College devices;

•       Protect College devices from theft, loss and unauthorised access, and never leave them unattended in public places;

•       Keep systems updated and report issues promptly;

•       Complete mandatory cyber-security and e-safety awareness training where required.

20. Security Incidents and Reporting

Users must immediately report:

•       Lost or stolen devices;

•       Phishing emails and suspected scams;

•       Suspected malware or ransomware;

•       Personal data breaches;

•       Unauthorised access to systems or information;

•       Accidental disclosure of confidential information;

•       Any incident that may compromise College systems or information, or any e-safety concern.

Where malware or ransomware is suspected and it is safe to do so, disconnect the affected device from the network, do not attempt remediation, and await guidance from IT Services. Suspected personal data breaches must be reported immediately to IT Services and the College’s data protection lead so that the College can meet its obligation to assess, and where required notify the Information Commissioner’s Office of, a breach within 72 hours. Prompt reporting enables the College to minimise risk and comply with its legal obligations.

Concerns should be escalated to:

•       IT Services: ITsupport@londonbrookes.ac.uk

•       Safeguarding Team: safeguarding@londonbrookes.ac.uk

•       Prevent Lead: as named in the Prevent Policy, Section 12.1. Prevent concerns may also be raised through the Safeguarding Team.

21. Breaches of this Policy

Failure to comply with this policy may result in:

•       Suspension or withdrawal of access to IT facilities;

•       Action under staff or student disciplinary procedures;

•       Contract termination where applicable;

•       Referral to regulatory authorities or law enforcement where appropriate.

22. Policy Ownership, Review and Version History

This policy is owned by the Head of IT Services and approved by the Board of Governors. It will be reviewed annually, or sooner where required by legislative, regulatory, technological or operational change.

All users are required to familiarise themselves with this policy before accessing College information systems. Acceptance of the policy is recorded at staff induction and student enrolment, at first sign-in to Microsoft 365 and Moodle, and is refreshed annually or whenever a new version is issued. For the purposes of the Prevent Policy, the Head of IT Services is the IT Lead. A significant change to this policy as it relates to the Prevent duty is reported to the Office for Students within five working days of approval, as required by the OfS Prevent monitoring framework. The College has considered the equality impact of this policy and will apply it fairly and consistently in accordance with the Equality Act 2010.