“Can I add work email to my phone?” is a policy question in disguise.

In most companies, BYOD was never decided. It just happened. Someone added work email to their phone in 2022, someone else downloaded a client file to a home laptop during a deadline crunch, and by the time anyone asks about policy, company data lives on a dozen devices the business has never seen.

Personal devices for work can be a perfectly reasonable call. What’s not reasonable is making it by default. The moment business data lands on a device you don’t manage, you’ve lost control over its updates, its installed apps, its backups, and who else picks it up at the kitchen table. And you’ve acquired a new obligation: getting that data back when the person leaves or the phone disappears.

What you genuinely can’t control on someone else’s device

On a company machine, IT sets the rules and verifies them. On a personal one, the employee decides when the OS updates, which apps get installed, and whether the whole family shares one login. The specific failure modes are predictable:

• Shared use. A home computer with one account for everyone means your spreadsheets sit next to a teenager’s game downloads. If work can’t be kept separate from other users, that device shouldn’t have work access. Full stop.
• Stale updates. You often can’t verify a personal device is patched, and people delay updates for the most human reasons: no storage, an old app might break, the phone never gets restarted.
• Files that wander. A downloaded attachment ends up in Downloads, then in a personal cloud backup the business doesn’t manage, then in a third app’s cache. Each hop is a copy you can’t delete.
• Repairs. A cracked screen goes to whatever shop is closest, with the work mailbox still signed in.
• Departures. Disabling an account stops future cloud access. It does nothing about what was already downloaded.

Decide by the work, not the device

The sane middle ground is tiered: reading email through an approved mobile app is fine on a personal phone; exporting the customer database is not. People handling financials, health records, or legal documents work on company hardware. And anyone doing administrative work (user accounts, security settings, backups) does it from a managed device, no exceptions. Apply the same logic to contractors, who are easy to forget and often hold more access than they need.

The minimum bar for a personal device

Before a personal device touches company data, it should clear all of these:

• A supported operating system that still gets security updates, with updates set to install automatically.
• A screen lock that engages on its own, and full-device encryption.
• MFA on email and every important system.
• No rooted or jailbroken devices.
• Work done only in approved apps, and a separate user account on any shared computer.

Pair that with one more thing people forget: employees need to know who to call, fast, when a device is lost, stolen, or headed to a repair shop. Early reporting is what makes everything else work.

Managed apps: the tool that makes BYOD tolerable

Application management (Microsoft Intune, or the endpoint management built into Google Workspace) is what separates a defensible BYOD setup from wishful thinking. It can ring-fence work apps and their data: blocking copy-paste into personal apps, preventing saves to personal storage, and selectively wiping company data while leaving photos and texts alone. That selective wipe is the feature that matters. A full factory reset of an employee’s personal phone is a conversation you do not want to have.

Be honest about the limits, though. Selective wipe only removes what the management layer controls. A file that escaped into an unmanaged app or personal backup is out of reach. And remote commands only land when the device comes online, which is why encryption and MFA have to already be in place, not planned.

Write it down, and answer the awkward questions

A real BYOD policy answers: who may use personal devices, for what work, through which apps; whether files can be downloaded; what the business can see and remove (put this in writing; employees deserve to know before enrolling); what happens on loss, repair, or departure; and who pays for data and repairs. Have employees accept it before access is granted, not after.

When the answer is just “no”

Buy the company device when the role involves sensitive data or admin access, when large amounts of company data must live locally, when the device is shared or can’t be encrypted, or when the employee won’t accept the controls. For a 25-to-150-person business in San Diego County, a known, managed laptop is often cheaper over its life than the support and incident costs of an unmanaged one. BYOD saves on hardware and spends on everything else.