Personal Devices for Work: What to Allow and Avoid

Let employees use personal devices for work only for approved tasks, in approved apps, and only when the device meets your security rules. Use company-owned hardware for admin duties, sensitive data, or roles that keep large data sets on the device.

In many offices, staff start using their own phones and laptops for work before anyone sets a policy. They add work email to a phone, pull a file down to a home computer, or log in to a company app from a shared family PC.

Once business data lands on a personal device, you have less say over updates, installed software, backups, and who else touches the device. You also need a clean way to remove company information when someone leaves or the device goes missing.

Personal gear can be part of your setup—but you should decide which devices are allowed, which apps are okay, and what kind of work is permitted.

What BYOD Means in Everyday Work

Bring your own device (BYOD) is when an employee uses a personally owned phone, tablet, or computer to do work.

Common examples:

Adding company email to a personal smartphone
Signing in to Google Workspace or Microsoft 365 from home
Joining video meetings
Opening customer or internal files
Chatting in a business messaging tool
Using accounting, CRM, or project tools
Saving documents to a personal laptop

Depending on the app, data may stay in the cloud or be stored on the device as messages, attachments, cache, or files.

Why Control Is Limited on Personal Devices

Your IT team can lock down company-owned equipment. On a personal device, the employee decides what to install, when to update, who else can use it, and how it’s backed up.

Management tools can apply some rules, but what’s possible varies by device, operating system, app, and how the device is enrolled.

Shared Devices at Home

Home computers and tablets are often shared with partners or kids. Separate user accounts help, but many families still use a single account.

The UK National Cyber Security Centre advises blocking BYOD when staff can’t meet the required controls—for example, if work can’t be kept apart from other family members on the same device. NCSC BYOD guidance

Updates Often Lag Behind

Your managed IT provider may have no reliable way to verify whether a personal device is running a supported operating system or has the latest security patches.

People delay updates for many reasons: low storage, fear an old app will break, or simply because the device is rarely rebooted.

Work Files Can End Up in Personal Storage

A document saved from work email or cloud storage can sit in Downloads, a personal folder, or get swept into a personal backup.

A personal cloud backup might sync that file to an account you don’t control. Opening the file in a personal app can create yet another unmanaged copy.

Other Apps May Peek at Work Data

Employees install the apps they want on their own devices. Some apps request access to files, contacts, browser data, or clipboard contents.

Most businesses don’t have an inventory of these apps or visibility into what they can reach.

Repairs Can Expose Company Information

When a personal phone or laptop breaks, employees may choose any repair shop. Email, remembered sessions, or downloaded files could still be present on the device.

Spell out who employees should contact before a repair, and what to do if the device can’t be unlocked.

Data Can Linger After Employment Ends

Turning off an account stops future logins to many cloud services. It does not clean up files that were saved to personal folders, opened in unmanaged apps, or synced to personal storage.

Using managed work profiles and protected apps makes removal easier—but they can only wipe what they manage.

Set Rules for Personal Devices for Work

Decide access by the task and the sensitivity of the data.

For example, you might permit reading email in an approved mobile app but require a company-issued computer for exporting customer lists. Roles that handle finances, health data, legal work, or large volumes of customer records often need company hardware.

Administrative work should be done on a managed device. Anyone who manages user accounts, security settings, backups, or core systems should not do that from an unmanaged personal computer.

Apply these same rules to contractors. Give them only the apps and data they need.

Security Basics for Personal Devices

Only allow access from personal devices that meet your minimum standards.

Require a Supported Operating System

Only permit devices that still receive security updates. Block access from devices that can’t install current patches.

Keep Updates On

Turn on automatic updates for the operating system and key apps. Employees should reboot when an update requires it.

Turn On a Screen Lock

Require a PIN, password, fingerprint, or face unlock. Set the device to lock itself after a short period of inactivity.

Encrypt the Device

Encryption protects stored data if a device is lost or stolen. The Australian Cyber Security Centre recommends full-device encryption when personal gear might hold work information. Cyber.gov.au BYOD guidance

Encryption has to be enabled before a loss, and it should be paired with a strong device PIN or password.

Use Two-Step Login

Require two-step login (multi-factor authentication) for email, cloud storage, and other important systems. The NCSC treats this as a minimum for BYOD access.

Use two-step login to protect sign-ins, and use encryption plus managed apps to protect any data stored on the device.

Block Rooted or Jailbroken Devices

Removing built-in operating system restrictions weakens security. Don’t allow these devices to access company data.

Detection isn’t perfect, so pair this control with the other safeguards in this article.

Approve the Apps Used for Work

Tell employees which apps to use for email, messaging, files, and other tasks.

