BYOD Policy for UK Business: What to Include & Template Guide

What Is a BYOD Policy?

A bring your own device (BYOD) policy sets the rules for employees using personal smartphones, tablets, and laptops to access company systems, data, and applications. It defines the security requirements, responsibilities, and boundaries that apply when personal devices are used for work purposes.

BYOD is increasingly common in UK businesses. It can reduce hardware costs and give employees flexibility, but without a clear policy, it introduces significant security and compliance risks — particularly around data protection and GDPR.

Why You Need a BYOD Policy

Allowing personal devices without a policy is one of the most common security gaps in UK SMEs. Here is why a formal BYOD policy is essential:

• Data protection — You need to ensure company data on personal devices is encrypted, backed up, and erasable if the device is lost
• GDPR compliance — Personal devices accessing customer data must meet the same security standards as company-owned equipment
• Security consistency — Without a policy, some personal devices may lack antivirus, encryption, or current software updates
• Clear boundaries — Both employer and employee need to understand who is responsible for what
• Liability clarity — Define what happens if a personal device is lost, stolen, or needs to be wiped

What to Include in Your BYOD Policy

1. Scope and Eligibility

Define which employees are eligible for BYOD and what types of devices are permitted:

• Which roles or departments can use personal devices for work?
• What device types are covered — smartphones, tablets, laptops, or all three?
• Are there minimum specifications (e.g., devices must run a supported operating system version)?

2. Security Requirements

This is the most critical section. Personal devices must meet minimum security standards:

• Screen lock — Device must have a PIN, password, or biometric lock enabled
• Encryption — Full-device encryption must be active
• Operating system — Must be on a currently supported and updated version
• Antivirus — Endpoint protection must be installed (you may specify an approved solution)
• MFA — Multi-factor authentication must be enabled on all business accounts accessed from the device
• No jailbreaking or rooting — Modified devices are not permitted

3. Mobile Device Management (MDM)

Specify whether personal devices must be enrolled in your MDM platform (e.g., Microsoft Intune, JumpCloud, or Jamf). MDM allows you to:

• Enforce security policies remotely
• Separate work data from personal data using containerisation
• Remotely wipe company data without affecting personal files
• Monitor compliance with your security requirements

Be clear about what the MDM can and cannot see — employees are often concerned about personal privacy when enrolling their own devices.

4. Acceptable Use

Define what employees can and cannot do with company data on personal devices:

• Company data must only be accessed through approved applications
• Data must not be stored locally on the personal device outside of managed containers
• Sharing work data via personal email, messaging apps, or cloud storage is prohibited
• Employees must not allow family members or others to use their device to access work applications

5. Data Ownership and Privacy

Clearly state the boundaries between company and personal data:

• Company data on the device remains the property of the business
• The business reserves the right to remotely wipe company data from the device
• Personal data, photos, and apps will not be accessed, monitored, or deleted by the business
• In the event of a full device wipe (e.g., if selective wipe is not possible), the employee accepts the risk of personal data loss

6. Lost or Stolen Devices

Establish a clear reporting and response process:

• Lost or stolen devices must be reported to IT within a defined timeframe (e.g., within 2 hours)
• IT will remotely wipe company data from the device immediately upon notification
• The employee should also change their personal passwords and report the loss to their mobile provider

7. Leaving the Company

Define what happens to company data when an employee leaves:

• All company data, apps, and profiles will be removed from the personal device
• The employee must present their device to IT for verification that all company data has been removed
• MDM enrolment will be revoked

8. Cost and Support

Clarify financial responsibilities:

• Will the business contribute to device costs, mobile data, or insurance?
• To what extent will IT support personal devices — full support, limited to business apps only, or no support?
• Who is responsible for repairs if the device is damaged?

BYOD and Compliance

A BYOD policy is an important component of your wider IT compliance framework. Auditors for Cyber Essentials, ISO 27001, and GDPR will want to see that you have documented controls for personal devices accessing company data.

Ensuring mobile device security across both company-owned and personal devices is critical to maintaining a strong security posture.

Getting Help

If you need help creating or enforcing a BYOD policy, a managed IT provider can draft the policy, deploy the MDM platform, and ensure ongoing compliance — leaving you to focus on running your business.