Most small businesses do not have a BYOD policy. They have a habit. Somebody asked if they could get work email on their phone, somebody said sure, and now half the staff has company email, files, and customer messages on phones the business does not own and has never looked at.

That is usually fine right up until one of two days. The day a phone gets left at a ball game, or the day someone leaves the company and their phone still has three years of company email on it. A BYOD policy is how you decide ahead of time what happens on those days, instead of finding out.

Let me walk through how this usually goes, what you can and cannot control on a phone that is not yours, and the questions your BYOD policy needs to answer.

How a BYOD policy usually starts: after the fact

BYOD stands for bring your own device. It just means an employee uses their own phone, tablet, or computer for work.

In most offices it starts small. Work email goes on a personal phone so someone can answer customers after hours. Then Teams goes on it. Then somebody opens a customer file on the home laptop the kids also use. Nobody decided any of this. It happened one reasonable request at a time.

By the time anyone thinks about a BYOD policy, the business information is already out there, on devices nobody at the company set up. That is not a reason to panic. It is a reason to write down the rules now, while nothing has gone wrong.

What counts as using a personal device for work

It is broader than most owners think. If any of these happen on a device the employee owns, you have BYOD whether you meant to or not:

• Company email on a personal phone
• Signing in to Microsoft 365 or Google Workspace from a home computer
• Joining work meetings from a personal tablet
• Opening customer or company files
• Using a business messaging app
• Logging in to the accounting, scheduling, or customer management system
• Downloading work documents to a personal laptop

Some of that information stays in the cloud. A lot of it does not. Attachments get saved, files get downloaded, and apps keep copies so they open faster. Those copies are what a BYOD policy is really about.

What you give up when the device is not yours

On a company laptop, we control the updates, the security software, and what gets installed. On a personal phone, the employee does. I want to be honest about this part, because it is the part people skip: you cannot fully control a device you do not own. A good BYOD policy narrows the gap. It does not close it.

Here is where the gap shows up, and where your BYOD policy has to fill in:

• Other people use it. The home computer is shared with a spouse and kids, often on one account. The UK’s National Cyber Security Centre says plainly that BYOD access should not be allowed when work cannot be kept separate from other family users. Their guidance on BYOD costs and security uses exactly that example.
• Updates get put off. The phone is out of storage, or the employee is worried an update will break something, so it sits a version behind for months.
• Files land in personal storage. An attachment saved to the phone gets copied into the employee’s personal iCloud or Google backup, an account the business has never seen.
• Other apps can read things. Personal phones have whatever apps the owner chose, and some of those can see files, contacts, or whatever was copied last.
• Repairs. A cracked phone goes to whatever repair shop is closest, with company email still signed in.
• Leaving. Turning off someone’s account stops them signing in to most cloud services. It does nothing about files already downloaded to their phone.

Decide what work a personal device can do

Your BYOD policy does not have to be yes or no. It can be yes to some work and no to other work, and that is usually the right answer.

A common split we write into a BYOD policy: reading and answering email through the approved Outlook app on a phone is fine. Exporting the customer list, working on payroll, or handling patient or client records needs a company computer. The more sensitive the information, the stronger the case for a device the business owns.

One line I would not move in any BYOD policy: anyone who manages user accounts, security settings, or backups should do that from a managed company device. Not from the home laptop. The same goes for contractors. Give them access to the apps they need and nothing else, which our post on limiting contractor access goes into.

What a personal device needs before it gets company email

Before any personal device touches company information, it should meet a short list of basics. This list is the core of any BYOD policy:

• A supported operating system. If the phone or laptop no longer gets security updates, it does not get company access.
• Updates turned on. Automatic where possible, and actually restarted when the update asks.
• A screen lock. A PIN, password, fingerprint, or face unlock, and a screen that locks itself after a short time.
• Encryption. This scrambles what is stored on the device so a lost phone is just a lost phone. Most modern phones do this once a passcode is set. The Australian Cyber Security Centre’s guidance on enterprise mobility and BYOD recommends full-device encryption whenever business information might be stored.
• Multi-factor sign in. The code on your phone after the password, on email, files, and anything important.
• No jailbroken or rooted phones. Those have had some of their built-in protections removed on purpose.
• Separate accounts on shared computers. If the family uses the computer, the employee gets their own account with its own password.

