Bring Your Own Device (BYOD) Policy

Let staff use their own phones, tablets and laptops for work safely – with device standards, data separation, device management and clear, signed consent to enrolment and remote wipe.

Editable Word document
14
10pages
Guidance notes included
aml consultancy solutions

IT & cyber security

Bring Your Own Device (BYOD) Policy

About this document

What it’s for

A policy and registration form for staff who use a personal device to access work email, files or systems. It sets minimum security standards, keeps business data separate from personal data, explains what device management can and cannot see, and records the user’s agreement to enrolment and to remote wiping.

When to use it

  • When any staff member reads work email or uses work apps on a personal phone, tablet or computer
  • Before rolling out mobile device management (MDM) or app protection policies
  • When preparing for Cyber Essentials, which treats such devices as in scope

What’s inside

The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.

  1. Purpose
  2. Scope
  3. Definitions
  4. Roles and responsibilities
  5. Who may use a Personal Device
  6. Registering a device
  7. Minimum security standards
  8. Keeping business and personal data separate
  9. Device Management and what we can see
  10. Monitoring, privacy and data protection
  11. Loss, theft and compromise
  12. Remote lock and wipe
  13. Costs, support and insurance
  14. Changing device or leaving
  15. Breaches of this policy
  16. Review and related documents
  17. Purpose
  18. Scope
  19. Definitions
  20. Roles and responsibilities
  21. Who may use a Personal Device
  22. Registering a device
  23. Minimum security standards
  24. Keeping business and personal data separate
  25. Device Management and what we can see
  26. Monitoring, privacy and data protection
  27. Loss, theft and compromise
  28. Remote lock and wipe
  29. Costs, support and insurance
  30. Changing device or leaving
  31. Breaches of this policy
  32. Review and related documents

Also included

  • Part 1 – Your details
  • Part 2 – Device details
  • Part 3 – Security checks (to be confirmed by the user and verified by IT)
  • Part 4 – Agreement and consent
  • Part 5 – Approval (organisation use)
  • BYOD register (kept by the IT Lead)

How to complete it

  • Choose whether BYOD is open to all staff or only approved roles (clause 5)
  • Describe your actual MDM or app management tool accurately in clauses 9 and 10
  • Decide whether you will ever use a full wipe, and say so plainly (clause 12)
  • Have every BYOD user sign the registration and consent form in Appendix A

Key points to check

  • Complete a short data protection impact assessment before enrolling personal devices
  • Never wipe a personal device without following the process and the consent given

Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.

Included in the pack

IT & cyber security

£20

for every document in this category

Editable Microsoft Word files

Guidance notes in every document

Written for UK businesses

Download and keep

Get the packSee every document in this pack →

Need more than one category?

Documents All-Access gives you every category for 12 months for £295.

Compare options →

Need it tailored?

We can adapt any template to your business, or write a document from scratch.

Talk to us →