--- title: 'Staff Phones and Work Email: BYOD Security' url: 'https://triplepoint.org.uk/guides/secure-staff-mobile-phones-byod' markdown: 'https://triplepoint.org.uk/guides/secure-staff-mobile-phones-byod.md' date: '2026-10-28' description: 'Staff reading work email on their own phones? How to protect business data on mobiles without taking over personal devices, plus a simple BYOD policy.' --- # Staff Phones and Work Email: BYOD Security ![](https://triplepoint.org.uk/user/pages/guides/secure-staff-mobile-phones-byod/secure-staff-mobile-phones-byod.jpg) **To secure work email on staff phones, require a passcode and multi-factor authentication, keep work email and files inside managed work apps, and make sure you can remove company data from a phone that's lost or belongs to someone who leaves.** On a personal phone, an Android work profile or iOS User Enrolment lets you do that without seeing or touching anyone's personal photos, messages or apps. Write the rules down in a short BYOD (bring your own device) policy so everyone knows where they stand. ## How many businesses allow personal devices? In the government's [Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), **66% of businesses said they only allow access to their systems from devices the organisation owns**, up from 61% the year before. That leaves about a third of businesses where staff use their own phones, tablets or computers for work. In small businesses, personal phones are often the norm, and nobody has decided any rules for them. ## What's at risk on a phone - **Email and files,** synced and available to anyone who picks up an unlocked phone. - **The sign-in approval app.** Many people's multi-factor authentication lives on their phone, so a stolen phone can help an attacker into other accounts. - **Out-of-date software.** Older phones stop receiving security updates, and many people put off installing them. - **Phishing beyond email.** Text messages, messaging apps and QR codes all carry phishing links, and they're harder to check on a small screen. - **Work data in personal apps.** Client documents saved to a personal cloud account or shared over a personal messaging app are outside your control. - **Leavers.** Without a way to remove it, company data stays on a former employee's phone. ## Three ways to set it up | Approach | How it works | Best for | |---|---|---| | **Company-owned, fully managed** | The business owns and manages the whole phone, and can lock or wipe it | Staff handling sensitive data, or anyone who'd rather keep work and personal phones apart | | **Personal phone with a work profile** | An Android work profile or iOS User Enrolment creates a separate, managed work area. The business manages only that part | Most small businesses that allow personal phones | | **Personal phone, app protection only** | No device enrolment. Policies apply to work apps such as Outlook, Teams or Gmail, for example blocking copy and paste into personal apps | A starting point, often using what's already in your Microsoft 365 or Google Workspace subscription | Whichever you choose, the person's own photos, messages and apps should stay private, and your policy should say so. ## The minimum rules for any phone with work email 1. **A passcode or biometric lock,** with the screen locking after a short time. 2. **Multi-factor authentication** on work accounts, ideally with number matching or passkeys rather than plain approve or deny prompts. 3. **Security updates installed promptly,** and no work data on phones too old to receive them. 4. **Work email in a managed app,** such as Outlook, rather than the phone's built-in mail app, so it can be protected and removed. 5. **The ability to remove company data remotely,** if the phone is lost or the person leaves. 6. **Apps only from the official app stores.** ## What to put in a BYOD policy A one or two page policy is enough. It should cover: - **Who can use a personal device for work,** and for which data and apps. - **The minimum requirements:** the rules above. - **What the business can and can't see** on a personal device, in plain words. - **What the business can remove,** and when: if the phone is lost, if the person leaves, or if it stops meeting the rules. - **Reporting a lost or stolen phone** straight away, and who to tell. - **Leaving the business:** work apps and data are removed on the last day. - **Personal data:** how the business handles any information it collects about the device, which your privacy notice for staff should cover. Ask staff to read it and agree to it before their phone is set up, and review it once a year. Charities with volunteers face the same question; our page on [cyber security for charities](https://triplepoint.org.uk/industries/charities) covers it. ## Where we can help Our [mobile device management](https://triplepoint.org.uk/security/devices/mobile-devices) service sets up and manages company and personal phones and tablets, on iOS and Android, from the same console as your laptops. It keeps work and personal apart on staff-owned phones, can lock or wipe a lost phone, and includes protection against malicious apps and phishing links on the phone itself. It's £3 per user per month, excluding VAT. If you'd like help deciding which approach fits, [talk to us](https://triplepoint.org.uk/contact?about=Staff%20phones). ## Questions Can my employer see my personal photos and messages?+Not if the phone is set up properly. With an Android work profile or iOS User Enrolment, the business manages only the work side: work apps, email and settings. Personal apps, photos and messages stay private. Can my employer wipe my personal phone?+With a work profile or User Enrolment, the business can remove only the work apps and data, not your photos or personal apps. Your BYOD policy should say exactly what can be removed and when. Is it safe to read work email in the iPhone Mail app?+It works, but the business can't protect or remove the email inside it. Using the Outlook app with the right policies means work data stays inside managed apps and can be removed if the phone is lost or the person leaves. Should we give staff company phones instead?+It gives you the most control and the simplest policy, but it costs more, and many people don't want to carry two phones. A personal phone with a work profile is a sensible middle ground for most small businesses. Where to go next- [Mobile device management](https://triplepoint.org.uk/security/devices/mobile-devices) - [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) - [Protect your devices](https://triplepoint.org.uk/security/devices) - [Lost or stolen work laptop?](https://triplepoint.org.uk/guides/lost-laptop-encryption) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Previous: [VPN vs ZTNA: Securing Staff Working From Home](https://triplepoint.org.uk/guides/secure-remote-working-vpn-vs-ztna.md) - Next: [Secure Small Business Web Hosting: What to Look For](https://triplepoint.org.uk/guides/secure-web-hosting-small-business.md)