East Durham College - Computer Usage Policy

PROCEDURE TITLE: Computer Usage Policy
DOCUMENT NUMBER: 6.4
PROCEDURE GROUP: Technical Services
AUTHOR / REVISOR / OWNER: Andrew Barker
DATE OF CURRENT VERSION: October 2026
 

This policy applies to all College staff, students, governors, agency workers, volunteers, contractors, visitors and authorised third parties using East Durham College computers, accounts, networks, cloud services, internet access, software, mobile devices, or data. It applies on college premises and when accessing College systems remotely or through an authorised personal device. 

All users are responsible for using College facilities lawfully, securely, ethically, and efficiently. Access is provided to support teaching, learning, administration, and authorised College business and may be restricted or withdrawn where misuse or risk is identified. 

The purpose of this policy is to protect learners, staff, information and College systems; define acceptable and unacceptable computer use; support safeguarding and cyber security; ensure compliance with applicable law and Department for Education standards; and explain how suspected misuse, security incidents and breaches will be managed. 

Authorised use and ownership. 

College systems, accounts, and data must be used primarily for teaching, learning, administration, and authorised College business. Limited personal use may be permitted where lawful, reasonable, non-disruptive and consistent with college policy. College systems and business records remain under college control, subject to individual rights under data protection and other applicable law. 

Accounts are issued through approved staff or student processes. Users must use only their own account and assigned access rights. Another person’s account, device, mailbox, files, or credentials must not be used without formal authority. 

Accounts, passwords, and access 

•  Use unique credentials and protect passwords, passkeys, authentication tokens, and multi-factor authentication methods. 

•  Do not share credentials, approve unexpected sign-in prompts, or allow another person to use an authenticated session. 

•  Lock unattended devices and sign out of shared devices. 

•  Report suspected compromise, unusual authentication activity, or loss of a device immediately to Technical Services. 

•  Access rights will be granted on least-privilege and need-to-know principles and may be reviewed, changed, or removed. 

Security of systems and devices 

Users must not attempt unauthorised access, security testing, vulnerability scanning, password cracking, interception, privilege escalation, or circumvention of controls. This includes activity prohibited by the Computer Misuse Act 1990. 

•  Do not disable, remove, or interfere with anti-malware, security system, encryption, patching, audit, backup, access, filtering, or monitoring controls. 

•  Only approved and properly licensed software, browser extensions, cloud services, and applications may be installed or used for college information. 

•  Security updates and restarts must not be unreasonably delayed. Devices identified as insecure may be isolated or access restricted. 

•  Removable media and authorised personal devices must comply with college security requirements. 

•  Administrative privileges must be used only when needed for authorised duties. 

Safeguarding, filtering, and monitoring 

The College will maintain appropriate filtering and monitoring arrangements to reduce exposure to illegal, inappropriate, and potentially harmful content. Users must not bypass these controls through VPNs, proxies, personal hotspots, alternative DNS services, or other methods unless specifically authorised for a legitimate technical or educational purpose. 

The effectiveness of filtering and monitoring will be reviewed at least once each academic year by the responsible by the Designated Safeguarding Lead and Technical Services. Reviews will consider web content, apps, mobile devices, dynamic and personalised services, and AI-generated content where relevant. 

Online activity indicating abuse, exploitation, grooming, radicalisation, self-harm, bullying, harassment, or another safeguarding concern must be reported promptly through the College safeguarding route. Immediate danger must be escalated to emergency services.

Data protection and information handling 

Users must comply with the UK GDPR, Data Protection Act 2018 as amended, College privacy notices, information-governance policies, and the records-retention schedule. Personal and confidential information must be limited to what is necessary, stored only in approved locations and shared on a need-to-know basis using appropriate safeguards. 

•  Do not copy College information to personal email, unapproved cloud storage, consumer messaging services, or unauthorised removable media. 

•  Check recipients, attachments, permissions, and sensitivity before sending or sharing information. 

•  Do not delete or alter information subject to a legal hold, safeguarding matter, complaint, investigation, or information request. 

•  Report lost devices, misdirected communications, unintended disclosure, or other suspected personal data breaches immediately. 

Software, copyright, and intellectual property 

Copyrighted software, media, learning materials and other intellectual property must be used only under a valid licence or lawful permission. Users must not copy, distribute, download, or make available software or content without authority. The Copyright, Designs and Patents Act 1988 and applicable licence terms must be observed. 

