30 October 2026

Should Employees Use Personal Devices for Work?

Photo by Vitaly Gariev on Pexels

Somebody adds their work email to their phone before anyone in the business has actually decided that's allowed. A file gets downloaded onto a home laptop. A colleague signs into a company app from a computer the whole family uses. None of this happens because a policy says it can. It happens because nobody's stopped it, and the phone or laptop was already sitting there.

Once that email, file or login is on a personal device, the business has far less say over what happens to it next. Who else uses that device, whether it gets updated, where its backups go and how you'd get the data off it again all become the employee's decisions, not yours. Bring your own device, usually shortened to BYOD, can still work well for a lot of everyday tasks. It just needs the business to decide what's allowed before someone else decides for you.

What counts as BYOD

BYOD covers a personal phone, tablet or computer being used for anything work related, not just email. In practice that might mean signing into Microsoft 365 or Google Workspace, joining a video call, opening a client file, using a business messaging app, logging into your accounting or CRM software, or saving a document straight to a personal laptop.

Some of that stays in the cloud and never really touches the device itself. Some of it doesn't, landing as a downloaded attachment, a cached copy, or a message thread that sits on the phone long after the conversation's finished.

What you stop being able to control

A company laptop can be locked down by your IT provider: what's installed, when it updates, who signs in, where its backups go. A personal device answers to the employee, not to you.

It might not be theirs alone

A work laptop shared with a partner or a teenager doing homework is more common than most policies admit. Separate logins on the same machine help, but plenty of personal devices get used through one shared account, which means anyone with access to that account has a route to whatever work data is on it. NCSC's own BYOD guidance lists exactly this, a device shared between an employee and other people, as one of the risks worth weighing before granting access, not an edge case to assume away.

Updates happen on their schedule, not yours

Your IT provider can't confirm a personal phone is running a current, supported operating system the way they can for a managed laptop. An employee might put off an update because storage is tight, an app they rely on hasn't caught up yet, or the phone just doesn't get restarted often enough to prompt it.

Files don't always stay where you put them

A document opened from work email can end up sitting in a Downloads folder, a personal photos app, or a phone's automatic backup, all without the employee doing anything that feels like a mistake. Once it's there, a personal cloud account you don't manage might pick it up next. It's worth being deliberate about where business files are meant to live in the first place, rather than only thinking about it once a copy has already gone somewhere it shouldn't.

You don't know what else is installed

Every app on a personal phone was chosen by the employee, and some of those apps have permission to read files, contacts, clipboard content or browsing activity. Neither you nor your IT provider gets a say in what's on there, or what those apps are quietly allowed to see.

Repairs and resale happen outside your control

A cracked screen usually goes to whichever repair shop is nearest or cheapest, not one your business has vetted. Work email, saved logins and downloaded files can still be sitting on the device when it's handed over. The same applies when a device is eventually sold or passed on. Staff should know who to check with before that happens, not find out it mattered after the fact.

Leaving the business doesn't clear the device

Turning off someone's account stops future sign-ins to cloud services, but it does nothing about files already downloaded, copies made in apps you don't manage, or anything sitting in personal storage. Properly managed apps can remove what they control. They can't remove what they were never able to see in the first place, which is why the way access is granted at the start decides how messy offboarding gets.

Decide what work is actually allowed

Base access on the work itself, not on a blanket yes or no. Reading email through an approved app might be fine on a personal phone, while exporting customer records probably belongs on a company machine. Anyone handling financial records, health information or large volumes of customer data is usually better off on hardware the business actually owns and controls.

It's also worth separating this from a purely network-level question. A personal phone that only ever needs an internet connection doesn't need business network access at all. That's what a properly separate guest Wi-Fi network is for. BYOD access proper is for devices that actually need to reach company systems, not every device that happens to be in the building.

