MDM

What it means

MDM, mobile device management, is a system for centrally managing company phones, tablets and laptops. Through it an administrator remotely sets security, installs or blocks apps, enforces updates and locks or wipes a lost device.

Modern solutions can separate the work and personal parts of a device. That matters with BYOD, when staff use their own phones: the company manages only its own apps and data and cannot see private photos or messages.

Typical rules MDM enforces are a screen lock, storage encryption, a minimum operating system version, no installs from untrusted sources and separation of work email. The company can then show that devices holding its data are protected.

How it works in practice

We recommend MDM to any company whose staff have work email, documents or system access on their phones, which today is nearly all of them. For smaller firms there are simple options within office suites for a small monthly fee.

When an employee leaves, MDM is part of offboarding: the company remotely removes work data, revokes access and, if the device is company-owned, prepares it for the next user. Without MDM the data stay on the former employee’s phone.

Under GDPR, staff must be told what MDM can and cannot see, especially on private devices. A configuration allowing location tracking or monitoring of private apps would be disproportionate.

What to watch out for

A common mistake is rolling out MDM with exceptions for management. Directors’ phones hold the most sensitive data and are the most frequent targets. The rules should apply to everyone.

The second risk is wiping an entire private device by mistake. With BYOD, use the mode that erases only the work area, and agree in writing what happens on loss or departure so there is no dispute over lost personal data.