BYOD Security | Can Staff Use Personal Devices for Work?

A smiling woman sitting at a desk with an open laptop, holding a smartphone near her face to speak or listen.

0 comments

It usually starts innocently enough. An employee asks to add their work email to their personal smartphone, or they download a quick file to their home laptop to finish a task over the weekend. Before your business has even formally discussed it, a Bring Your Own Device (BYOD) culture has organically taken root.

While letting staff use their own devices is incredibly convenient, it presents a major security challenge. Once your business data is stored on a personal laptop or phone, you instantly lose control over software updates, which apps are installed, where files are backed up, and who else has access to the device. Furthermore, you need a reliable way to securely wipe that company data when the device is lost or the employee leaves the business.

Allowing personal devices for work is perfectly fine, provided you establish clear rules about which devices, applications, and types of work are actually permitted.

What “Bring Your Own Device” Actually Includes

BYOD means an employee is using a personally owned smartphone, tablet, or computer to carry out company work. This typically includes:

Adding a work email account to a personal phone.
Signing into company portals like Microsoft 365 or Google Workspace.
Joining business video calls and online meetings.
Opening, editing, or saving customer and company files.
Using business messaging platforms like Teams or Slack.
Logging into accounting, CRM, or project management software.

Depending on how the applications are set up, your business information might remain securely in the cloud, or it could be downloaded locally to the personal device as saved messages, cached data, attachments, or loose files.

The Hidden Risks You Cannot Fully Control

On a company-owned device, your IT team can easily enforce strict security policies and monitor for threats. On a personal device, the employee makes the decisions: they choose which sketchy apps to install, when (or if) they bother to update their operating system, and where their files are backed up.

Other people may use the device: An employee might share their home computer or iPad with a partner or child. While setting up separate user profiles helps, many families just share one main account, meaning anyone in the house could accidentally access or delete your business data. The UK National Cyber Security Centre (NCSC) explicitly advises against BYOD access if an employee cannot keep their work separate from family users.

Critical updates are often missing: Your IT provider cannot easily check if a personal laptop has the latest security patches. Employees often ignore update prompts because their phone is low on storage or they just don’t want to wait for it to restart.

Business files mix with personal storage: A sensitive document downloaded from a work email might end up sitting in a personal “Downloads” folder forever. From there, a personal iCloud or Google Drive backup might copy that file to a private account that your business has absolutely no control over.

Unapproved apps can snoop on your data: Employees install a wide variety of personal applications, and some of those request extensive permissions. You simply do not know which personal apps are quietly reading their files, contacts, browser history, or copied clipboard text.

Third-party repairs expose data: If an employee drops their phone and takes it to a local high-street repair shop, your business emails, saved logins, and downloaded files could be completely exposed to the technician working on it.

Company data lingers after employment ends: Disabling a former employee’s main login account stops them from accessing cloud services in the future, but it does absolutely nothing to wipe the copies of documents they already downloaded to their personal folders.

Setting the Boundaries: Decide What Work is Allowed

Access should always be granted based on the specific work being performed and the sensitivity of the information.

For example, it might be perfectly acceptable to let an employee check their work email via an approved mobile app on their personal phone. However, exporting a massive customer database or handling payroll should strictly be limited to a secure, company-owned computer.

Crucially, administrative IT work must always be performed on a fully managed device. Nobody responsible for managing user accounts, backups, or security settings should ever be logging in from an unmanaged home computer. These exact same rules must also apply to outside contractors.

Non-Negotiable Security Rules for Personal Devices

If an employee wants to use their own device for work, it must meet specific security requirements before any access is granted:

Use a supported operating system: The device must run an OS that still actively receives security updates from Apple, Microsoft, or Google. Block any older devices that are obsolete.

Install updates promptly: Auto-updates should be enabled, and staff must restart their devices when required.

Require a screen lock: The device must be protected by a strong PIN, password, fingerprint, or facial recognition, and it must lock automatically when idle.

Require device encryption: If the device is lost on a train, encryption is what stops a thief from reading the files on the hard drive. The Australian Cyber Security Centre recommends full-device encryption for any personal device handling business info.

Enforce MFA: Multi-Factor Authentication (MFA) must be enabled for work emails and cloud storage. The NCSC views MFA as an absolute minimum requirement for BYOD setups.

Block rooted or jailbroken devices: “Jailbreaking” a phone strips away its built-in security protections. These devices must be banned from accessing company networks.

Use separate accounts on shared PCs: If using a family computer, the employee must have a dedicated, password-protected Windows or Mac profile that the rest of the family cannot access.

Mandate reporting: Staff need a clear, blame-free process for reporting if their personal device is lost, stolen, or infected with malware so your IT team can quickly sever its access.

Take Back Control with Managed Apps (MDM & MAM)

You don’t need to take over an employee’s entire personal phone to keep your data safe. Mobile Application Management (MAM) applies security controls solely to the work apps.

Using tools like Microsoft Intune, you can prevent an employee from copying text out of a business email and pasting it into a personal app, or block them from saving company documents to their personal iCloud. Most importantly, if the employee leaves, you can trigger a “selective wipe” that instantly deletes all company data from the protected apps without touching their personal family photos.

If you use Mobile Device Management (MDM) to manage the entire device, be transparent. Microsoft warns that applying full device management to personal phones can be risky, so clearly explain to employees exactly what your IT team can and cannot see before they enrol.

Building Your BYOD Policy

Never allow BYOD without a formal, written policy. Your document needs to clearly answer:

Which employees and contractors are eligible?
Which devices and applications are permitted?
Can company files be downloaded locally?
What happens if the device is lost, stolen, or sold?
What happens to the data when the employee leaves?
Who pays for the mobile data, repairs, or replacements?

When to Say No to Personal Devices

Sometimes, BYOD is simply too risky. You must provide a secure, company-owned device when:

The employee handles highly sensitive financial, legal, or health information.
Their role requires high-level administrator access.
Large amounts of company data must be downloaded locally.
The employee’s personal device is too old to receive security updates or cannot be encrypted.
The employee does not agree to your security controls.

Frequently Asked Questions

Can employees use a web browser without enrolling their personal device?

You can allow basic browser access, but remember that business information might still be left behind in their browser cache, saved passwords, or their Downloads folder.

Is MFA enough to secure a personal device?

No. While MFA protects the account login, it does nothing to protect the files stored on the device itself. You still need device encryption, screen locks, and a process for lost devices.

Can the business see an employee’s personal information?

It depends entirely on how the device is managed. Application management (MAM) only looks at the business apps and data. Full device enrolment (MDM) gives the business broader control. Always give staff a written explanation of exactly what IT can see.

Can the business erase a personal phone?

Some full-management methods allow IT to trigger a factory reset, wiping everything (including personal photos). However, it is much safer to use “selective removal” tools that only delete the isolated company data.

Is BYOD cheaper than providing company devices?

It saves you the initial cost of buying a laptop or phone, but it can quickly add hidden costs in management software, technical support, and complex security administration.

Secure your team’s devices—whether they are yours or theirs

Managing the fine line between employee privacy and business security doesn’t have to be a headache. If you want peace of mind knowing your digital storefront and backend data are fully protected across every device, Novo IT is here to help. As a family-run business based in Crawley, we provide proactive Cybersecurity and Managed IT Services to small businesses across West Sussex. We can assess your current setup, implement safe BYOD policies, configure Mobile Device Management, and lock down vulnerabilities so you can focus on running your business.

👉 Ready to secure your digital presence? Book your Free IT Audit today, and let our friendly, expert team secure your data no matter where your team is working.

Article used with permission from The Technology Press.