Staff phones and work email: securing mobile devices and BYOD

To secure work email on staff phones, require a passcode and multi-factor authentication, keep work email and files inside managed work apps, and make sure you can remove company data from a phone that's lost or belongs to someone who leaves. On a personal phone, an Android work profile or iOS User Enrolment lets you do that without seeing or touching anyone's personal photos, messages or apps. Write the rules down in a short BYOD (bring your own device) policy so everyone knows where they stand.

How many businesses allow personal devices?

In the government's Cyber Security Breaches Survey 2025/26, 66% of businesses said they only allow access to their systems from devices the organisation owns, up from 61% the year before.

That leaves about a third of businesses where staff use their own phones, tablets or computers for work. In small businesses, personal phones are often the norm, and nobody has decided any rules for them.

What's at risk on a phone

• Email and files, synced and available to anyone who picks up an unlocked phone.
• The sign-in approval app. Many people's multi-factor authentication lives on their phone, so a stolen phone can help an attacker into other accounts.
• Out-of-date software. Older phones stop receiving security updates, and many people put off installing them.
• Phishing beyond email. Text messages, messaging apps and QR codes all carry phishing links, and they're harder to check on a small screen.
• Work data in personal apps. Client documents saved to a personal cloud account or shared over a personal messaging app are outside your control.
• Leavers. Without a way to remove it, company data stays on a former employee's phone.

Three ways to set it up

Whichever you choose, the person's own photos, messages and apps should stay private, and your policy should say so.

The minimum rules for any phone with work email

1. A passcode or biometric lock, with the screen locking after a short time.
2. Multi-factor authentication on work accounts, ideally with number matching or passkeys rather than plain approve or deny prompts.
3. Security updates installed promptly, and no work data on phones too old to receive them.
4. Work email in a managed app, such as Outlook, rather than the phone's built-in mail app, so it can be protected and removed.
5. The ability to remove company data remotely, if the phone is lost or the person leaves.
6. Apps only from the official app stores.

What to put in a BYOD policy

A one or two page policy is enough. It should cover:

• Who can use a personal device for work, and for which data and apps.
• The minimum requirements: the rules above.
• What the business can and can't see on a personal device, in plain words.
• What the business can remove, and when: if the phone is lost, if the person leaves, or if it stops meeting the rules.
• Reporting a lost or stolen phone straight away, and who to tell.
• Leaving the business: work apps and data are removed on the last day.
• Personal data: how the business handles any information it collects about the device, which your privacy notice for staff should cover.

Ask staff to read it and agree to it before their phone is set up, and review it once a year. Charities with volunteers face the same question; our page on cyber security for charities covers it.

Where we can help

Our mobile device management service sets up and manages company and personal phones and tablets, on iOS and Android, from the same console as your laptops. It keeps work and personal apart on staff-owned phones, can lock or wipe a lost phone, and includes protection against malicious apps and phishing links on the phone itself. It's £3 per user per month, excluding VAT. If you'd like help deciding which approach fits, talk to us.

< Back to Guides