Internet, email, collaboration, and cloud services 

Internet access, email, Microsoft 365, Teams, and other collaboration services must be used professionally and securely. Communications must not be fraudulent, threatening, defamatory, discriminatory, harassing, bullying or otherwise unlawful. Users must not send spam, hoaxes, chain messages, or material likely to compromise security or the College’s reputation. 

Guest access, external sharing, recordings, transcripts, and automated summaries must have an authorised purpose. Sharing permissions must be the least permissive appropriate setting and reviewed when access is no longer required. 

Generative AI and automated tools 

•  Only approved AI services may be used for college work involving College information. 

•  Personal, special category, safeguarding, confidential, credential, assessment or commercially sensitive information must not be entered into an AI service unless formally approved and assessed. 

•  AI output must be reviewed for accuracy, bias, accessibility, confidentiality, copyright, and fitness for purpose. The user remains accountable for the final work. 

•  Use in learning and assessment must comply with academic-integrity and awarding-organisation requirements. 

Acceptable use of resources 

Users must not intentionally or recklessly degrade system performance, consume excessive storage, network, printing or processing capacity, interfere with another user’s work, or use College resources for unauthorised commercial activity, crypto-mining, gambling, or other non-College purposes. High-volume or specialist activity must be authorised where it may affect service availability. 

Examples of unacceptable use 

•  Gaining or attempting unauthorised access to systems, accounts, files, data, or network resources. 

•  Creating, introducing, distributing, or knowingly executing malware, malicious code, phishing content, or denial-of-service activity. 

•  Circumventing authentication, encryption, filtering, monitoring, licensing, retention, or security controls.

Accessing, creating, storing, or sharing illegal, abusive, hateful, discriminatory, exploitative, sexually explicit, or otherwise inappropriate material. 

•  Impersonating another person, masking identity for improper purposes, or tampering with logs or evidence. 

•  Reading, copying, changing, deleting, or monitoring another user’s communications or files without authority. 

•  Publishing abusive content or confidential, personal, safeguarding or commercially sensitive information without authority. 

•  Using College systems to promote terrorism or extremism or failing to report related safeguarding concerns through the approved route. 

Personal devices and mobile phones 

Personal devices brought onto college premises remain the owner’s responsibility and must be used safely, respectfully and in accordance with teaching, safeguarding, and security requirements. Mobile phones and other devices must not disrupt learning or business activity and may be restricted in teaching, assessment, secure or safeguarding-sensitive environments. 

Connection of a personal device does not transfer ownership to the College, but the College may restrict network access, require minimum security controls, and remove College data or access where necessary and lawful. 

Monitoring and privacy 

The College may monitor and record use of accounts, networks, devices, internet access, and services for defined purposes including safeguarding, cyber security, service management, compliance, prevention and detection of misuse, incident investigation, and protection of college interests. 

Monitoring will be lawful, fair, transparent, necessary, and proportionate. Access to monitoring information will be restricted to authorised personnel, and records retained only as long as necessary. Covert monitoring will be exceptional, specifically authorised, time-limited and undertaken only where lawful and proportionate. 

Cyber security and incident reporting 

Phishing, malware, suspected compromise, loss or theft of equipment, unauthorised access, unusual system activity, and other cyber incidents must be reported immediately to Technical Services or the Service Desk. Users must preserve relevant evidence, disconnect a device if instruct and avoid actions that could spread an incident or destroy evidence. 

The College will maintain cyber-awareness, risk-assessment, account-security, anti-malware, security system, update, backup, and incident-response arrangements aligned with current Department for Education cyber security standards and applicable funding requirements. 

Enforcement 

The College may restrict or suspend access while a suspected breach, safeguarding concern or cyber incident is assessed. Breaches may be managed under the relevant staff, student, safeguarding, contractual or disciplinary procedure. Serious matters may be reported to regulators or law-enforcement bodies where necessary and lawful. Decisions will be proportionate and will not be made solely by Technical Services. 

Agreement and assistance 

Use of College systems indicates acceptance of the current Acceptable Use Agreement and this policy. Questions, access needs, and technical support requests should be directed to Technical Services or the Service Desk. Safeguarding concerns must be reported through the College safeguarding route.

• Acceptable Use Agreement(s)
• Electronic Communications Policy
• Safeguarding Policy 

This document is issued and controlled by Quality & Standards and may only be modified by the designated group after proposed modifications have been accepted by the College Management Group. The latest version of the policy will be maintained on the College Extranet.