Free Template for Dealers

Acceptable Use Policy Template for Dealership Employees

A fill-in policy in plain words for everyone at the store, from company devices and personal phones to customer data and AI tools, ready to sign at hire.

Request a Complimentary Assessment →

Or download the template as an editable Word file or a printable PDF.

New dealership employee signing a printed acceptable use policy at an office desk, with a short stack of pages beside her

An acceptable use policy template for dealerships is a fill-in set of plain rules every employee signs, covering company and personal devices, email, passwords, customer data, software and AI tools, monitoring, and how to report a problem.

Last updated: November 9, 2026

Company computers

Personal phones

AI and free apps

One policy

Before You Block It, Write Down What’s Allowed

Erik Nachbahr, our founder, describes the conversation like this: “Dealers are thinking about these things, and they’re asking a question of how do we block these things, potentially, but they don’t have policies that even state what is or isn’t allowed. Certainly not when it comes to AI and PII.”

Picture a salesperson taking a photo of a driver’s license on a personal phone, or an advisor pasting a repair history into a free AI app. If nothing in writing covers those moments, nobody has really told them not to. A technical block can only stop what somebody already decided to stop, and our cybersecurity for dealerships page covers the controls behind it. This IT acceptable use policy is where the decision gets written down.

One rule before you start. This template is not legal advice, so have your attorney read your version before anyone signs it.

The template

The Dealership Acceptable Use Policy Template

Download it as an editable Word file or a printable PDF. Same ten sections, same numbers. We wrote it to be read at the parts counter, not in a conference room.

Dealership controller filing a manila folder into a steel file cabinet with a key in its lock

Where Helion fits

Helion has helped a few clients write basic AI language into their policies. The final policy is the dealer’s. We guide you and supply templates, and a complimentary IT and cybersecurity assessment reviews what’s in place today and puts the findings in writing.

Acceptable use policy: section by section Each numbered line is a rule your staff signs. Anything in [brackets] is yours to fill in or change.

1 Who this covers

1.1 This policy covers everyone who works at [Dealership Name], including part-time staff, temps and contractors, on any device used for dealership work.
1.2 We hold customers’ personal and financial information. These rules protect them, the store and you.
1.3 The policy owner is [name, title]. If you aren’t sure about something, ask [name, phone] before you do it.

2 Company devices and personal phones

2.1 Company computers, tablets and phones are for dealership work. Personal use is [allowed on breaks / not allowed].
2.2 Lock your screen whenever you walk away from it, even for a minute.
2.3 Personal phones and laptops may be used for work only for [approved apps], and only with a screen lock turned on.
2.4 Never save customer information on a personal device. That includes photos, texts and downloads.
2.5 If a device with dealership email or apps on it is lost or stolen, call [name, phone] right away.
2.6 When you leave, you return company devices, and dealership apps and data come off your personal ones.

If your store runs its apps on personal phones, write 2.3 for what really happens there. Ask your attorney about paying staff back for work use of a personal phone, and about time spent on it after hours. Line 2.6 is easier with a record of who has which device, which IT asset management keeps.

3 Email and Microsoft 365

3.1 Use your work email for dealership business. Don’t forward work email to a personal account.
3.2 Keep dealership files in [OneDrive, SharePoint or the DMS], not in a personal cloud account.
3.3 Send customer information outside the store only through [approved secure method].
3.4 If a message asks you to change bank details, buy gift cards or sign in to see a file, check with the sender at a number you already have.

Words only go so far. Microsoft 365 management is where sharing settings and sign-in rules back these lines up.

4 Passwords and multi-factor sign-in

4.1 Use a long password you don’t use anywhere else.
4.2 Your login is yours. Don’t share it, not even with a manager at month-end.
4.3 Use multi-factor sign-in on every system that asks for it.
4.4 Approve a sign-in prompt only if you just started that sign-in. If you didn’t, deny it and report it.
4.5 Never give your password or sign-in code to anyone, even someone who says they’re from IT. If someone asks for either, hang up and call [name, phone].

