Managed IT Services
Summary: Allow personal devices only for approved work, through approved apps, and only when the device meets your security requirements. Use company-owned devices for administration, sensitive work, and roles that store large amounts of data locally. So, should employees use personal devices for work? Yes, with a written policy, a management tool that separates company data from personal data, and a plan for the day the phone is lost or the employee leaves.
Employees usually start using personal devices for work before the business has made a decision about it. They add work email to a phone, download a file to a home laptop, or sign into a company app from a computer shared with the family. Once business data lands on a personal device, you have less control over updates, installed apps, backups, and who else picks it up. You also need a way to remove company data when the employee leaves or the device is lost. That is the real question behind “should employees use personal devices for work”: not whether it is convenient, but whether the business can still protect its data when it does not own the hardware.
At eMDTec, a New Jersey managed IT services provider supporting healthcare practices, law firms, accounting offices, and professional services companies since 2002, BYOD is one of the first things we assess for a new client. Almost every office has it, very few have written it down, and the risks of using personal phones for work land squarely on the regulated firms we serve. This guide walks through the pros and cons of BYOD, the industry-specific exposure, and how mobile device management NJ businesses can deploy in a week lets you say yes safely.
The Real Costs of a BYOD (Bring Your Own Device) Policy
Bring your own device means an employee uses a personally owned phone, tablet, or computer for work, and it is the everyday form of the question should employees use personal devices for work: checking email on a personal phone, opening client files on a home laptop, joining Teams from a tablet, using a business messaging app, signing into accounting, CRM, or project management software, or downloading documents to a personal computer.
Depending on the application, business information may stay in the cloud or be copied to the device as messages, attachments, cached data, or files. The pros and cons of BYOD are lopsided: the pros are convenience and a lower hardware bill; the cons are everything below, and they are the reason BYOD security risks for small business owners keep showing up on cyber insurance questionnaires.
What you cannot fully control on a personal device
Your IT team can set and monitor security on company-owned devices, which is the first thing to weigh when asking should employees use personal devices for work. With personal devices, the employee chooses which apps to install, when to update the operating system, who else uses the device, and where files are backed up. Management software can enforce some rules, but the available controls depend on the device, operating system, application, and how it was enrolled. The UK National Cyber Security Centre’s BYOD guidance is blunt about this: the organization inherits risks it cannot see and did not choose.
- Other people use the device. A home computer or tablet is often shared with a partner or child through one account. Whoever sits down can open the saved work session.
- Updates go missing. Employees delay updates because the device is out of storage, an old app might break, or the phone is never restarted. Unpatched personal devices are how attackers reach company data on personal cell phones.
- Business files drift into personal storage. A downloaded attachment sits in the Downloads folder, gets picked up by a personal cloud backup, and gets opened in a personal app that keeps its own copy. Now there are three unmanaged copies.
- Other apps can read business information. Personal apps may have permission to read files, contacts, browser activity, or the clipboard. The business does not know which apps are installed or what they can reach.
- Repairs expose data. A broken phone goes to a repair shop the employee chose, with business email and saved sessions still on it.
- Data outlives employment. When someone leaves, their personal phone leaves with them, along with cached email, downloaded files, and app sessions, unless the business has a way to remove them.
Intellectual property theft and the offboarding problem
The last item is the one professional services firms underestimate when they decide should employees use personal devices for work. Intellectual property theft personal devices make possible is rarely dramatic; it is a departing consultant whose phone still holds two years of client proposals and a contact list. Wiping company data from employee phone storage on the way out is only possible if the business set up that capability on the way in. Without a managed app or work profile, the only options are asking nicely or a lawyer’s letter.
Industry-Specific Risks: HIPAA, Legal Ethics, and Financial Compliance
For an unregulated business, BYOD risk is mostly about lost productivity and embarrassment. For the firms eMDTec serves, a personal phone with company data on it is a compliance question with a fine attached, and “should employees use personal devices for work” has a different answer depending on what the device can see.