Administrative work deserves the same line drawn firmly. NCSC's BYOD guidance is direct on this point: anyone with privileged or administrative access, account management, security settings, backups, core business systems, shouldn't be doing that work from a personal device, full stop. The same principle holds even on a company-owned computer, not only a personal one: admin rights are worth restricting to as few people as possible, regardless of whose hardware it is. Contractors should be held to the same standard as staff, limited to exactly what their work needs and nothing more.

What a personal device needs before it gets access

A personal device should meet a minimum bar before it can reach anything belonging to the business.

A supported, updated operating system. If a phone can no longer install current security updates, it shouldn't be allowed to connect. Automatic updates should be switched on wherever the device supports it.

A screen lock that's actually set. PIN, password, fingerprint or face recognition, configured to lock the device automatically rather than left to chance.

Encryption. Most current phones encrypt their storage by default once a screen lock is enabled, but it's worth confirming rather than assuming, since it's what actually protects the data if the device is lost or stolen.

Multi-factor authentication. NCSC states plainly that MFA is a minimum requirement for BYOD access, not a nice-to-have, and it's worth knowing that not all MFA methods hold up equally well against a determined attacker.

No rooted or jailbroken devices. Rooting or jailbreaking strips out some of the operating system's own built-in restrictions, and a device in that state shouldn't be trusted with business access. Detection isn't perfect, which is another reason it shouldn't be the only control in place.

Approved apps only. Employees should know exactly which app they're expected to use for email, messaging and file access, not left to pick whatever's convenient.

Separate logins on shared computers. A personal computer used for work should have its own account for the employee, distinct from anyone else who uses the machine, with nobody else knowing that login's password.

A clear way to report a problem. Staff need to know who to contact the moment a device is lost, stolen, sent for repair, replaced, or acting strangely. The earlier you hear about it, the more you can actually do.

Keeping business data separate, without controlling the whole device

Mobile device management (MDM) and mobile application management (MAM) exist precisely because most businesses don't want, or need, full control over an employee's own phone. MDM manages the device itself and can enforce settings across it, useful for company-owned hardware but often more than a personal device warrants. MAM works at the app level instead, applying policies only to the apps handling business data, which suits BYOD far better.

Microsoft Intune's app protection policies are a working example: business data inside protected apps like Outlook or OneDrive can be encrypted and wiped selectively, while everything personal on the same phone is left untouched. If a device is lost, or an employee leaves, that selective wipe removes what the business actually needs removed without touching photos, messages or anything else that was never yours to control. NCSC's own guidance describes the same underlying capability: a device properly enrolled can be sent a remote wipe command that erases it, or just the managed portion of it, the next time it connects.

This is also where a managed phone contract can quietly solve a problem that started life as a BYOD question. If a device is provided as part of a managed business mobile setup, it can be secured and wiped remotely from the outset, rather than retrofitting that protection onto a phone an employee already owns and uses for everything else.

What your policy actually needs to answer

A BYOD policy earns its keep by answering specific questions, not by existing as a document nobody's read. At minimum, it should cover who's allowed to use their own device, which types of device qualify, what work can be done on them, which apps are required, whether files can be downloaded at all, what happens if the device is shared with someone else, what security settings are non-negotiable, what the business or its IT provider can actually see, and what happens when the device is lost, sold, repaired, or the employee moves on. Who pays for data, repairs or replacement is worth settling too, if only to avoid an awkward conversation later.

Employment and data protection rules aren't identical everywhere a business operates, so it's worth having the policy checked against your own circumstances rather than assuming a template covers it. Staff should read and accept it before any company access gets added to their own device, not after.

When it's simpler to just provide the device

Some situations aren't really BYOD candidates at all. A company-owned device makes more sense when someone handles sensitive information regularly, needs administrator access, has to store large volumes of business data locally, shares their personal device with other people, or can't meet the encryption, update or app-approval requirements above. If a device has already been rooted or jailbroken, or an employee simply won't accept the controls you need in place, that's your answer too.

Company-owned hardware is also just easier to support. Your IT provider already knows what's installed and what state it's in, instead of guessing at both.