Employees use familiar devices, the company saves on procurement. Against this stand risks: unknown security state, mixing private and business data, data leakage on loss or departure.
What a BYOD policy should regulate
Which devices and operating system versions are permitted.
Minimum requirements: lock, encryption, updates.
Which data and applications may be used on them.
How company data is separated and protected (app protection, container).
Company rights: what may be managed or wiped?
Behaviour on loss, defect or departure.
Cost arrangement and support.
Data protection basis and information for employees.
Alternative: company devices
For sensitive areas or strict requirements, company devices can be the clearer solution. Check where BYOD is justifiable, for example email and calendar with app protection, and where not. Clarify legal questions with data protection officers or specialist lawyers.
BYODprivate devices workBYOD policybring your own device
Frequently asked questions
What does BYOD mean?
Bring your own device: employees use private devices for work.
Is BYOD possible in compliance with data protection?
Yes, with clear rules, data separation, technical protection and information for employees. Legal review in the individual case is recommended.
What to do if a private device is lost?
With app protection or MDM, company data can be wiped remotely, provided this was agreed beforehand.