Small business security
Should staff use personal phones and laptops for work?
In many small businesses, work email lives on personal phones and the odd personal laptop. It saves money and it’s convenient. It also means business data sits on devices you don’t control. You don’t have to ban personal devices, but you do need a few clear rules.
The short version
Minimum rules
- Every device has a screen lock and is kept updated.
- Work data stays in work apps, not personal ones.
- The business can remove work data if a device is lost or someone leaves.
- Laptops used for work need encryption and security software.
Benefits and risks
| Benefits | Risks |
|---|---|
| Lower hardware costs | You can’t easily check the device is updated or secured |
| Staff use devices they know | Work and personal data get mixed |
| Faster to get people working | Lost or stolen devices may hold client data |
| When someone leaves, work data may leave with them | |
| Family members may use the same device |
Phones vs laptops
Personal phones are usually manageable with the right controls, because work email and files can run inside protected apps.
Personal laptops are harder. They often have shared accounts, old software and no central protection. For anyone handling sensitive data, a business-owned laptop is usually worth the cost.
The minimum rules
- Screen lock with a PIN of at least six digits, or biometrics.
- Up to date operating system and apps, and a device that still receives security updates.
- Work apps only for work data. Use Outlook, Teams, OneDrive or Google’s apps signed in with the work account. Don’t forward work email to personal accounts or save client files to personal storage.
- No shared use of work apps by family members.
- Report a lost device straight away.
- Agreement to remove work data when someone leaves or a device is lost.
Keeping work data separate
You don’t need to control the whole phone to protect business data.
App protection (no full enrolment)
Microsoft Intune app protection policies, and similar Google Workspace controls, protect data inside work apps only. You can require a PIN for work apps, block copying work data into personal apps, and wipe just the work data remotely. The rest of the phone stays private. Staff often prefer this.
Full device management
For business-owned devices, or roles handling very sensitive data, enrolling the whole device in management (such as Intune or Apple Business Manager) gives more control, including enforcing encryption and updates.
Be clear about privacy
Staff are more comfortable when they know what the business can and can’t see. With app protection, the business can manage work apps and data but can’t see personal photos, messages or browsing. Say so in writing.
Put it in writing
A one-page BYOD policy should cover:
- Which devices and apps are allowed for work
- The minimum security rules above
- What the business can manage or wipe
- What happens when someone leaves
- Who to tell if a device is lost
- Any contribution the business makes to phone costs
Common questions
Can we wipe a staff member’s whole personal phone?
You shouldn’t need to. App protection lets you remove only work data. Full wipes of personal devices should be avoided and only done with clear, informed agreement.
A staff member refuses to install work apps on their personal phone.
That’s reasonable. Provide a work phone, or limit access to the web versions on a business device.
Is web-only access to email safer?
It can be, if combined with conditional access rules. But it’s often less convenient, so staff find workarounds. Protected apps are usually the better balance.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.