Bring Your Own Device (BYOD) template

2. Policy statement

Personal devices may be used for work only with approval, only through [approved apps/access method], and only while the security requirements below are met. {{org.name}} may withdraw access at any time. We will never browse the personal content of your device.

3. Approval and eligible devices

Ask [name/role] before connecting a personal device to any work system. Approvals are recorded in the [BYOD register] with the device type and what it may access. Devices that no longer receive manufacturer security updates are not eligible. Roles handling [sensitive data categories — e.g. health or financial records] are excluded from BYOD and use company devices instead: [list roles].

4. Security requirements

• Protect the device with a PIN, password, or biometric lock that engages automatically.
• Keep the operating system and apps updated — stop using any device that no longer receives security updates.
• Turn on device encryption where it is not already on by default.
• Do not use a jailbroken or rooted device (one with its built-in security removed) for work.
• Install [mobile device management / approved security app] if we require it for your level of access.

5. Working on your own device

• Access work systems only through [approved apps — e.g. the company email app or browser portal]; never forward work email to personal accounts.
• Keep work files in [company cloud system], not in the device's local storage or personal cloud accounts.
• Do not let family members or anyone else use the device while you are signed in to work systems.
• Avoid public Wi-Fi for work, or use [VPN/approved method] when you have no alternative.
• Do not photograph anything containing customer or staff personal data unless a work process specifically requires it.

6. Your privacy — what we can and cannot see

{{org.name}} can see and manage the work side only: [describe — work accounts, the contents of approved work apps, access logs]. We cannot and will not look at your personal photos, messages, browsing history, or location.

If we use remote wipe, it is limited to work data and work apps wherever the technology allows. A full-device wipe is a last resort for a lost device that cannot be selectively wiped, and we will tell you before triggering one unless delay would materially increase the risk.

7. Lost devices, incidents and leavers

1. 1Report a lost or stolen device with work access to [name/role] immediately, at any hour.
2. 2[Name/role] revokes the device's access to work systems and triggers remote wipe of work data where enabled.
3. 3If personal data may be exposed, follow the data breach response procedure — the 72-hour ICO clock runs from awareness.
4. 4When you leave {{org.name}} or stop using BYOD, work accounts and data are removed from your device on or before your last day, and you confirm in writing that none remains.

8. Costs, support, records and review

[State your position: {{org.name}} contributes [amount] per month for approved regular users / work calls and data are reimbursed through the expenses policy / no contribution is made for optional BYOD.] IT support covers the work apps and connections only — we do not repair or maintain the device itself.

The BYOD register, approvals, and signed acknowledgments are kept in [system/location]. This policy is reviewed [frequency] and whenever the systems staff can access change. Owner: [name/role]. Next review: [date].