Acceptable Use of Information Technology

All Policies › Information Technology › Acceptable Use of Information Technology

Responsible Office

Vice President for Strategic Operations & Human Resources

Policy Owner

Executive Director of Innovation & Technology

Policy Contact

Executive Director of Innovation & Technology

Issued

2020-06-11

Last Revised

2026-10-01

On this page: Policy Statement · Reason for Policy · Policy Scope · Procedures · Frequently Asked Questions · Forms · Appendices · Additional Contacts · Definitions · Responsibilities · Related Information · History

Policy Statement

The university provides information technology resources to its faculty, students, staff, and some affiliates and guests to advance its mission. In addition, authorized users may also use IT resources for appropriate incidental personal use so long as those activities are legal and do not violate: university policies; contractual obligations; the safety, security, privacy, reputational, and intellectual property rights of the university or others; or restrictions on political or commercial activities that are applicable to not-for-profit organizations like the university.

Every user bears the responsibility for knowing and complying with applicable laws, policies, and rules; for appropriately securing their computers and other electronic devices from misuse or theft by others; and for avoiding any use that interferes with others’ legitimate access to and use of IT resources.

Acceptable Use

Acceptable use is always ethical, reflects academic honesty, and shows restraint in the consumption of shared resources. Acceptable use demonstrates respect for intellectual property, ownership of data, system security mechanisms, and individuals’ rights to privacy and to freedom from libel, slander, intimidation, discrimination, and harassment.

All users are individually responsible for appropriate use of all IT resources assigned to them, including their account, computer and/or devices, the network address or port, software, and hardware. Therefore, all users are accountable to the university for all use of such resources. As an authorized user of IT resources, users may not enable unauthorized users to access the network by using a university computer or a personal computer that is connected to the university network without appropriate permission from the Executive Director of Innovation & Technology or their designee.

Departments and users that grant guest access to IT resources must make their guests aware of their acceptable use responsibilities. The university accepts no responsibility or liability for any personal or unauthorized use of its resources by users.

Accounts

The university assigns accounts to individuals and prohibits account sharing unless specifically authorized by IT. All users are solely responsible for all functions performed from accounts assigned to them.

Users are responsible for protecting passwords, any other security mechanisms the university provides, and following safe computing practices. Users will be held responsible for any activity that occurs using accounts assigned to them, so it is vital to not share access or passwords.

Copyright and Licenses

Users must abide by all applicable copyright laws and licenses. The university has entered into legal agreements or contracts for many of our software and network resources which require everyone using them to comply with those agreements.

Users must observe the law as it applies to copyrighted works in both personal use and in production of electronic information.

Shared Resources

The university recognizes that technology is essential to the work conducted at the university. The university also recognizes incidental personal use of university IT resources, as long as this use does not interfere with the performance of duties or other university responsibilities, does not consume a significant amount of those resources, and does not violate any other university policies. Supervisors may impose further limits on computer use for non-work purposes, in accordance with normal supervisory procedures.

The university may choose to set limits on an individual’s use of a resource through quotas, time limits, and other mechanisms to ensure that these resources can be used by anyone who needs them.

Unacceptable Use

The following actions are expressly prohibited:

Using another person’s system, account, password, files, or data without appropriate permission.
Using computer programs to decode passwords or access control information or attempting to capture or guess other users’ passwords.
Attempting to circumvent or subvert system or network security measures.
Possession of tools that bypass security or probe security, or of files that may be used as input or output for such tools.
Engaging in any activity that might be purposefully harmful to systems or to any information stored thereon, such as creating or propagating viruses, disrupting services, or damaging files or making unauthorized modifications to university data.
Attempting to intercept, monitor, forge, alter or destroy other users’ communications.
Modifying, without proper authorization, any of the university’s information resources and technology, including the work products of others.
Using university systems for commercial or partisan political purposes.
Making or using illegal copies of copyrighted materials or software, storing such copies on university systems, or transmitting them over university networks.
Wasting IT resources by intentionally placing a program in an endless loop, printing excessive amounts of paper, or by sending chain letters or unsolicited mass mailings.
Attempting to disguise their identity, the identity of their account, the machine that they are using, or attempting to impersonate another person or organization.
Using the university’s assigned Internet number space for their own domain without the prior express permission of IT.
Stating or implying that they speak on behalf of the university or using university trademarks and logos without authorization to do so.
Possessing, distributing, or sending unlawful communications of any kind, including but not limited to threats of violence, obscenity, child pornography and/or harassing communications (as defined by law), or participating in or facilitating communications in furtherance of other illegal activities.
Violating any applicable laws and regulations or university policies, standards, and procedures.

