Skip to content 
BYOD (Bring Your Own Device)
Using your own smartphone for company email as well is convenient for many employees. For companies, it raises questions: who owns the data, who may erase it, and what happens when someone leaves? This entry explains BYOD, distinguishes it from other device models and shows the consequences for data protection and offboarding.
In brief
BYOD (Bring Your Own Device) refers to a model in which employees also use private smartphones, tablets or notebooks for work tasks. The company remains responsible under data protection law for the business data on these devices but does not have full access to the device. When someone leaves or changes devices, the company data must therefore be removed in a targeted way without touching private data.
BYOD and other device models
| Model | Ownership of the device | Private use |
|---|---|---|
| BYOD – Bring Your Own Device | Employees | Yes, the device is private |
| CYOD – Choose Your Own Device | Company; selection from a device list | Depending on the policy |
| COPE – Corporate Owned, Personally Enabled | The company | Permitted, in a separate area |
| COBO – Corporate Owned, Business Only | The company | No |
The more the device belongs to the company, the easier it is to manage, reclaim and erase verifiably.
Data protection with BYOD
If business emails, contacts or documents are stored on a private device, the company remains the controller within the meaning of the GDPR. It must protect the data with suitable measures without interfering disproportionately with privacy. The following have proven effective:
- Separation of data: Business apps and data run in a separate area, for example in the Android work profile or through user enrollment at Apple.
- Device management with a sense of proportion: One mobile device management or an app management solution, for example with Microsoft Intune, manages only the business area.
- Clear agreement: A usage policy regulates obligations, control rights and the procedure in case of loss and departure. If there is a works council, it generally has to be involved.
If a private device containing company data is lost, this can be a Data breach that must be reported.
Rule of thumb: with BYOD, you do not own the device, but you do own the responsibility for the company data on it.
BYOD during offboarding
When an employee leaves the company, she keeps her device. The company can remove the business area using a selective Remote wipe but cannot erase the entire device. There is no certificate for each data carrier of the kind that is customary for company-owned devices. It also remains unclear whether business data has ended up in private backups or cloud accounts. The usage agreement should therefore stipulate that employees confirm the removal. A complete list of the steps when someone leaves can be found in our offboarding checklist.
BYOD and Second IT
Viele Unternehmen setzen wegen dieser Nachweislücke auf firmeneigene Geräte. Für sie bietet Second IT eine nachweisbare Ausmusterung: Abholung mit eigener Sicherheitslogistik, Löschung von Smartphones, Tablets und Notebooks mit Blancco und ein digital signiertes Löschzertifikat je Gerät. Mehr zur certified data deletion.
Frequently asked questions about BYOD
Is BYOD permitted under the GDPR?
Yes, the GDPR does not prohibit BYOD. However, the company must protect the business data and respect employees’ privacy. In practice this works with separate areas, device or app management and a written agreement.
May the employer remotely erase a private device?
Erasing a private device completely is delicate, because private data is lost as well. Selectively erasing only the business area is the usual approach. What is permitted should be stated in the usage agreement in advance.
What is the difference between BYOD and COPE?
With BYOD, the device belongs to the employees. With COPE, it belongs to the company, but private use is permitted. COPE devices can ultimately be fully reclaimed and erased with certification.
What happens to company data with BYOD when employees leave?
The device stays with the employees. The company can remove the business area using a selective remote wipe but cannot erase the entire device. It remains unclear whether data has ended up in private backups or cloud accounts. The usage agreement should regulate the confirmation of the removal.
How can private and business data be separated with BYOD?
Business apps and data run in a separate area, for example in the Android work profile or through user enrollment at Apple. Mobile device management or an app management solution such as Microsoft Intune then manages only the business part of the device.
Decommission company-owned smartphones and tablets, with a certificate for each device.
Send us your device list. You will receive your offer in 48 hours on average.