BYOD

What it means

BYOD, bring your own device, means employees use their own phones, tablets or laptops for work. In small companies it is often the reality without anyone deciding it: work email and company documents sit on a private phone because that was the easiest way.

The advantages are lower device costs and staff who are happy working on what they know. The drawback is that the company has no control over the device: it does not know whether it is updated, has a screen lock or who else uses it, children for instance.

Under GDPR responsibility for company data stays with the employer even when the data sit on a private device. If a phone holding client contacts or payroll data is lost, that is a personal data breach, which the company must assess and, where needed, report.

How it works in practice

Sensible BYOD starts with a written policy: which devices are allowed, what minimum security they must have, which apps may be used and what happens when a device is lost or the employee leaves. The employee signs it, because it concerns their private property too.

On the technical side, MDM creates a separate work space on a private phone. When the device is lost or the employee leaves, the company can wipe only work data and leave private photos alone. Device encryption and a screen lock go without saying.

If the company pays the employee towards a private phone or internet, there is a tax question. Compensation for using one’s own device for work that matches the actual costs can be exempt, whereas a flat allowance with no link to work is taxable income.

What to watch out for

The biggest risk is an employee leaving. If the company does not know where its data are, they remain on a private phone, a private cloud or a messaging app after the person has gone. A list of access rights is needed, and they should be revoked on the day the person leaves.

Watch out for shadow IT too. On their own devices staff like to use apps familiar from private life, such as free storage or translation services, and company documents end up outside the company’s control and outside the EU.