Monitoring and Privacy

The university employs numerous measures to protect the security of its IT resources and users’ accounts but cannot guarantee complete security and confidentiality. The use of university IT resources is not private. While the university does not routinely monitor individual usage of IT resources, the normal operation and maintenance of the university’s IT resources require the backup and caching of data and communications, the logging of activity, monitoring of general usage patterns and other activities necessary or convenient for the provision of service.

In addition, since employees are granted use of electronic information systems and network services to conduct university business, there may be instances when the university, based on approval from authorized officers, reserves and retains the right to access and inspect stored information without the consent of the user.

The university normally will attempt to provide advance notice to the affected individual of access to or the preservation or sharing of data with third parties unless such notification would put the university at risk or is prohibited by law.

The university also maintains the authority to limit access to its networks or to remove material stored or posted on its computers when applicable policies, contractual obligations, or applicable laws are or likely have been violated.

Use of Personal Information Technology Resources

It is essential for all employees to understand that any data, communications, and work product created as part of their duties are classified as university information. This information is the property of the university, regardless of the device used for its creation. This principle of ownership is the reason why all such data is subject to university policies, audit, and legal discovery, and why the following rules must be observed.

All normal university business must be conducted on university-owned and managed IT Resources. This is the primary rule for protecting the university’s information assets.

Prohibited Use of Personal Devices

The use of personal devices and accounts to create, process, or store university information is strictly prohibited. This is a critical security measure to protect university assets. Prohibited actions include, but are not limited to:

Storing university documents or data on a personal computer, tablet, or personal cloud service (e.g., personal Google Drive, Dropbox, iCloud).
Using a personal email account (e.g., Gmail) to conduct university business.
Using non-university messaging applications (e.g., WhatsApp, Signal) for work-related communications.

Handling Incidental Use and Employee Responsibility

The university recognizes that minor, incidental contact with university information on a personal device may be unavoidable. However, this does not constitute approval to work on that device.

Any university information on a personal device, even temporarily, may be subject to audit and legal discovery processes such as subpoenas. Therefore, if university information is stored on a personal device, the employee must take immediate action to transfer that information to an approved university system. Following a successful transfer, all copies must be securely and permanently deleted from the personal device.

Authorized Exceptions for Personal Smartphones

In situations where a university-provided device is not available, the following limited exceptions are authorized for personal smartphones only:

University Email and Calendar: Employees are permitted to access university email and calendars exclusively through the official Microsoft Outlook application.
Collaboration and Messaging: Employees are permitted to use the official Microsoft Teams application for university-related communication and collaboration.
Work-Related Photos and Videos: An employee may use a personal smartphone’s camera for legitimate university business, but the files must be handled according to the following requirements: (1) promptly transfer the files to an approved university storage location (e.g., OneDrive); (2) permanently delete the files from the personal device after confirming the transfer; and (3) ensure the capture and use of images comply with all university privacy policies.

Protecting Information in Public

All employees have a duty to protect university information in any environment where unauthorized individuals could view it.

In Public or Shared Spaces, employees are required to be aware of their surroundings, position screens to prevent observation, use a privacy screen filter when possible, lock their device when away, and avoid discussing sensitive information where they can be overheard.
On Public or Non-University Computers, use is highly discouraged. If emergency use is unavoidable, the employee must use private/incognito mode, never download files, actively sign out of all applications, and clear the browser’s cache, cookies, and history.

Recording and Wearable Devices

Technology that captures audio, video, images, or transcripts creates risks for privacy, confidentiality, FERPA compliance, and academic integrity. The university governs recording by what a person captures and the circumstances of that capture, not by the device a person uses. Smart glasses, wearable cameras, AI-enabled eyewear, earpieces, smartphones, computers, and AI transcription services all fall within these requirements.

