BYOD: The Risks of Using Personal Devices for Work

Many employees start using personal devices for work before the business has a policy in place. They add work email to their phone, download files to a home computer, or access company apps from a shared family device.

While this can be convenient, it also means company data is being stored on devices the business does not fully control. Updates may be missing, files can end up in personal backups, and removing company information becomes more difficult if the device is lost or the employee leaves.

Personal devices can be allowed, but the business should decide what devices, applications, and types of work are permitted before access is granted.

What BYOD Means

Bring Your Own Device (BYOD) is when employees use their own phones, tablets, or computers for work. This may include:

• Accessing work email
• Using Microsoft 365 or Google Workspace
• Joining online meetings
• Opening company files
• Using business messaging apps
• Accessing accounting, CRM, or project management systems

Even when information is stored in the cloud, copies may still end up on the device as downloaded files, email attachments, cached data, or backups.

The Main Risks

Shared Devices

A home computer or tablet may be used by other family members. If work and personal use are not properly separated, company information can be exposed to people who should not have access.

Missing Updates

Personal devices may run outdated software if updates are delayed or no longer supported, increasing security risks.

Business Data in Personal Storage

Files downloaded from work systems can remain in personal folders and may be automatically backed up to personal cloud storage accounts.

Unapproved Apps

Businesses often have little visibility into which apps are installed on personal devices. Some applications may have access to files, contacts, or copied information.

Lost, Repaired, or Replaced Devices

A lost device or one sent for repair can expose business information if suitable protections are not in place.

Data Remaining After Employment Ends

Disabling an account prevents future access, but it does not automatically remove files that have already been downloaded or copied elsewhere.

Set Clear Rules

Not every task should be allowed on a personal device. For example, reading email through an approved mobile app may be acceptable, while accessing sensitive customer data or performing administrative tasks may require a company-owned device.

The same rules should apply to contractors and temporary staff.

Minimum Security Requirements

Before a personal device can access company information, it should:

• Run a supported operating system
• Install security updates automatically
• Use a screen lock such as a PIN, password, fingerprint, or Face ID
• Have device encryption enabled
• Use multi-factor authentication (MFA)
• Avoid rooted or jailbroken devices
• Use approved work applications only

Employees should also know how to report a lost, stolen, or compromised device immediately.

Use Managed Apps Where Possible

Tools such as Microsoft Intune can help separate work data from personal data. Managed applications can restrict copying, control where files are saved, and allow company information to be removed without affecting personal content.

However, these tools cannot remove files that have already been copied into personal storage or unmanaged applications.

What Should Be in Your BYOD Policy?

Your policy should clearly define:

• What devices are allowed
• What work can be performed on them
• Which applications must be used
• Whether files can be downloaded
• Required security settings
• What information IT can see and manage
• What happens if a device is lost, repaired, sold, or replaced
• What happens when an employee leaves

Employees should read and accept the policy before using personal devices for work.

When BYOD Is Not Appropriate

A company-owned device is usually the better option when:

• The employee handles sensitive information
• The role requires administrator access
• Large amounts of company data are stored locally
• The device is shared with other people
• Required security controls cannot be enforced

Company-owned devices provide greater control, stronger security, and simpler support for your IT provider.

Conclusion

BYOD can offer flexibility and convenience, but it should never be an unofficial arrangement. Clear policies, security requirements, and managed applications help reduce risk and protect business information. If you're unsure whether your current setup is secure, contact TechMan for advice on creating a practical and secure BYOD strategy for your business.

Article used with permission from The Technology Press.

Featured Image Credit