5 Customer information

5.1 Customer information includes driver’s licenses, Social Security numbers, credit applications, deal jackets, bank and card details, and [anything else your store adds].
5.2 Open it only when your job calls for it. Looking up a neighbor, an ex or a coworker’s deal isn’t allowed.
5.3 Keep it where the table below says it belongs. If a customer sends it to you some other way, tell [name] and don’t pass it along.
5.4 Deal jackets and credit applications stay in [locked place] when you aren’t working on them.
5.5 Paper with customer information goes in [shred bin], never the trash.

Line 5.2 is the plain-words version of a line in the FTC Safeguards Rule, which says to limit users’ access “only to customer information that they need to perform their duties and functions.”

6 Wi-Fi, USB drives and remote access

6.1 Company devices use [staff Wi-Fi name]. Customers and personal devices use [guest Wi-Fi name].
6.2 Don’t plug in a USB drive you found or were handed. Customer information never goes on one.
6.3 Work from outside the building only through [approved remote access], with multi-factor sign-in.
6.4 On public Wi-Fi, [use the VPN / use your phone’s hotspot / don’t open dealership systems].
6.5 Don’t give a caller control of your screen, even one who says they’re from IT, until you’ve checked with [name].

7 Approved software and AI tools

7.1 Use only the software on [where the approved list lives]. To add something, ask [name].
7.2 Don’t install apps, browser add-ons, or free or unlicensed software on a company device.
7.3 Keep customer and employee personal information out of AI tools, above all personal AI accounts. Our AI use policy names the approved tools and any exception.

8 Monitoring

8.1 Company email, internet access, phones and devices may be monitored and logged. Don’t expect privacy on them.
8.2 The types of monitoring we use are [list them, as your attorney advises].
8.3 [State notice wording from your attorney, if your state requires it.]

Notice rules differ by state, and three of them are spelled out below. Leave 8.3 to counsel.

9 Reporting a problem

9.1 Tell [name, phone] right away if you clicked something odd, lost a device, saw a strange login or sent customer information to the wrong place.
9.2 Don’t try to fix it or delete anything. Make the call first.
9.3 You won’t get in trouble for quickly reporting an honest mistake.

A serious report moves to your incident response plan. Name the same person in both documents.

10 Signing it

10.1 Breaking these rules can lead to [discipline, up to and including termination].
10.2 Nothing here stops you from talking about pay, hours or working conditions, or from reporting a concern to a government agency.
10.3 We’ll go over this policy with you at hire and [how often], and ask you to sign again when it changes.
10.4 I’ve read this policy and had the chance to ask questions. [Name, signature, date]

The first half of line 10.2 is there because the National Labor Relations Act gives employees the right to act together for “mutual aid or protection.” Your attorney may want different wording for either half.

Section 5

Where Can Customer Information Go at a Dealership?

Only into the systems and locked places your store has approved, and never onto anything personal. This table goes document by document, starting with the license copy at the desk. Swap in your own systems where you see brackets.

The information	Where it may go	Where it may not go
Driver’s license copy	The DMS or [approved deal system], or the paper deal jacket.	A photo on a personal phone, a text message or personal email.
Credit application	The lender portal or [approved credit system], or the locked deal file.	Regular email, a shared desk folder or an AI tool.
Deal jacket	[Locked file room] or [approved scanning system].	Left out on a desk overnight, or taken home.
Social Security, bank and card numbers	Only the fields built for them in the DMS or [payment system].	Sticky notes, spreadsheets, or anything typed into a chat.
Customer list from the CRM or DMS	[Approved shared location], with [manager]’s approval.	A USB drive, a personal cloud account or a personal phone.
Repair history tied to a name or VIN	The DMS or [approved service system].	A public AI tool or a personal AI account.
Employee and payroll files	[HR system] or the locked HR file, for the people who handle them.	Shared drives, group texts or a manager’s personal email.

This table is the employee’s version of the data rules in your written information security program.

Do You Have to Tell Employees You Monitor Them?