Notice Requirement

Members of the university community must not record a university activity without making the recording apparent to all participants. A person who records must either inform participants before recording begins, or use the recording device in an overt and conspicuous manner so that participants readily recognize that recording occurs.

Prohibited Recording

Members of the university community must not record in the following circumstances, regardless of notice:

Restrooms, locker rooms, shower areas, changing areas, lactation spaces, and any other space where individuals hold a heightened expectation of personal privacy.
Counseling offices, health services areas, and medical treatment facilities.
Any meeting, appointment, or workspace that university personnel designate as confidential.
Testing centers and any instructional space during an academic assessment, quiz, examination, or proctored activity.
Any work area, service counter, or office where personnel routinely handle, display, or discuss Confidential or Restricted data (Data Level 2 or 3, as defined in the Information Security policy).

Members of the university community must not use any device or service to capture unpublished research, proprietary information, trade secrets, or other confidential research activity without authorization. Members of the university community must not use recording to target, intimidate, harass, or conduct covert surveillance of any member of the university community, and must not collect or transmit biometric data, including data derived from facial recognition or voiceprint analysis, without the explicit, informed consent of those identified.

Concealment

Members of the university community must not conceal or misrepresent whether a device records. A person who states that a device does not record, or who obscures a device’s recording indicator while present in a prohibited setting or after receiving direction from authorized university personnel, violates this policy independent of any violation involving the recording itself.

Faculty and Supervisor Authority

Faculty members may prohibit recording devices in their classrooms or require that recording functions remain disabled during any class session. Supervisors hold equivalent authority within their areas of responsibility. Faculty members and supervisors may prohibit recording whenever privacy, confidentiality, security, research, or compliance concerns exist.

Members of the university community must comply immediately when a faculty member, supervisor, or Campus Safety officer directs them to stop recording, power off a device, or remove a device. A person who disagrees with that direction may raise the concern with a supervisor or the Office of Innovation & Technology afterward.

Academic Assessments

Members of the university community must power off or remove any wearable device capable of capturing assessment content, communicating with external systems, or receiving AI-generated content during all academic assessments. Using any device to capture assessment content, access or receive AI-generated assistance, or transmit assessment materials by any means during an academic evaluation constitutes an academic integrity violation.

Accommodations

Students who hold approved accessibility accommodations that include recording authorizations may record in accordance with the specific terms of their accommodation letter. Students must present accommodation documentation to faculty before recording any course session.

Handling Recordings

Recordings that capture identifiable student information, classroom participation, student responses, or academic performance may constitute education records under FERPA. The person who creates such a recording assumes responsibility for handling that content in compliance with FERPA and university records requirements.

Recordings made for authorized university purposes must transfer to an approved university storage location promptly. Following confirmed transfer, all copies must delete permanently from the personal device and any connected personal accounts.

Members of the university community must not retain, disclose, or distribute a recording containing Confidential or Restricted data without authorization.

Faculty members and supervisors may direct deletion of an unauthorized recording within their areas of responsibility, and the university may require other corrective measures. When a complaint, investigation, or allegation connects to a recording, or when the person who made the recording states that they captured the material to document a concern, no member of the university community may direct deletion of that recording. The matter proceeds to the Office of Strategic Operations and Human Resources, which determines how the university handles the recording.

Third-Party Services

Consumer recording and transcription services transmit captured content to systems that operate outside university control. Members of the university community must not use such services to capture, transmit, or process Confidential or Restricted data. The Using AI at Work policy governs which artificial intelligence tools members of the university community may use for transcription and meeting capture.

Protected Rights

Nothing in this section limits any right protected under state or federal law, including the right of employees to engage in concerted or otherwise legally protected activity.

Violations and Sanctions

Users who violate this policy may be denied access to university IT resources. The university may suspend, block, or restrict access to an account when it appears necessary to do so:

to protect the integrity, security, or functionality of university or other IT resources;
to comply with legal or contractual requirements;
to investigate alleged or potential violations of law or policy including, without limitation, state, federal, or local law;
to investigate any asserted, threatened, or potential complaint or grievance filed or credibly alleged pursuant to law or university rules, regulations, policies, or subject of law enforcement review or investigation; or
to protect the university from liability or disruption.

