BYOD & Personal Device Security Compliance Check

When staff read work email, open customer files or use messaging apps on their own phones and laptops, your business remains the controller of that personal data. UK GDPR Article 32 requires “appropriate technical and organisational measures” to keep it secure, and Article 5(1)(f) requires protection against unauthorised access, loss or destruction. The ICO’s guidance on bring your own device (BYOD) is clear that responsibility cannot be handed to the employee: a lost, unlocked or shared personal device holding customer data is your breach to assess and, if the risk threshold is met, report to the ICO within 72 hours.

Personal devices also create risks outside data protection. The Computer Misuse Act 1990 and the Cyber Essentials scheme both treat unmanaged devices as a weak point, and many insurers and larger customers now ask whether you control the devices that touch their data. Employee monitoring on a personal device raises further issues under the Human Rights Act 1998 and UK GDPR, so a BYOD approach needs a written policy, sensible technical controls such as passcodes, encryption and remote wipe, and a clear plan for what happens when someone leaves.

This check looks at how personal devices are used for work in your business and highlights the policy and technical gaps most likely to cause a data breach or regulatory problem, with practical next steps.