In most small companies the question "may people use their own phone for work?" was answered long ago, without anyone deciding it. Somebody added the work email account to their phone, then the chat app, then the shared calendar. It is convenient and often cheap. It also means company data sits on a device you do not own, that may be unlocked, unupdated or passed to a family member.
You do not need a large policy or special software to deal with this. You need a one-page rule that answers three questions: what is allowed, what must be installed or switched on, and what happens when someone leaves.
This article is about phones the person owns. For devices the company buys, see the company device inventory for laptops and phones.
Step 1: Find out what is already happening
Ask in a short message, not a survey: "Which work apps do you use on your personal phone?" Expect email, calendar, chat, the file store and sometimes the customer system or the password manager. Say clearly that you are not judging anyone; you want the rule to match reality.
Write down the list. It shows which data is already on personal devices and which accounts would need to be removed later.
Step 2: Decide what is allowed
Sort work tools into three groups:
| Group | Examples | On a personal phone? |
|---|---|---|
| Low risk | Calendar, chat, company directory | Yes, with the basic settings below |
| Medium risk | Email, shared files, project tool | Yes, if the person agrees to the settings and to removal of the work account |
| High risk | Customer database, accounting, admin consoles, exports of personal data | No, or only through the company's own phone or tablet version of the tool that you have chosen to support |
Your groups may differ. The point is that someone has decided, and that the decision is written down. If a role really needs high-risk access on the move, give that person a company phone instead.
Also decide whether using a personal phone is optional. A person who does not want work apps on their own phone should be able to say no without penalty, and still have a way to do the job, for example through a laptop or a shared company phone. Be aware of working-time questions as well: if people read work email in the evening, that is a conversation about expectations, not only security.
Step 3: Require a few settings
Keep the list short enough that people will actually follow it. A reasonable minimum:
- Screen lock with a PIN of at least six digits or a biometric unlock.
- Updates on. The phone is on a version of its system that still receives security updates, and updates are installed within a couple of weeks.
- Two-step sign-in on every work account. If you have not rolled this out yet, start with the two-step sign-in rollout, which also covers lost phones.
- Work apps only from the official store, not from files sent by message.
- Report loss quickly. If the phone is lost or stolen, the person tells a named contact the same day, and you remove access to work accounts. The lost or stolen laptop checklist works as a model for the first hour.
- No sharing of the unlocked phone with others while work apps are open.
If you use a password manager, put it on the list. The password manager rollout is a better place to keep work passwords than the phone's notes app.
Both the UK National Cyber Security Centre and the Information Commissioner's Office treat device security as part of the basic protection of data. The sources below explain what is expected.
Step 4: Be honest about what you can see and do
People accept a rule more easily when they know the limits. Write three sentences and put them at the top of the page:
- "We can sign out and remove your work accounts from your phone. We cannot read your personal messages, photos or browsing."
- "We will only remove work accounts, not wipe the whole phone, unless you ask us to."
- "We will ask you to confirm when your work accounts have been removed."
If you later adopt a tool that can manage the phone more deeply, check what it can see and tell people before switching it on. Do not install anything that reads personal content "just in case".
Step 5: Plan for the day someone leaves
A leaver is the moment when a personal phone is hardest to control, because the person may leave on good terms but the data stays on the device. Add three lines to your leaver checklist:
- On the last day, sign the person out of all work accounts from the administration side, so that phones lose access even if the apps are still installed.
- Ask the person to remove work apps and accounts from their phone and confirm in one line. Offer to do it together if they prefer.
- Check for local copies. Files saved to the phone, exported contacts and screenshots are the usual leftovers. Ask the person to delete them and note that they did.
Also look at tools that connect to the account, such as keys and automations that sit outside the phone. The article on what happens to AI agents, keys and automations when an employee leaves covers that part.
Because the checklist is rarely used, test it once. Pick a colleague who volunteers and walk through removing their work account from their phone while they watch. You will find out in ten minutes whether the steps are clear.
Where AI tools fit in
If staff use AI assistants on their personal phones, the same logic applies. Decide whether work content may be pasted into a consumer app on a personal phone, and say so in the rule. The short usage policy for AI tools is a good companion to this page. An assistant can help you draft the one-page rule or the reminder message, but it should not be given customer data or the staff list to do it.
What to do this month
- Ask who uses which work apps on a personal phone and write the list.
- Sort the apps into low, medium and high risk and decide what is allowed.
- Write the minimum settings and the three honest sentences on one page.
- Add the phone steps to the leaver checklist.
- Test the removal of work accounts once with a volunteer.
This is general guidance for small businesses, not legal advice. If you process sensitive personal data or monitor employees' devices, check your data protection duties first.
Sources
- UK National Cyber Security Centre, Device security guidance: practical advice on configuring and managing phones and other devices.
- UK Information Commissioner's Office, A guide to data security: what appropriate security means for personal data held by an organisation.