The university may also refer suspected violations of law to appropriate law enforcement agencies for further investigation or action.

Users who violate the policy may be subject to other penalties and disciplinary action, including expulsion or dismissal, under applicable university rules, regulations, or policies.

Reason for Policy

Technology supports the educational, instructional, research, and administrative activities of the university. Members of the university community who use that technology gain access to valuable resources, to sensitive information, and to internal and external networks. Technology also allows members of the university community to capture, store, and transmit information about one another in ways that carry real consequences for privacy and confidentiality.

The university expects members of its community to use technology responsibly, ethically, and lawfully in everything they do in connection with the university. This policy establishes the requirements that apply to that use.

Policy Scope

This policy governs how members of the university community use technology in the course of their affiliation with the university. The policy applies to:

University information technology resources, wherever a person accesses them.
University information, regardless of the device or account a person uses to create, store, or transmit it.
The use of any device, including personally owned devices, during a university activity.

Individuals covered by this policy include, but are not limited to, university faculty and visiting faculty, staff, students, alumni, guests or agents of the administration, and external individuals and organizations that access university information technology resources.

Procedures

There are no procedures associated with this policy.

Frequently Asked Questions

Q: Can I use my university computer for personal things?

A: Yes, incidental personal use is allowed as long as it is legal, does not violate university policies, and does not interfere with your job or consume significant resources. Your supervisor can set further limits on personal use.

Q: Am I responsible for everything that happens on my university account?

A: Yes. You are responsible for all functions performed from accounts assigned to you. You must never share your password and are accountable for any activity that occurs using your account.

Q: What happens if I use my personal phone for work email?

A: The university prohibits the use of personal devices for normal university business. The only exceptions are for accessing university email through the official Microsoft Outlook app and using the Microsoft Teams app on a personal smartphone.

Q: If I send a work-related text from my personal phone, who owns that message?

A: That text message is considered university information. Any information you create for university business is university information, no matter what device you use. This information must be managed according to university policies and may be subject to subpoena or other audit request.

Q: Is my use of university computers and networks private?

A: No. The use of university IT resources is not private. While the university does not routinely monitor individual use, it does log activity for normal operations and maintenance. The university also reserves the right to access stored information without user consent when authorized.

Q: What are some examples of things I am not allowed to do?

A: Prohibited actions include sharing your password, trying to bypass security measures, using university systems for commercial or political purposes, illegally copying copyrighted material, sending harassing communications, or intentionally disrupting services.

Q: Can I wear smart glasses or other recording-capable devices on campus?

A: Yes. The policy governs recording, not the device. Members of the university community must not record during a university activity without making the recording apparent to all participants, and must not record at all in restrooms, locker rooms, counseling spaces, confidential meetings, testing centers, or work areas where protected university information appears routinely. Faculty may prohibit these devices in their classrooms, and supervisors may prohibit them within their areas of responsibility.

Q: Minnesota is a one-party consent state. Doesn’t that mean I can record without telling anyone?

A: Minnesota law addresses whether recording constitutes a crime. It does not address whether recording violates university policy. The university requires that participants know when recording occurs during a university activity. Recording without that knowledge may result in disciplinary action even when the recording itself breaks no law.

Q: Can I record a class?

A: Students may record class sessions only with permission from the faculty member. Recordings that capture identifiable student information or participation may constitute FERPA-protected education records, which creates legal obligations for whoever made the recording. Students with approved accommodations that include recording authorizations must present that documentation to faculty before recording any session.

Q: Can I use an AI notetaker or transcription service for a meeting?

A: Only Microsoft Copilot, which the Using AI at Work policy identifies as the only meeting assistant approved for university use. Otter.ai, Fireflies.ai, Fathom, Krisp, Zoom AI Companion, and Google Meet transcription do not carry university approval. Using an approved tool does not make a prohibited recording acceptable: the notice requirement still applies, recording remains prohibited where this policy prohibits it, and the data classification requirements still govern. Members of the university community must never input Restricted data (Data Level 3), and must de-identify Confidential data (Data Level 2) before entering it into any AI tool.

Q: What do I do if someone records me without my knowledge?

