What should be included in a BYOD policy?

At minimum: scope and eligible devices, a security baseline, separation of work and personal data, a plain privacy statement, acceptable use, lost-device reporting, offboarding, support and costs, data protection duties, and a signed acknowledgement with a review date. The template in this article covers all ten.

How do you create a BYOD security policy?

Start with the data and decide which systems personal devices may reach. Pick an ownership model for each role, write the clauses, choose the MDM enrolment method that enforces them, then train staff and collect acknowledgements. The NCSC's BYOD guidance follows a similar order: set objectives, write the policy, estimate costs, choose a deployment approach and put technical controls in place.

What is the difference between BYOD and COPE?

With BYOD the employee owns the device and the company manages only a work space on it. With COPE (corporate-owned, personally enabled) the company owns and manages the device but allows a separate personal space. COPE gives IT more control; BYOD gives the employee more privacy.

What happens to work data when an employee leaves?

Under a good BYOD policy, IT removes the work profile or managed accounts and revokes access on the last working day. Work apps and data are deleted; personal apps, photos and messages stay on the device.

Does India's DPDP Act apply to BYOD devices?

Once its main obligations take effect (13 May 2027), it applies to the personal data on them. From then, section 8(5) of the Digital Personal Data Protection Act, 2023 requires reasonable security safeguards for personal data in a company's possession or under its control, which can include work data on employees' own phones, and the Act's schedule allows penalties of up to ₹250 crore for failing that duty. Ask your legal team how it applies to your setup.

Do you need MDM for BYOD?

For anything beyond email on a few phones, yes. Without MDM there is no way to check the security baseline, separate work data or remove it when someone leaves. On Android and Apple devices, an MDM is also what creates the separate work space in the first place.

BYOD Policy: What to Include, With a Template

A BYOD (bring your own device) policy is the written set of rules for using personally owned phones, tablets and laptops for work. It covers who may use a personal device, the minimum security settings, how work data is kept apart from personal data, what the company can and cannot see, and how work data is removed when someone leaves.

A policy only holds if it is enforced, which in practice means enrolling personal phones into a work profile or a similar managed space through MDM.

10: clauses a complete BYOD policy should cover
₹250 crore: maximum DPDP Act penalty for failing to keep reasonable security safeguards (from May 2027)
Android 11+: work-profile apps cannot read personal SMS or MMS

Most staff already read work email on their own phones. A BYOD policy decides whether that happens on your terms or by accident: which devices qualify, what IT controls, what IT never sees, and what happens to company data when someone leaves.

The problem

Why informal BYOD causes trouble

BYOD rarely starts as a decision. Someone adds the work mailbox to their own phone, a sales team builds a customer WhatsApp group, a contractor saves a price list to a personal tablet. Months later the company has work data on dozens of devices it has never seen and could not wipe if it wanted to.

The opposite mistake does as much damage. IT reacts by demanding full control of personal phones, staff refuse, and work moves quietly into personal apps where nobody can see it. The UK's National Cyber Security Centre warns that a badly designed scheme can push people towards exactly this kind of shadow IT.

Company data with no owner: files, chats and mail on phones IT has never enrolled
Over-reach: full device control demanded on a phone the employee paid for
Leavers keep access: mailbox and app sessions stay signed in after the last working day
Lost phones, no answers: nobody can say whether the device had a screen lock or encryption
Shadow IT: rules nobody can live with push work into personal apps

Definition

What is a BYOD policy?

A BYOD policy is an agreement between the company and each person who uses a personal device for work. It sets the company's rules for the work data on that device and the company's limits on the device itself. The NCSC's framing is worth keeping in mind: the device is the property of the user, while the corporate data and access on it belong to the organisation.

It sits alongside your general IT security policy rather than inside it. Company-owned devices can be fully managed; personal devices need a lighter and more transparent approach, which is why NIST's mobile security guidance, SP 800-124 Rev. 2, treats organisation-provided and personally owned deployments as separate scenarios. If the management side is new to you, what MDM is explains the tools that do the enforcing.

Policy contents

What a BYOD policy should include

Ten clauses cover almost every situation a growing company meets. Keep each one short enough that people actually read it before they sign.

1. Scope and eligibility

Say who the policy covers (employees, contractors, interns), which device types are allowed and which data they may reach. Require an operating system version that still receives security updates, and exclude rooted or jailbroken devices outright. It is reasonable to keep some systems, such as production databases or payroll, off personal devices entirely.

2. Security baseline

Set the minimum: a screen lock, device encryption, operating system updates installed within a fixed number of days, and apps only from official stores. Write the baseline as checks your MDM can verify automatically, not as advice. Our MDM best practices checklist covers how to define one baseline and apply it everywhere.

