BYOD policy for small business: what to put in it

BYOD (bring your own device) means using personal devices, mostly smartphones, for work: reading e-mail, replying on Teams, opening a document. In many Swiss SMEs, this is already reality, often without any written rule.

BYOD is not a problem in itself. It becomes one when company data gets mixed with vacation photos, with no way to remove it when the employee leaves. A simple policy and a few technical settings are enough to keep it under control.

What should a BYOD policy include?

The Swiss Code of Obligations generally provides for appropriate compensation when an employee supplies their own work tools with the employer's agreement, unless otherwise agreed. The policy is the right place to settle this, along with the rest.

• Allowed devices: smartphones, tablets, personal computers or not, minimum operating system versions.
• Permitted uses: e-mail, Teams, documents, and what remains reserved for company computers.
• Required measures: screen lock, updates, multi-factor authentication.
• What the company can see and do on the device, and what it will not do.
• The procedure in case of loss, theft and departure.
• Cost sharing, where applicable.

Separating data on a personal device

On a personal device, there is no need to take control of the whole phone. With Intune app protection policies, the company manages only its own apps: Outlook, Teams, OneDrive, Word, Excel. It can require a PIN in them, and block copy and paste into a personal app or saving a file to personal storage.

The rest of the device (photos, messages, personal apps) stays out of the company's reach.

MFA and Conditional Access: setting the access conditions

Multi-factor authentication is the minimum for any access from a personal device. Conditional Access, included in Microsoft 365 Business Premium, then lets you allow company data only through the protected apps, and block access from an unmanaged e-mail app.

Also require a recent operating system version: a phone that no longer receives updates should no longer reach company data. App protection policies can check this each time an app is opened, without enrolling the device in Intune.

Selective wipe: what happens when an employee leaves?

In case of loss, theft or departure, a selective wipe removes only the company data from the managed apps. Photos and personal data are not touched. That is the key difference from a full wipe, which resets the entire device and has no place on a personal phone.

When someone leaves, the selective wipe comes on top of blocking the account and revoking open sessions, which cut off access even if the device is never returned.

Respecting the employee's privacy

Swiss law limits what an employer may process: under Article 328b of the Code of Obligations, it only processes data that concerns the employee's suitability for the job or that is necessary to perform the employment contract, and the nFADP applies as well. With app management, the company sees neither the browsing history, nor the photos, nor the location of the device.

State this in black and white in the BYOD policy: it is often what reassures teams most and makes the rules easier to accept.