A: Report the incident to Campus Safety at 612.343.4445 or to the Office of Innovation & Technology at incident@northcentral.edu. Members of the university community must comply when authorized personnel direct them to stop recording or remove a device.

Q: Someone made an unauthorized recording. Should I tell them to delete it?

A: Usually yes. If a complaint, investigation, or allegation connects to the recording, or if the person says they recorded in order to document something, do not direct deletion. Direct them to keep the recording and notify the Office of Strategic Operations and Human Resources.

Q: What happens if I violate this policy?

A: Violations can lead to being denied access to university IT resources. It may also result in disciplinary action, including expulsion or dismissal, and could be referred to law enforcement.

Forms

There are no forms associated with this policy.

Appendices

There are no appendices associated with this policy.

Additional Contacts

Subject	Contact	Phone	Email
Primary Contact	NCU Policy Office	612.343.4170	policy@northcentral.edu

Definitions

Acceptable Use

Use of IT resources that is always ethical, reflects academic honesty, and shows restraint in the consumption of shared resources. Acceptable use demonstrates respect for intellectual property, ownership of data, system security mechanisms, and individuals’ rights to privacy and to freedom from libel, slander, intimidation, discrimination, and harassment.

Authorized Use

Use that the university determines, in its sole and exclusive discretion, is consistent with the education, research, and mission of the university, consistent with effective departmental or divisional operations, and consistent with this policy.

Authorized User

Individuals or entities permitted to make use of university information technology resources, including students, staff, faculty, alumni, guests, sponsored affiliates, and other individuals who have an association with the university.

Confidential Data (Data Level 2)

Internal university information intended for members of the university community with a business need, where unauthorized disclosure could cause moderate harm, as defined in the Information Security policy. Examples include internal procedures and workflow documents, meeting notes, internal communications, draft documents, project timelines, and non-public operational data.

Incidental Personal Use

Limited personal use of university IT resources that does not interfere with an employee’s duties, consume significant resources, or violate any university policies or laws.

Information Technology Resources

Refers to the university’s computing, communications, and other information technology systems and includes all hardware, software (including data and documentation), local area networks, internet systems, access controls, and applications and data stored on such information technology systems and any other electronic device or service that can store, transmit, or receive information. IT resources include, but are not limited to, accounts, passwords, access controls, servers, computers, personal computers, workstations, laptops, mainframes, minicomputers, mobile equipment, land line telephones, wireless devices, media players, storage media, computer networks, connections to network services such as the Internet and web pages, subscriptions to external computer services, networking devices, and any associated peripherals and software, regardless of whether used for educational, research, service, administrative or other purposes. This definition is not all inclusive but rather reflects examples of equipment, supplies and services. This also includes services that are university owned, leased, operated or provided by the University or otherwise connected to university resources, such as cloud and Software-as-a-Service (SaaS) or Infrastructure-as-a-service (IaaS), or any other connected/hosted service.

Normal University Business

Any activity performed by an employee as part of their assigned university duties and responsibilities. This applies to all work related to university operations, research, administration, and instruction. Normal university business includes, but is not limited to:

Creating, editing, or sharing course materials, research data, or administrative documents.
Communicating with students, colleagues, or external partners about official university matters.
Accessing or managing any university data classified as private or institutional.
Conducting university-sponsored research.
Performing administrative tasks such as budgeting, scheduling, or departmental planning.

Personal Information Technology Resources

Any information technology resource, including hardware, software, and services, that was not purchased with university funds and is not centrally managed by the university. This definition is broad and includes, but is not limited to:

Hardware: Personal computers (laptops, desktops), smartphones, tablets, smartwatches, smart glasses and other wearable devices, and removable storage devices (e.g., USB flash drives, external hard drives).
Software & Applications: Any software or application installed on a personal device that was not provided or licensed by the university.
Services & Accounts: Personally-contracted cloud storage services (e.g., Google Drive, Dropbox, iCloud), personal email accounts (e.g., Gmail, Yahoo), non-university messaging applications (e.g., WhatsApp, Signal), and social media accounts.

Recording

The capture of audio, video, still images, or transcribed content of another person, by any device or method, in any format or medium. Recording includes capture through smartphones, cameras, computers, smart glasses, wearable cameras, earpieces, and other wearable technology, and includes transcripts that artificial intelligence services generate.