Where your management tools support it, stop users from saving work data to personal storage or pasting it into unmanaged apps.

Use Separate Logins on Shared Computers

If someone uses a personal computer for work, give them their own user account. Other family members should sign in with their own accounts and not have the employee’s password.

Skip BYOD entirely if work cannot be kept separate from other users of the device.

Make Reporting Easy

Employees should know exactly who to contact if a device is lost, stolen, repaired, replaced, or possibly infected.

Fast reporting gives you time to cut access, review account activity, and remove managed data.

Keep Company Data in Managed Apps or Work Profiles

Device and app management can separate work from personal data.

Mobile device management (MDM) applies settings to an enrolled device and can report whether it meets your requirements. The level of control varies by platform and enrollment type.

Mobile application management (MAM) focuses on supported work apps and their data. Depending on the product, it can block copying, prevent saving to personal storage, require an extra PIN, or remove company content from managed apps.

For instance, Microsoft Intune can wipe company data from protected apps if a device is lost or an employee departs, while leaving personal content intact.

Note that selective wipes can only remove data they manage. They can’t touch files that were copied into personal apps, personal backups, or unsupported locations.

A factory reset erases everything—personal and work. Microsoft cautions admins about using full device management on hardware the business doesn’t own. Prefer selective removal when possible, and be clear with employees about what your tools can view and control. Microsoft Intune planning guide

What Your BYOD Policy Should Cover

Your policy should answer:

Which employees and contractors are allowed to use personal devices?
Which device types are permitted?
What tasks can be done on them?
Which approved apps must be used?
Are users allowed to download or store company files locally?
Can the device be shared with others in the household?
Which security settings are mandatory?
What company or IT data can be seen about the device?
Which settings can the business change or enforce?
Can company data be removed remotely?
What is the plan if the device is lost or stolen?
What must happen before the device is repaired or sold?
What happens at offboarding?
Who covers cellular data, repairs, or a replacement device?

Privacy, employment, and data protection laws differ by location. Ask for a legal review wherever you have employees.

Have employees read and accept the policy before work access is added to their devices.

If a Personal Device Is Lost or Stolen

Have the employee alert the business or your IT provider right away.

Your response may include:

Cutting off access if the device can’t be found
Revoking any active sign-in sessions
Removing company data from managed apps
Taking the device off any approved-device list
Reviewing account activity for unusual logins
Resetting passwords or keys that might be exposed
Noting which company files may have been stored on the device

Remote lock or wipe commands only work when the device comes back online and checks in with the management service. A device that never powers on or connects won’t receive the command.

That’s why encryption and strong account controls are still required.

When an Employee Leaves

At the agreed time, disable the user’s account and sign them out everywhere. Remove business data from managed apps or work profiles.

Confirm whether any files were saved locally and agree on how those copies will be returned or destroyed.

Update your records to show the device is no longer approved. If your tools support it, remove business apps, certificates, email profiles, and VPN settings.

When to Say No to Personal Devices

Issue company hardware when:

The role handles sensitive information
The job needs admin-level access
Large data sets must live on the device
The device is shared with others
The operating system is out of support
Encryption can’t be enabled
You can’t keep business data separate or remove it later
The employee won’t accept required controls
The device is rooted or jailbroken

Company-owned devices are easier to support because their settings and software are known.

Frequently Asked Questions

Can staff use a web browser without enrolling their device?

You can allow browser-only access, but traces can remain—cache, Downloads, saved passwords, screenshots, and active sessions.

Conditional access can limit which devices and browsers may connect. Highly sensitive work should still use a managed device.

Is two-step login enough to secure a personal device?

Two-step login protects accounts. Device encryption protects stored files, and managed apps control how work data is handled.

You also need current updates, screen locks, approved apps, and a clear lost-device process.

Can the company see an employee’s personal information?

It depends on the approach. App-level management focuses on work apps and their data. Full device enrollment can reveal device details and enable wider control.

Give employees a written summary of what IT can view, change, lock, or erase before they enroll.

Can the business erase a personal phone?

Some enrollment types allow a factory reset; app-only management does not. A factory reset clears personal data along with company data.

Use selective wipes on employee-owned devices when available.

Is BYOD cheaper than buying company devices?

BYOD can reduce hardware purchases, but it can add costs for management, support, security, and admin time. Savings depend on which devices, apps, and tasks you allow.

Sources and further reading

If your team already uses personal devices for work, ask your IT provider to review what they can access and whether the right safeguards are in place.

If you’d like help setting a clear BYOD plan for offices around Panama City and Bay County, get in touch with Flux Labs.

—

Featured Image Credit