Healthcare: Are Personal Phones Breaching HIPAA?
They can be, and often are, which is why should employees use personal devices for work is a compliance question in a medical office. HIPAA compliance personal devices have to meet is the same as for any workstation: Protected Health Information (PHI) on personal phones must be encrypted, access-controlled, logged, and removable.
A text message from a physician to the front desk with a patient’s name and diagnosis is PHI on an unmanaged device. A photo of a lab result taken to “send it quickly” is PHI in a personal camera roll, backed up to a personal cloud account. An unencrypted phone with those messages on it that gets lost is a reportable breach.
A healthcare BYOD security policy has to name which apps may touch PHI (a managed, encrypted messaging app, not SMS), require device encryption and a screen lock, and give the practice the ability to wipe the work container. That is the baseline for NJ healthcare IT compliance we build into every practice’s HIPAA program, and it is what an OCR investigator asks about first after a lost phone.
Legal & Finance: Confidentiality and Regulatory Fines
When a law firm asks should employees use personal devices for work, the resulting law firm BYOD policy has to protect two things at once: attorney-client privilege on personal devices, and the firm’s ability to find and produce those communications later. Client messages in a personal texting app are privileged, but they are also outside the firm’s retention system, which is a discovery problem waiting to happen. The ethics of lawyers using personal phones for client work come down to competence and confidentiality obligations under the rules of professional conduct: the attorney is responsible for securing client information wherever it sits.
Secure legal data mobile management means managed email and document apps with encryption, no copy-out to personal storage, and remote wipe, so a partner can use the phone they like without the firm losing control of the matter.
Financial firms face the strictest version of should employees use personal devices for work. FINRA compliance personal devices have to satisfy includes recordkeeping of business communications, which is why “texting clients from a personal number” has produced some of the largest regulatory fines in the industry. Accounting firm client data security is governed by the FTC Safeguards Rule, and FTC Safeguards Rule personal devices provisions require encryption, multi-factor authentication, and access controls on every device that touches customer financial information, personal or not. Securing financial data on employee phones is therefore not optional for CPAs, advisors, or lenders; it is a written requirement, and our FTC Safeguards compliance checklist treats BYOD as a first-phase control.
Decide What Work Is Allowed on Personal Devices
Not every task belongs on a personal device, so should employees use personal devices for work is really a question about which work. Email, calendar, Teams or another messaging app, and viewing documents in a managed app are the reasonable yeses to should employees use personal devices for work for most roles.
Administrative work is not: anyone responsible for user accounts, security settings, backups, or business systems should do that work from a managed, company-owned device. Staff who handle financial records, health information, legal documents, or large customer datasets usually need company devices too, because the volume of data that ends up stored locally is too high to control. Apply the same rules to contractors, and limit their access to the applications and information their work requires.
Security Requirements Before a Personal Device Gets Access
If your answer to should employees use personal devices for work is yes, a personal device should meet your requirements before it can reach company information, not after. These are the nine conditions we enforce through mobile device management for our New Jersey clients, and any of them can be written into an employee personal device policy template on their own.
- Supported operating system. The device must still receive security updates. Block anything that cannot install current patches.
- Automatic security updates. OS and app updates install automatically where possible, and employees restart when asked.
- Screen lock. A PIN, passcode, or biometric lock with a short timeout, so a phone left on a restaurant table is not an open door.
- Device encryption. Enabled by default on modern phones, often not on older laptops. Verify it, do not assume it.
- Multi-factor authentication. On every company account the device can reach. MFA protects the account; it does not protect files already on the device, so it is a layer, not the whole plan.
- No rooted or jailbroken devices. A device with its security model removed cannot be trusted with company data, and management tools can detect and block it.
- Approved applications only. Tell employees which apps to use for email, messaging, and files, and where the management tool supports it, prevent company information from being saved to personal storage or pasted into unmanaged apps.
