Drafting a bring-your-own-device policy: this is what should be included

Anyone wishing to draft a bring-your-own-device policy must structure the document around four core questions: which devices and data are covered, what security requirements apply, how far the employer may monitor, and what happens in the event of loss, incidents, and departure. The rest is elaboration. Below, chapter by chapter, is what should be included, along with the legal limits that define the text.

The short answer

1. Scope of application: which employees, which devices, and which data.
2. Security requirements: encryption, screen lock, updates, separate working environment (Art. 32 GDPR).
3. Prohibited use: outdated operating systems, devices with removed security restrictions, shared family devices, off-site storage.
4. Control: grounds, scope, who decides and which safeguards apply (Art. 8 ECHR and Art. 6 paragraph 1 sub f GDPR).
5. Incidents: reporting period for loss or theft and the data breach procedure (Art. 33 and 34 GDPR).
6. Departure and sanctions: removal of company data and the consequences of violation.

Drafting a bring-your-own-device policy: start with the scope

The first chapter determines how strict the rest may be. Therefore, split by risk. An employee who only wants calendar and email on their phone requires a different regime than a controller who works with financial systems or a healthcare worker who processes special personal data. Work with two or three categories, for example, basic, elevated, and prohibited, and link the permitted data to the required measures within each category.

Additionally, explicitly state which devices are included: phone, tablet, laptop, private desktop, and whether portable storage and smartwatches are also included. Exclude shared devices. A family laptop used by children almost never meets security requirements and is the most common cause of incidents. Furthermore, state that participation is voluntary and that an employee who does not wish to participate will receive company equipment. Without that alternative, the voluntary nature becomes paper.

The security requirements

This chapter makes the difference in the event of an incident. Art. 32 GDPR mandates appropriate technical and organizational measures, tailored to the risk. Specifically:

• Separate work environment: business data exclusively in a managed container or app, never in the device's general file storage.
• Encryption of the device or at least of the work environment.
• Screen lock with code or biometrics, with a maximum lock time.
• Current software: update operating system and apps within a specified period.
• Multi-factor authentication for access to business systems.
• Network: no business data via open Wi-Fi without a secure connection.
• Backup: business data not in a private cloud backup, to prevent data from ending up outside the work environment.

Translate every requirement into a verifiable standard. Not “the device must be sufficiently secure”, but “the operating system is updated within thirty days of the release of a security update”. Only then can you determine later whether a violation has occurred and which one.

The limits of control

Monitoring of a private device infringes upon the right to respect for private life under Article 8 of the ECHR. In the case of Bărbulescu v. Romania on 5 September 2017, the European Court of Human Rights elaborated on the key issues: the employee must be informed in advance of the nature and extent of the monitoring, there must be a legitimate purpose, the measure must be necessary, and no less intrusive means may be available. Under the GDPR, the usual legal basis is the legitimate interest under Article 6(1)(f) of the GDPR. Consent from the employee is usually not sufficient, as such consent is rarely freely given in a relationship of authority.

Therefore, elaborate on the chapter as follows:

• What is recorded by default: device status, version numbers, login attempts. No message content.
• When further inspection is possible: in the event of a concrete and substantiated suspicion of a serious violation or a data breach.
• Who decides: preferably two persons, for example the Management Board together with the Data Protection Officer or the IT manager.
• What is left out of consideration: private photos, private communication, health apps, and everything outside the work environment.
• Reporting: a brief report of each inspection, with the right of inspection for the employee.

If you introduce systematic monitoring, assess whether a Data Protection Impact Assessment is required pursuant to Art. 35 GDPR. Also bear in mind that the Works Council has the right of consent regarding regulations concerning the monitoring of behaviour or performance (Art. 27, paragraph 1, part k of the Works Councils Act) and regarding the processing of employees' personal data (part l). Without consent, the regulation may be declared void, after which you can no longer rely on it.

Incidents, departure and sanctions

The final stage consists of three procedures. In the event of loss or theft, the employee reports this immediately, specifying a concrete timeframe in hours and a designated contact point, including outside office hours. The employer then assesses whether a data breach has occurred and reports this, if necessary, within 72 hours to the Dutch Data Protection Authority (Art. 33 GDPR) and, in cases of high risk, also to the data subjects (Art. 34 GDPR). Stipulate that the employer is permitted to remotely wipe the work environment and that this affects only that specific work environment.

Upon termination of employment, the removal of company data must be included in the exit procedure, accompanied by a brief confirmation signed by the employee. This is not just a GDPR point: the Trade Secrets Act only protects confidential information if the holder has taken reasonable measures to keep it secret. A demonstrable exit procedure is one such measure. Also, regulate what happens regarding the repair, sale, or trade-in of the device during employment.

Regarding sanctions , refer to the usual measures under employment law, ranging from a warning to dismissal in the event of a serious violation. If you wish to impose a fine, the requirements of Article 7:650 of the Dutch Civil Code apply, including a written agreement specifying the purpose of the fine and the maximum amount. For employees earning a wage above the minimum wage, a written deviation from this is permitted. In practice, revoking BYOD consent, accompanied by the provision of company equipment, is more effective than a fine.

Practical example: an administration office allowed BYOD without categorization. An employee stored client files in his private cloud drive, which was also on his partner's tablet. After the introduction of regulations with a mandatory work container and an explicit ban on private cloud storage, the problem was structurally resolved, without anyone having to hand in their phone.

Honest recommendation

You do not always need a lawyer for this. If you only allow calendar and email via a managed app with its own PIN code, do not process special personal data, and do not have a works council, then a page in the employee handbook will suffice: permitted devices, mandatory screen locking and updates, prohibition on storage outside the app, reporting obligation in case of loss, and deletion upon departure.

Ensure that regulations are drawn up as soon as employees access customer files, financial systems, or sensitive personal data with their own devices, as soon as you introduce device management or monitoring, or as soon as there is a Works Council that requires approval. It is precisely the monitoring chapter and the sanctions chapter that determine whether you are actually permitted to intervene in the event of an incident and whether a measure will stand up in court.

Read more: what is a bring your own device policy and having a bring your own device policy drawn up. You can arrange this directly via the bring your own device policy.

Frequently Asked Questions