Restricted Data (Data Level 3)

Information protected by law, regulation, or contract, or whose unauthorized disclosure could cause severe harm to individuals or the university, as defined in the Information Security policy. Examples include student education records protected by FERPA, Social Security numbers and other government-issued identification numbers, protected health information, payment card and financial account numbers, employee personnel and compensation records, and legal and privileged matters.

Security Measures

Actions, tools, and protocols, such as passwords, firewalls, and data encryption, used to protect IT resources and data from unauthorized access, damage, or disruption.

University Activity

Instruction, meetings, appointments, advising sessions, services, university-sponsored events, and any other function the university conducts or sponsors, whether on campus, off campus, or through virtual platforms.

University Information

Any information a member of the university community creates or receives related to university business or a university activity. University information includes text messages, voicemail, email, photographs, recordings, transcripts, documents, and other electronic communications.

User

Any individual authorized to access university IT resources, including students, faculty, staff, affiliates, and guests.

Responsibilities

Users

Review, understand, and comply with policies, laws and contractual obligations related to access, acceptable use, and security of information technology resources.
Consult with university Information Security on acceptable use issues not specifically addressed in this policy.
Protect personal information and personal assets used to access personal information or university data.
Report possible violations of this policy to university Information Security (incident@northcentral.edu).

Data Custodian, Data Owner, Data Stewards

Protect the privacy of users, unless designated as university-approved personnel to monitor, examine, or disclose this information.
Respond to questions from users related to appropriate use of information technology resources.
Work with university Information Security to investigate alleged violations of this policy.
Report possible violations of this policy to university Information Security (incident@northcentral.edu).

Department Heads and Supervisors

Work with university Information Security to investigate alleged violations of this policy.
Report possible violations of this policy to university Information Security (incident@northcentral.edu).
Determine whether recording may occur within their areas of responsibility and communicate that determination to affected individuals.
Escalate any unauthorized recording connected to a complaint, investigation, or allegation to the Office of Strategic Operations and Human Resources rather than directing deletion.

Faculty

Determine whether recording may occur in their classrooms and communicate that determination to students.
Review accommodation documentation presented by students before permitting recording in a course session.
Escalate any unauthorized recording connected to a complaint, investigation, or allegation to the Office of Strategic Operations and Human Resources rather than directing deletion.

Information Technology

Investigate possible violations of this policy.
Refer alleged violations to appropriate university offices and law enforcement agencies for resolution or disciplinary action.
Ensure that appropriate and timely action is taken on alleged violations.
Coordinate with Internet Service Providers and law enforcement agencies on violations of this policy.

IT Leadership

Designate individuals who have the responsibility and authority for information technology resources.
Designate individuals who have the responsibility and authority for establishing policies for access to and acceptable use of information technology resources.
Designate individuals who have the responsibility and authority for monitoring and managing system resource usage.
Designate individuals who have the responsibility and authority for investigating alleged violations of this policy.
Delegate authority and responsibility for investigating violations of this policy.
Designate individuals who have the responsibility and authority to refer violations to appropriate university offices or law enforcement agencies for resolution or disciplinary action.
Designate individuals who have the responsibility and authority to employ security measures and ensure that appropriate and timely action is taken on acceptable use violations.

Related University Policies

Related Legislation

Family Educational Rights and Privacy Act (FERPA)
Gramm–Leach–Bliley Act (GLBA)
Computer Fraud and Abuse Act, 1986
Electronic Communications Privacy Act
Minnesota Statutes §626A.02 (Privacy of Communications)
Payment Card Industry Data Security Standard (PCI DSS)

Other Related Information

Safe Computing

History

Amended

2026-10-01 – Non-substantive updates (e.g., titles and copy errors); updated data classification terms to match the Information Security policy.

2026-09-09 – Consolidated recording provisions, broadened policy scope, and added definitions for recording and data classification.

2025-08-11 – Added clarifying language around the use of personal technology resources and the ownership of university data/work made for hire.

Issued

2020-06-11

← Information Technology Policies

All Policies

Admissions

Visit Our Campus

Life at NCU

Visit Our Campus

About

Giving at NCU