What to Delete
Seven categories that appear in almost every policy and earn their place in almost none.
Internet use in general
Never enforced
As written
Employees must use the internet responsibly and in accordance with the company's values.
What happens
Means nothing operationally. Has never been the basis of any conversation with anybody.
Quoted occasionally in disputes about something else, which is the only use it has ever had.
Delete. If responsible use matters, say what specifically is not acceptable.
Most policies are long because nothing has ever been removed. These seven categories account for most of the excess.
The drafting lesson in “What to Delete” should carry into any workforce platform rollout. When an organisation evaluates further details are available here for fireable offenses, it should state which operational question the data answers, what is excluded, who may review it and when the setting will be reconsidered instead of relying on a broad reservation of rights.
Statements of values
Employees must act professionally, responsibly, in accordance with company values.
For a separate benchmark relevant to “What to Delete”, consult the Cloudflare insider-threat overview. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
Unactionable, unenforceable as drafted, and present in essentially every policy. Nobody has ever been spoken to on the strength of one.
Duplicates of law
Clauses prohibiting conduct that is already unlawful: harassment, fraud, accessing material that is criminal to possess.
Restating them adds nothing to the prohibition and dilutes the clauses that are specific to this organisation. A single line noting that unlawful conduct is also a breach covers it.
Technology that no longer exists
Faxes, removable floppy media, specific products retired years ago.
Harmless and a reliable signal to the reader about how current the document is.
Clauses written for one incident
A paragraph added after something happened, phrased around the specifics of that event, applying to nothing else.
These are identifiable by their oddly particular wording. Either generalise them or remove them.
Overlapping prohibitions
Three clauses about data leaving the organisation, written at different times, with different scope.
Consolidate into one. Overlap creates arguments about which applies and gives whoever is quoting a choice.
Requirements to understand or be aware
Employees must be aware of, must understand, must familiarise themselves with.
A document cannot create awareness and cannot verify it. These are hopes dressed as obligations.
Anything nobody can explain
The audit test: for each clause, why is this here?
Where the answer is that it came from a template or that nobody knows, delete it. If it turns out to have mattered, it will come back with a reason attached, which is more than it has now.
What deletion costs
Nothing legally. Removing a clause does not create permission; conduct that is unlawful or damaging remains so.
What it costs is the discomfort of removing something that might one day have been useful, which is the reason nothing is ever deleted and the reason policies are the length they are.
Nothing legally. Removing a clause does not create permission: conduct that is unlawful or damaging remains so, and the disciplinary procedure does not depend on the policy enumerating everything.
Why nothing is ever removed
Because every clause has somebody who can imagine a use for it. The forcing requirement of five deletions per review is what overcomes that, and after the first round they are rarely hard to find.
Requirements to be aware
Must be aware of, must familiarise themselves with, must understand. A document cannot create awareness and cannot verify it, which makes these hopes dressed as obligations.
The hardest category to delete
Clauses that might one day be useful. Every dormant clause is in this category by definition, and the imagined future use is why nothing is ever removed.
The answer is that an unused clause will not be useful on the day it is needed, because the inconsistency argument will defeat it. A clause worth having is one being applied; a clause being saved for later is one that will fail when later arrives.
The deletions that feel hardest are usually the oldest, because nobody remembers why they are there and nobody wants to be the person who removed something that turned out to matter. The audit answers that: a clause nobody can explain and nobody has applied has already demonstrated what it is worth.