Contract guide
Company Personal Mobile Device Use Policy — What to Include
A personal mobile device use policy sets rules for accessing company systems on employee-owned devices. Learn what to include for security, privacy, and offboarding.
Written and reviewed by Talking Tree's legal team · Last reviewed September 2026
An employee checks customer records on a personal phone, then loses it during a commute. Your response depends on decisions made before the device went missing: what access was allowed, what security was required, and what the company can remove. A Personal Mobile Device Use Policy puts those decisions in writing.
What Is a Company Personal Mobile Device Use Policy?
A Company Personal Mobile Device Use Policy, often called a bring-your-own-device or BYOD policy, governs the use of personally owned phones and tablets for work. It defines access conditions, security controls, employee privacy expectations, and procedures for incidents and departure. It should reflect the controls your IT team can actually implement.
When Do You Need One?
- Employees use personal phones for company email, messaging, or customer systems
- Your team works remotely or handles sensitive data outside the office
- You plan to deploy device management software
- You need a consistent process for lost devices and employee departures
What Should a Company Personal Mobile Device Use Policy Include?
1. Covered Devices and Permitted Use
Identify eligible users, devices, operating systems, and approved business applications. Explain whether participation is optional and how someone requests a company-provided alternative.
2. Enrollment and Access Approval
Define the approval process before company accounts are added. Require supported software and identify who can suspend access when a device no longer meets the standard.
3. Security Requirements
Specify screen locks, encryption where supported, updates, multifactor authentication, and restrictions on rooted or jailbroken devices. Match each requirement to the sensitivity of the systems being accessed.
4. Separation of Company and Personal Data
Use managed work profiles or applications where feasible. Address backups, file sharing, shared family devices, and whether company information may be saved to personal cloud accounts.
5. Privacy and Monitoring Notice
Explain what administrators can see, collect, or change, including relevant device details and work application data. Do not claim the company can inspect everything merely because the employee uses a work account.
6. Remote Removal and Consent
Describe when work access or data may be removed, who authorizes it, and the difference between selective work-data removal and a full device reset. Obtain appropriate acknowledgment and assess local privacy requirements before deployment.
7. Costs, Support, and Work Time
Explain reimbursement, service plans, repairs, and the limits of IT support. Clarify that employees should record compensable work performed on mobile devices and check applicable expense reimbursement rules.
8. Lost Devices and Security Incidents
Provide a reporting contact and immediate steps for loss, theft, suspected malware, or accidental disclosure. Connect device reporting to the company's broader incident response process.
9. Offboarding and Exceptions
Describe access revocation, return or preservation of business records, and removal of work data when a person leaves. Assign an owner to approve time-limited exceptions and review the policy.
Common Mistakes Founders Make
Promising privacy the technology cannot provide. Confirm actual management capabilities before describing what the company can access.
Authorizing unrestricted wiping. A full reset can remove personal photos and records. Define narrow, workable procedures and consent requirements.
Ignoring after-hours work. Mobile access can blur working hours. Give managers and employees clear timekeeping expectations.
Why This Matters for Founders
Personal devices can make work easier, but unclear rules create friction during the moments that matter most. A practical policy helps employees understand the tradeoffs and gives IT a defined basis for protecting company information.
Coordinate it with your Data Incident Notification Policy and Employee Handbook.
Frequently Asked Questions
What is a BYOD policy?
A policy governing work access from personally owned devices, including security, privacy, support, and removal of company data.
Can the company wipe a personal phone?
That depends on applicable law, the agreed policy, consent, and technical controls. Define the scope carefully and prefer selective removal of company data where feasible.
What should the policy include?
Eligibility, enrollment, security, data separation, monitoring notices, removal procedures, costs, incident reporting, and offboarding.
Legal and Practical Context
NIST's BYOD guidance addresses both organizational security and the privacy risks of using personally owned devices for work. Use it to align the written policy with technical controls. NIST Mobile Device Security: BYOD.
This guide focuses on common U.S. business considerations. Requirements and enforceability depend on the jurisdiction and the facts of the arrangement.
Explore Talking Tree's Contract Studio
Cedar, Talking Tree's Contract Studio, brings document preparation and signing into one workflow. Use this guide to organize your requirements, then explore the available templates and tailor the document to your business.
Get started with Talking Tree.
This page is for informational purposes only and does not constitute legal advice. For advice specific to your situation, consult a licensed attorney.