Who this is for
This guide, What to put in a bring your own device policy, is for founders, operations leads and IT staff at small and mid-sized companies where people already use personal phones for work email or chat. It also fits the harder case: personal laptops that reach internal systems. If your only rule today is a verbal yes from a manager, you have a policy gap, not a policy.
The goal is not to ban personal devices. Set clear limits before the first lost phone or departing employee. Decide what data can live on personal gear, what controls are required and where support stops. Cover full-time staff, part-time staff and contractors, and name any role that cannot use personal devices, such as finance roles with access to sensitive customer records.
Before you begin
Map your access levels before you write rules. Put email and calendar in one tier, chat and file sharing in a second, and source code, finance systems and customer records in a third. A personal phone that reads email needs lighter controls than a personal laptop that can query a production database. Write the tiers down so the policy can point to them.
Choose the control method. For phones and tablets, an app protection policy in Microsoft Intune or Google Workspace can wrap work apps and remove work data without managing the whole device. Android work profiles and iOS user enrollment separate work and personal data when you need device-level controls. For laptops, decide whether you manage the device or only the apps and network access. Do not promise privacy you cannot deliver.
Settle support and money questions with finance and operations. Decide whether the company pays for a stipend, data plan or repairs, and write the rule in plain words. Point to the expense policy for amounts. Decide who approves exceptions and how long they last. An exception without an expiry date becomes the new standard.
Read your customer contracts and insurance terms for clauses about where data can be stored and who can access it. You do not need legal language in the policy, but you do need to know which systems are off limits on personal gear. That list will shape the access tiers.
The checklist
A useful policy is short enough for a new hire to read in one sitting and specific enough for the help desk to apply without asking a manager. Use the items below as the draft agenda. Attach a one-page matrix that maps each role to an access tier, the allowed device types and the required controls.
Write the policy in two parts. The first part is the rulebook: scope, privacy, support and exit. The second part is the control sheet: minimum OS versions, screen lock rules, encryption, app protection settings and the enrollment steps. Keep the control sheet in a versioned document so IT can update settings without reopening the whole policy.
Test each sentence against a real case. If an employee buys a new phone, what happens to the old one? If a contractor finishes a project, who removes the work profile? If a device is stolen, what is the first step? If a rule cannot be enforced with your tools, change the rule or the tool.
- State the scope: which people, which device types and which systems are covered, and name any role that cannot use personal devices.
- Define access tiers from email and chat to source code and finance systems, and list the controls required for each tier.
- Require enrollment in the company management tool before the first work app is added.
- Set a minimum operating system version and a patch deadline, with automatic updates required where the platform allows it.
- Require a screen lock with a passcode or biometric, plus automatic lock after a short period of inactivity.
- Require full disk encryption and block work access from rooted, jailbroken or otherwise modified devices.
- Explain what the company can see and remove, such as work data only, and what it will never touch, such as personal photos and messages.
- Keep work data in managed apps or a work profile, and block copy and paste into personal apps for the highest tier.
- Set acceptable use rules for work data on personal devices, including no forwarding to personal email and no storing work files in personal cloud accounts.
- Set network rules for public wireless networks and travel, and require the company access client or VPN for internal systems.
- Name the person to contact when a device is lost or stolen, the time limit to report it and the steps that follow.
- Define the exit process: remove the work account, wipe work data and confirm completion before the last day.
- State the support boundary: IT supports work apps and access, not personal hardware repairs, carrier plans or personal data.
- Set an exception process with an owner, a written reason and an expiry date, and state what happens when a device falls out of compliance.
What good looks like
A good policy passes a simple test. A new hire can enroll a phone in about fifteen minutes with the guide you provide, and the help desk can answer basic questions without escalating. A manager can tell from the matrix whether a personal laptop is allowed for a given role. A departing employee gets a clear checklist, not a vague reminder. Different tiers can have different answers, and that is fine as long as the matrix says so.
Privacy language is specific. It says which data the management tool reports, such as device model, operating system version and compliance status, and which data it cannot read, such as personal email and photos. It does not say the company may wipe the whole phone unless that is truly the rule, with a stated trigger and a confirmation step. Vague warnings erode trust and invite workarounds.
The controls are enforced, not just written. Sample a few enrolled devices each quarter and check OS versions, screen lock and encryption status. Test the remote wipe on a spare phone or a test account. Review exceptions that are near expiry. If a rule is ignored by many people, fix the rule or the tool instead of adding another reminder.
What to do next
Draft the scope and access tiers on one page each. Run the draft past finance for the reimbursement rule and past the help desk for the support boundary. Pick a small pilot group with a mix of phones and laptops, enroll them and watch where they get stuck. Fix the guide before you publish the policy.
Add the policy to onboarding and offboarding. New hires sign it before they get work data on a personal device. Leavers get the removal steps with their account shutdown notice. Keep an exception log and review it on a schedule. Review the control sheet when platforms release major updates or when you change your identity provider, and assign one owner for the document and one for enforcement settings.
If device standards and support boundaries are unclear, the Hardware and endpoint review from Cloudverg, a fixed price of $4,500 over two weeks, inventories endpoints and produces a standard device specification per role. It is one option among others. You can also run the inventory internally or with your managed service provider, then use this checklist to draft the policy.
Frequently asked questions
Can an employer wipe a personal phone under a bring your own device policy?
Only work data if the company uses a managed app or work profile, and the policy must say so before enrollment. A full device wipe on personal hardware needs a stated trigger and clear consent.
What should a bring your own device policy say about privacy?
It should list what the management tool collects, such as device model and compliance status, and what it cannot see, such as personal photos and messages. Say where work data lives and how it is removed.
Do contractors need to follow the same bring your own device policy?
Yes, but with tighter scope. Give contractors a time-limited account, the lowest access tier that fits the work and an exit step tied to the contract end date.