- Separate accounts on shared computers. A home PC used for work needs its own user account for the employee. If work cannot be kept separate from other users, do not allow BYOD on that machine.
- A reporting path. Employees must know who to contact when a device is lost, stolen, repaired, replaced, or infected. Early reporting is what lets IT disable access before anyone else uses it.
How to Protect Your Business: Mobile Device Management (MDM) vs. Corporate Devices
Once you have decided should employees use personal devices for work and for which tasks, there are two ways to make it safe: manage the personal device, or stop using personal devices for that work. Most New Jersey small businesses end up with both, applied by role.
Managed apps and work profiles
Managed apps are the answer to should employees use personal devices for work that most firms land on. Modern management tools (Microsoft Intune is the one most of our clients already own through Microsoft 365; here is our plain-English guide to it) can protect company data without taking over the whole phone. App protection policies put work email, files, and Teams inside a managed container: the data is encrypted, cannot be copied into personal apps, requires a PIN or biometric to open, and can be wiped by the business without touching personal photos or messages.
On Android this is a separate work profile; on iPhone it is managed apps and accounts. Microsoft’s own documentation on wiping corporate data from managed apps describes exactly this selective wipe. This is the model that answers “should employees use personal devices for work” with a yes for email, calendar, and documents, and it is the core of the Mobile Device Management (MDM) for remote workers program in our mobile and endpoint security service.
Full device enrollment
Enrolling the whole device is the other way to answer should employees use personal devices for work, and it gives the business more control: enforced encryption, OS version requirements, app restrictions, and the ability to locate or fully wipe it. It also gives the business more visibility into the device, which employees may reasonably object to on a phone they paid for. Full enrollment is the right answer for company-owned devices and for personal devices in roles that handle regulated data all day. Be explicit in the policy about what the business can and cannot see.
When corporate devices are the better answer
For some roles the answer to should employees use personal devices for work is no; they should simply get a company phone or laptop: administrators, anyone who stores large amounts of client, patient, or financial data locally, and staff whose personal device cannot meet the requirements above. A managed corporate laptop costs less than most people assume, is easier for IT to support because its configuration is known, and removes the offboarding argument entirely. The comparison below is the one we walk clients through.
| Unmanaged personal device | Personal device with managed apps (MDM) | Company-owned managed device | |
|---|---|---|---|
| Company data encrypted and separated | No | Yes, inside the work container | Yes, whole device |
| Remote wipe when lost or on departure | No | Work data only | Full device |
| Updates and OS version enforced | No | Required to open work apps | Yes |
| Employee privacy | Complete | Personal side untouched | Company property |
| Meets HIPAA, FTC Safeguards, FINRA expectations | No | Yes for email, messaging, documents | Yes, including admin and bulk data |
| Cost to the business | Hidden (incidents, support) | Low, usually included in Microsoft 365 | Hardware plus management |
What Your Employee Personal Device Policy Should Cover
A policy is what turns should employees use personal devices for work from IT’s opinion into a rule employees have agreed to. An employee personal device policy template for a New Jersey SMB should answer, in plain language: which employees and contractors may use personal devices; which device types are permitted; what work can be performed on them; which applications must be used; whether company files can be downloaded; whether the device may be shared; which security settings are required; what the business or IT provider can see and control; whether company information can be removed remotely.
It should also say what happens if the device is lost, stolen, repaired, or sold; what happens when the employee leaves; and who pays for mobile data, repairs, or replacement.
Employees read and accept it before company access is added, and it gets reviewed when privacy or employment rules change.
Our earlier post on building a BYOD policy for a small business goes deeper on the wording.
Lost Phones and Departing Employees: The Two Days That Matter
When a personal device is lost or stolen
The employee contacts IT immediately; this is the scenario that decides should employees use personal devices for work for many owners. IT signs the device out of company accounts, revokes active sessions, resets passwords where needed, wipes the managed work data, reviews recent sign-in activity for anything unusual, and documents the incident. If the device was unmanaged and held regulated data, the incident review has to consider whether it is a reportable breach. That last sentence is why a managed container matters: with encrypted, wipeable work data, a lost phone is a replacement cost rather than a notification letter.
