BYOD policy: personal devices doing company work

Personal devices are already doing company work in almost every organisation, usually starting with email on a phone and spreading from there. A BYOD policy is the decision to govern that deliberately rather than to discover its boundaries during an incident — and the most useful version is narrow and enforceable rather than comprehensive and ignored.

What a BYOD policy must cover

• Which data may be accessed from a personal device at all, and which may never be — that distinction does most of the work.
• Minimum conditions: screen lock, current operating system, disk encryption where the platform offers it.
• What happens when the device is lost or stolen, including who to tell and how quickly.
• Whether company data can be wiped remotely, and whether that wipe can be limited to company data rather than the whole device.
• What happens when somebody leaves, which is the moment most policies are discovered to be theoretical.
• Who pays for what — data plans, repairs, replacement — stated plainly, because the ambiguity breeds resentment rather than savings.

The wipe question

This is where BYOD policies either hold or collapse. An employer that reserves the right to wipe an entire personal device is asking somebody to risk their own photographs against a company incident, and people respond by quietly keeping work on a second unmanaged device — which is worse than what you started with. The workable arrangement separates company data into a managed container that can be removed on its own. Where that is not technically available, the honest answer is to narrow what may be accessed rather than to claim a power you will hesitate to use.

A personal device used for work can become evidence. If the business is ever subject to a legal hold or an investigation, data on an employee's own phone may be in scope — and that is a conversation nobody wants to have for the first time under a deadline, so the policy should say it in advance.

Making it enforceable

1. Enrol devices rather than relying on an acknowledgement, or you have a document instead of a control.
2. Keep a register of which devices are enrolled and for whom, with a review date.
3. Tie offboarding to removal, as a step with a named owner rather than an assumption.
4. Allow people to opt out and use company equipment instead — a BYOD policy with no alternative is a cost shifted onto staff.
5. Review annually, since platform capabilities change faster than policies do.

Ettex Wiki is a sensible home for the policy itself, where it can be found and dated rather than living in an onboarding attachment. The device register belongs beside the other access records, since the question asked after a departure is always the same one: what did this person still have.