Most businesses do not decide to allow personal devices. They discover it has already happened. Someone added work email to their phone. Someone opened a client file on a home laptop. Someone signed into a company application from a computer shared with their family.
The moment business data lands on a device you do not control, you lose visibility into updates, installed apps, who else uses it, and where files are backed up. You also lose the ability to remove that data cleanly when the person leaves.
Personal devices can be allowed. What cannot be left undecided is which devices, which applications, and which work.
What you give up
On company-owned equipment, your provider sets and monitors the security posture. On a personal device, the employee decides what to install, when to update, and who else gets to use it.
Other people use the device. A home laptop shared with a partner or a teenager, often through one account, with your client files in the downloads folder. UK guidance on this is blunt: if work cannot be kept separate from other users of a device, that device should not have access.
Updates lag. You cannot confirm a personal phone is on a supported OS or has current patches unless it is enrolled in something.
Files leak into personal storage. A document opened from work email lands in Downloads, gets picked up by a personal cloud backup, and is now in an account you have no relationship with.
Repairs happen. A cracked phone goes to whichever shop is closest, with the work mailbox still signed in.
Data survives the employment. Disabling an account stops future access. It does not retrieve the files already copied somewhere unmanaged.
Decide what work is allowed where
Set access by the sensitivity of the work, not by the convenience of the device.
Reading work email through an approved mobile app on a personal phone is reasonable. Exporting the client database is not. Staff handling financial records, health information, privileged documents or bulk client data should be on company equipment for that work.
Administrative work is the clearest line. Anyone managing user accounts, security settings, backups or core systems should not do it from an unmanaged personal computer. That account is too valuable.
Contractors follow the same rules, scoped to whatever they were hired to do.
The controls to require
A personal device should meet these before it touches company data:
A supported operating system, still receiving security updates. Block access from anything that cannot install current updates.
A screen lock with a PIN, password or biometric, set to engage automatically.
Full device encryption, enabled before the device goes missing rather than after.
MFA on work email, cloud storage and anything else that matters. This is the floor, not the ceiling.
No rooted or jailbroken devices. Detection is imperfect, so this sits alongside the other controls rather than replacing them.
Approved applications only for email, messaging and file access, with saving to personal storage blocked where your management platform supports it.
A separate user account on any shared computer, with a password nobody else in the household knows.
A reporting path for lost, stolen, repaired or replaced devices. Fast reporting is what makes the rest of the response possible.
Managed apps beat managed devices
There are two approaches and the distinction matters more than most people expect.
Device management enrolls the whole device. Application management applies controls only to the work apps and the data inside them, restricting copy and paste, blocking saves to personal storage, and requiring a separate PIN.
For employee-owned equipment, application management is usually the right answer. Microsoft Intune can remove company data from protected applications when a device goes missing or someone leaves, while leaving personal photos and messages untouched. Full device management gives you more control and also gives you the ability to wipe a device your business does not own, which is a conversation nobody wants to have.
Either way, selective removal only reaches data the service manages. A file copied into an unmanaged app or a personal backup is beyond its reach, which is the real argument for restricting where files can go in the first place.
What the policy needs to answer
Who may use personal devices. Which device types. What work is permitted. Which applications are required. Whether files may be downloaded. Whether the device can be shared. Which security settings are mandatory. What the business can see, change and remove. What happens when a device is lost. What must happen before a repair or a sale. What happens when the employee leaves. And who pays for data, repairs and replacement.
Have the policy reviewed for the states and countries where you actually employ people, and have staff accept it in writing before access is granted.
When to just buy the device
Provide company equipment when the employee handles sensitive information, the role requires administrator access, large volumes of company data must be stored locally, the device is shared with other people, the operating system is unsupported, encryption cannot be enabled, your business cannot separate or remove its data, or the employee declines the required controls.
A laptop is cheaper than an incident, and managed equipment is faster for us to support because we already know what is on it.
If your team is already using personal devices and nobody has written down the rules, that is worth an hour. We can help you work out where the lines should sit.