It usually starts innocently enough. A new employee checks their work email on their personal phone because it's quicker than logging into a laptop. Someone saves a client spreadsheet to their home PC so they can finish it over the weekend. Before long, your company's emails, documents and client data are sitting on devices you've never seen, protected by whatever passcode (or lack of one) the owner happens to use. This is Bring Your Own Device, or BYOD, and most small businesses allow it without ever deciding to. The cost savings are real: no need to buy everyone a company phone. But so is the risk, and it only becomes visible when something goes wrong, a phone is lost, an employee leaves on bad terms, or a personal laptop gets hit with malware that then spreads to your business files.
The good news is that BYOD doesn't have to mean choosing between convenience and control. With a few sensible policies and the right tools, you can let staff use their own devices while keeping company data protected.
Why BYOD needs a policy, not just trust
Most SMEs manage BYOD informally: staff are trusted to "be careful" with company data. The problem is that trust doesn't stop a phone being stolen on the bus home, and it doesn't stop a departing employee from still having access to your file storage three months after they've left. A written BYOD policy, even a short one, sets out what's expected: minimum security settings like a passcode and encryption, which apps can access company data, and what happens if a device is lost or an employee resigns. It gives you something to point to and gives staff clarity about where the lines are.
Mobile device management: the basics
Mobile Device Management (MDM) software is the practical tool that makes a BYOD policy enforceable. Rather than controlling the whole phone or laptop, modern MDM typically creates a separate, managed "container" for work apps and data, leaving the employee's personal photos, messages and apps untouched. Within that container, you can:
- Require a PIN or biometric lock before work email or files can be opened
- Enforce encryption on company data stored on the device
- Block copying of company files into personal apps or cloud storage
- Remotely wipe just the work data, without touching personal content
- Push security updates and flag devices that are out of date or jailbroken
For most SMEs, this doesn't need to be complicated or expensive. Platforms like Microsoft Intune, often already included in business Microsoft 365 plans, cover the essentials without a separate IT department to run them. The key is setting it up properly from day one, rather than bolting it on after a problem occurs.
What happens when someone leaves
This is the scenario that catches most businesses out. An employee leaves, their email account gets disabled, and everyone assumes that's the end of it. But if they had the company email app, a OneDrive sync, or shared files on their personal phone or laptop, that data can still sit there long after their last day, accessible and unmonitored. With MDM in place, offboarding becomes a simple, repeatable step: when HR confirms someone has left, IT remotely wipes the managed work container from their personal device. Their photos and personal apps are untouched, but every company email, document and credential is removed in minutes. Without MDM, this relies on the ex-employee deleting things themselves, which is not a plan, it's a hope.
Lost or stolen devices
A lost phone is stressful enough without wondering whether it's also exposed your client database. The response needs to be fast and doesn't need to involve guesswork. With MDM, a lost or stolen device can be located, locked or wiped remotely as soon as it's reported, and because only the work container is affected, the employee isn't penalised for reporting it quickly. Encourage a culture where staff report a lost device immediately rather than hoping it turns up, delays of even a few hours can be the difference between a non-event and a data breach that needs reporting under UK GDPR.
Getting started without overcomplicating it
You don't need to lock down every device overnight. A sensible starting point is: identify which personal devices currently access company email or files, set a minimum security standard (passcode, encryption, up to date software), and roll out MDM for anything touching sensitive data. Review the policy yearly as your team and tools change.
BYOD is a perfectly reasonable way for an SME to operate, provided it's managed rather than ignored. Valetech Solutions sets up and manages mobile device management for businesses across Greater Manchester, so staff can use their own phones and laptops without your company data being left exposed. Get in touch with Valetech Solutions to talk through a BYOD setup that fits your business.