Bring your own device (BYOD) policy guide

Be specific. "Personal devices" can mean a phone with Outlook on it, a home laptop used to open a client file, or a tablet a family member also uses. The policy should name which device types may access which data, and through which apps.

Keep the list short enough to verify, and enforce it with technology rather than trust wherever possible. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations include securing mobility and using strong user authentication; these map directly to BYOD rules.

• A device screen lock (PIN, password or biometric) and automatic locking.
• A supported operating system that still receives security updates; updates installed promptly.
• No jailbroken or rooted devices.
• Company apps from official app stores only, signed in with the work account.
• Multi-factor authentication on the work account.
• Work data kept inside approved apps: no forwarding to personal email, no saving to personal cloud storage, no screenshots of client data to personal photo libraries.

This is the section employees actually read. The Office of the Privacy Commissioner of Canada's guidance on privacy in the workplace stresses that monitoring should be limited to specific, appropriate purposes and that employers should be transparent about the purpose, nature and extent of monitoring. Write it plainly.

If you use Microsoft Intune app protection without enrolling personal phones, say so: the company can manage work data inside Outlook, Teams and OneDrive, see the app version and the device model and OS, and remove work data from those apps. It cannot see personal email, texts, photos, browsing history, location or other apps. If you do enroll personal devices, explain what additional information that exposes.

State what happens when someone leaves or a device is replaced: the company will remove work accounts and work data from the device, and will not wipe the whole device unless it is enrolled and the employee has agreed to that in writing. With app protection, an admin issues a selective wipe and work data is removed from the managed apps the next time they open.

Ask departing staff to confirm they have not kept copies of company data elsewhere, and make that confirmation part of the offboarding checklist.

1. 01

   Report immediately

   Name who to call or message, including outside business hours.

2. 02

   Company actions

   IT blocks sessions on the work account, issues a selective wipe, and checks sign-in logs for misuse.

3. 03

   Employee actions

   Use the phone maker's find-my-device service to lock or erase if appropriate; change personal passwords; report theft to police.

4. 04

   Privacy assessment

   If client or employee personal information may have been exposed, the company assesses whether it is a reportable breach.

Have each employee sign or electronically acknowledge the policy before their device is given access, and again when it changes. The acknowledgement should confirm they understand the security requirements, the limits on what the company sees, and the selective wipe process. Keep the acknowledgement with their HR file.

Review the policy yearly. Phone platforms and Microsoft's controls change, and so do the apps your staff use. Employment and privacy rules vary by province and sector; have your counsel review the final wording, particularly the monitoring and wipe sections.