In some states, yes. Connecticut, Delaware and New York each have a statute on notice of electronic monitoring, and each one words it differently. That’s why section 8 of this acceptable use policy template leaves the state wording to your attorney.

A signed policy may carry part of that notice, but only counsel can tell you whether yours is enough. Your own state may have other rules, and a group with stores in several states could be under more than one.

Ask before you monitor.

Connecticut

Conn. Gen. Stat. 31-48d calls for “prior written notice to all employees who may be affected,” naming the types of monitoring, and a notice posted where staff can see it.

The statute says the posting counts as that notice.

Delaware

19 Del. C. 705 accepts a one-time notice the employee acknowledges, in writing or electronically, or an electronic notice at least once each day the employee uses employer-provided email or internet.

There are two routes, and a signed page fits the first.

New York

N.Y. Civil Rights Law 52-c requires “prior written notice upon hiring,” acknowledged by the employee, plus a notice posted in a conspicuous place.

In New York it starts at hire.

Who’s Behind This Acceptable Use Policy Template

2,000+ Automotive and heavy truck dealerships

35,000+ Dealership employees supported daily

98% Client retention rate

1997 Working only with dealerships since

Helion Technologies has worked only with automotive and heavy truck dealerships since 1997. Managed IT, cybersecurity and compliance run as one team here, so the rules in this policy and the controls behind them can sit with one owner instead of several.

How to Roll Out an Acceptable Use Policy Staff Will Remember

A policy is only as good as how you communicate it. If someone signs it during onboarding and never hears about it again, the signature is about all you’ve got. So plan on repeating it, and put it in your security awareness training, which the Safeguards Rule already asks for.

1
Fill it in with your managers
Write the brackets with your general manager, your controller and whoever runs IT, so the rules match how the store works.
2
Have your attorney read it
Monitoring notice and discipline wording need a legal eye, in every state where you have a store.
3
Walk through it at hire
Don’t just hand it over in a stack. Point out sections 2 and 5, then get the signature.
4
Keep bringing it up
Use a line or two in training and at staff meetings. When the policy changes, everyone signs again.

Common Questions

Three dealership employees at a break room table going over printed policy pages together

Finished the policy?

A complimentary IT and cybersecurity assessment reviews the technology behind it, including AI tool use in personal accounts, and puts the findings in a written report.

What should an acceptable use policy include?

The rules a person needs on an ordinary workday, plus who to call and a signature. At a dealership that means personal phones and deal jackets, not just passwords. The ten sections above are a starting point, and your store can add its own.

Does the FTC Safeguards Rule require an acceptable use policy?

16 CFR 314.4 doesn’t use those words. It does call for limiting each user’s access to the customer information they need, monitoring and logging user activity, and security awareness training. A signed policy is one way to put those in front of staff, and it can sit behind your written program.

Can employees use personal phones for work?

That’s your call, but say so in writing either way. We’d steer you toward company devices where you can. If phones stay in the mix, line 2.3 names the apps allowed and line 2.4 keeps customer information off the phone itself.

Do we need an attorney to review this?

Yes. This template isn’t legal advice, and we aren’t your lawyers. Employment and monitoring rules change from state to state, so have counsel read your filled-in version, sections 8 and 10 above all, before anyone signs.

How is this different from a WISP or an AI policy?

Think of who reads each one. A WISP is the program document for the people running security. An AI use policy goes deep on one subject. This one is short enough for every employee to read and sign, and it points to the other two.

When should employees sign it?

At hire, and again whenever the policy changes. In New York, an employer that monitors phones, email or internet use has to give written notice upon hiring. Signing isn’t the end of it, though. Step 4 above keeps the policy in front of staff.

Can Helion write the policy for us?

The final policy is yours. Helion guides you and supplies templates, and we’ve helped a few clients write basic AI language into their policies. Our complimentary assessment also looks at whether staff are using AI tools in personal accounts outside your security controls.

Your policy says what’s allowed. A complimentary assessment looks at the technology behind it and puts what it finds in a written report.

Get Your Complimentary IT & Cybersecurity Assessment →