Keeping work data in its own box

This is the part that makes a BYOD policy workable, and it is the part most people have never heard explained.

There are two ways to manage a phone. One is to enroll the whole device, which gives the business a lot of control over it. On a phone the employee owns, that is usually more control than either side wants. The other is to manage just the work apps. The company email and files live inside the Outlook and OneDrive apps, the business controls those apps, and the rest of the phone stays the employee’s.

With the second approach, you can stop someone copying a work file into their personal notes, require a PIN to open the work apps, and remove the company data from those apps without touching their photos or texts. Microsoft explains how this works in its guide to removing company data from protected apps. This is how we set up Microsoft 365 for most clients who allow personal phones.

The thing nobody asks about, and should: this only removes what those managed apps control. If someone saved a file to their personal storage before the protection was set up, that copy is out of reach. That is why the protection goes on before the access, not after.

Microsoft also warns businesses about applying full device management to phones they do not own, in their planning guide. A full wipe erases the family photos along with the company email. Put exactly what the business can see and do into your BYOD policy, in writing, before you set anything up. People are much more willing to say yes when they know.

14 questions your BYOD policy should answer

You do not need a twenty-page document. You need clear answers to these, in plain language, signed by each person before their device gets access:

• Who is allowed to use a personal device for work, including contractors?
• Which kinds of devices are allowed?
• Which work can be done on them, and which work cannot?
• Which apps must be used for email, files, and messaging?
• Can company files be downloaded to the device?
• Can other people use the device?
• What security settings are required?
• What can the business or the IT provider see on the device?
• What can the business change or control?
• Can company data be removed remotely, and how?
• What does the employee do the moment a device is lost or stolen?
• What has to happen before the device is repaired, sold, or traded in?
• What happens to company data when the employee leaves?
• Who pays for data plans, repairs, or a replacement?

One thing I am not sure of for your business, and you should check: employment and privacy rules differ by state and by industry. Have your BYOD policy looked over by whoever handles your HR or legal questions before you roll it out.

The two days your BYOD policy gets tested

The day a device goes missing

Your BYOD policy should tell the employee to report it right away, not after they have looked for it for a week. Then the business, or us, can sign the device out of everything, remove company data from the work apps, check whether anyone has signed in from somewhere strange, and change passwords if needed.

Here is the catch. Remote removal only works once the device connects to the internet again. A phone that stays switched off may never get the message. That is why the encryption and screen lock matter. They are the protection that works even when nothing else reaches the phone.

The day someone leaves

Your BYOD policy should spell out the order. Turn off the account, sign them out of active sessions, and remove company data from the work apps, all at the agreed time. Then ask the uncomfortable question: did they download files to that device, and how will those copies be deleted? We walk through the full checklist in our post on employee offboarding.

When the answer should be a company device

A BYOD policy is also allowed to say no. Give the person a company device when they handle sensitive information, need administrator access, store a lot of company data locally, share the device with family, or will not accept the security settings. Same answer if the device cannot be encrypted, no longer gets updates, or has been jailbroken.

Company devices cost more up front. They are also easier and cheaper to support, because we know exactly what is on them. A good BYOD policy makes that trade on purpose instead of by accident.

Frequently asked questions

Can I let employees check work email on their personal phones? Yes, if your BYOD policy sets the rules first: a screen lock, multi-factor sign in, the approved email app, and a way to remove company data from that app if the phone is lost or they leave.

Can the business see personal photos and texts on an employee’s phone? Not when only the work apps are managed. Full device enrollment can show more. Either way, put in writing exactly what you can see before anyone signs up.

Can the business wipe an employee’s personal phone? Some setups allow a full reset, which also erases personal data. For phones employees own, remove just the company data from the work apps instead.

Is multi-factor sign in enough on its own? No. It protects the account, but it does nothing for files already saved on the device. Your BYOD policy still needs encryption, a screen lock, updates, and managed apps.

Is BYOD cheaper than buying company phones? It saves on hardware, but it adds setup, support, and management time. Whether it comes out ahead depends on how many people and how much sensitive work is involved.

If you are not sure what is on your employees’ phones right now, you are in good company. Most businesses we talk to are not. Our guide to navigating the cybersecurity jungle walks through BYOD policy basics and the other gaps that small businesses tend to miss, in plain language.

Featured image: Pexels