When an employee leaves
Offboarding is where should employees use personal devices for work either works or fails. On the last day, IT disables the account, revokes sessions and app tokens, wipes company data from the managed apps or work profile, removes the device from management, and confirms nothing was forwarded to a personal address in the final weeks. Wiping company data from employee phone storage takes minutes when the device was enrolled and is impossible when it was not. Building this into your onboarding and offboarding process is what keeps client lists from walking out the door.
Should Employees Use Personal Devices for Work? When the Answer Is No
The answer to should employees use personal devices for work is no when the work requires local storage of sensitive data, when the device cannot meet your security requirements, when it is shared and cannot be separated by account, when the employee will not accept management or the policy, or when a regulator or client contract requires company-owned equipment. In those cases, a managed corporate device is cheaper than the incident it prevents, and easier for your IT provider to support because its settings and software are known.
Frequently Asked Questions
Can employees use a web browser without enrolling their personal device?
You can, and for many firms this is the middle answer to should employees use personal devices for work. Browser-only access is allowed, but information still lands in the browser cache, Downloads folder, saved passwords, screenshots, and active sessions. Conditional access policies can limit which devices and browsers are permitted, and sensitive work should still require a managed device.
Is MFA enough to secure a personal device?
No, and this is the most common misunderstanding when owners ask should employees use personal devices for work. MFA protects the account sign-in. Device encryption protects stored files, and managed applications control how company information is used and copied. You still need updates, screen locks, approved apps, and a lost-device process.
Can the business see an employee’s personal information?
It depends on the management method, and it is the privacy half of should employees use personal devices for work. App-level management sees business applications and their data, not personal photos, messages, or browsing. Full device enrollment can show device details and allow broader control. Put the answer in writing in the policy so nobody is surprised.
Can the business erase a personal phone?
With app-level management, which is how most eMDTec clients settle should employees use personal devices for work, the business can remove company data only, leaving personal content alone. A full device wipe is generally reserved for company-owned or fully enrolled devices and should be spelled out in the policy before enrollment.
Is BYOD cheaper than providing company devices?
Sometimes, and cost is usually why the question should employees use personal devices for work comes up. BYOD avoids hardware purchases but adds management, support for unfamiliar devices, policy work, and incident risk. For roles that handle regulated or high-volume data, a managed company device is usually the cheaper option once you count what a single lost, unmanaged phone can cost.
Does this apply to Apple and Android equally?
Yes. Should employees use personal devices for work is platform-neutral at eMDTec; we are vendor agnostic, and iPhones, iPads, Android phones and tablets, Windows laptops, and Macs are all managed from the same platform under the same policy, so the rules do not change based on which phone an employee prefers.
Secure Your NJ Business Infrastructure
Should employees use personal devices for work? At most New Jersey businesses the honest answer is “they already do,” and the useful question is whether the company can still protect its data when they do. eMDTec provides IT support for small businesses in NJ from our Verona headquarters, including a BYOD and mobile device assessment that inventories every personal device touching company data, checks it against HIPAA, FTC Safeguards, or FINRA expectations, and sets up the managed apps and offboarding process that let you say yes safely. As a NJ business cybersecurity consultant that has run this for medical practices, law firms, and CPA firms for two decades, we can usually have a managed BYOD program live within a week.
Sources and further reading
- UK National Cyber Security Centre: Bring your own device guidance
- Australian Cyber Security Centre: Risk management of enterprise mobility including BYOD
- Microsoft Learn: Wipe corporate data from Intune-managed apps
- Microsoft Learn: Intune device security overview
- Australian Cyber Security Centre: Securing customer personal data
Featured image credit: Pexels. This article has been republished with permission from The Technology Press.