3. Separating work and personal data

This is the clause that makes BYOD acceptable to staff. On Android, a work profile keeps work apps and data in a separate space marked with a briefcase badge, while personal apps, data and usage stay private. On iPhone and iPad, Apple's account-driven User Enrollment does a similar job for personally owned devices: IT can manage only the organisation's accounts, settings and information. On personal laptops, keeping work inside a managed browser profile or a virtual desktop is usually lighter than installing a full management agent.

4. Privacy: what IT can and cannot see

List it plainly. IT can typically see the device model, OS version, compliance status and the work apps it installed. IT should not see personal apps, photos, messages or browsing outside the work space, and the policy should say whether location is ever collected. On a personal device, the honest default is that it is not.

5. Acceptable use

Keep company data inside approved work apps. No forwarding to personal email, no saving to personal cloud storage, no copying customer data into personal messaging apps. Short, concrete rules work better than a page of prohibitions.

6. Lost or stolen devices

Set a reporting deadline, such as within 24 hours, and name who to tell. Then explain what happens next: IT removes work data remotely, and personal data is left alone.

7. Offboarding

On the last working day, IT removes the work profile and company accounts and revokes access. The employee keeps the device and everything personal on it. Put this in writing, because fear of a full wipe is one of the main reasons staff resist enrolment.

8. Support and costs

State what IT supports (work apps and access, not the phone itself) and whether the company pays a stipend or reimburses part of the cost. Either answer is fine. Leaving it unstated is not.

9. Data protection duties

Work data on a personal phone often includes personal data about customers and colleagues. In India, section 8(5) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to protect personal data in its possession or under its control with reasonable security safeguards, and the Act's schedule allows penalties of up to ₹250 crore for failing to do so. These duties take effect on 13 May 2027 under the phased commencement notified with the DPDP Rules, 2025, so build the controls now. Section 7(i) lists employment-related purposes among the legitimate uses of personal data, but how far that reaches is a question for your legal team, not for a template.

10. Acknowledgement and review

Each person signs or accepts the policy before enrolment. Review it every year, and again whenever your device platforms change their management options, which tends to happen with major OS releases.

Compare

BYOD vs COPE vs fully managed devices

BYOD is one of three ownership models, and many companies run two of them side by side. The right choice depends on the data a role handles, not on what is cheapest to roll out.

Device ownership models compared

Model	Device owner	What IT manages	Employee privacy	Typical fit
BYOD (work profile)	Employee	Work apps, accounts and data only	High: the personal side is untouched	Email, chat and documents for most office roles
COPE (corporate-owned, personally enabled)	Company	The whole device, with a separate personal space	Medium	Roles handling sensitive data where staff want one phone
Fully managed (corporate-owned)	Company	The whole device	Low: work use only	Field devices, kiosks and high-risk roles

Enforcement

How to enforce a BYOD policy with MDM

A policy that nothing checks is a hope. Enforcement means the device proves it meets the baseline before it gets access, and keeps proving it afterwards.

Android phones

Use Android Enterprise work-profile enrolment for personal phones. The employee sets up the work profile, IT manages only that profile, and removing it deletes the work apps and data without touching anything else. Infronest's Android MDM supports work-profile enrolment for personally owned phones alongside fully managed enrolment for company devices.

iPhone and iPad

Apple's account-driven User Enrollment is the method built for personal devices. If you use Infronest, know the scope: iPhone and iPad are managed through native Apple MDM enrollment (a signed configuration profile and your organisation's own Apple push certificate); there is no Infronest iOS app. Account-driven User Enrollment is not supported, so this route suits company-owned iPhones better than personal ones.

Laptops

Personal laptops are the hardest case, because a full management agent reaches the whole machine. Many teams limit personal laptops to browser-based access with strong sign-in, or provide a virtual desktop, and keep agent-based management for company laptops.

Compliance checks and offboarding

Whatever the platform, two controls matter most: a compliance check that flags or blocks a device that falls below the baseline, and a removal step that runs as part of every exit. Tie both to your HR leaver process so nobody has to remember.

See how work profiles, compliance checks and device records come together in one MDM console.

Explore Infronest MDM

Template

BYOD policy template

Adapt the wording below. Replace anything in square brackets, keep the clause order, and have HR and legal review the final text before anyone signs it.

1. Purpose and scope: This policy applies to [all employees and contractors] who use a personally owned phone, tablet or laptop to access [Company] email, chat, files or applications.
2. Eligible devices: Devices must run an operating system version that still receives security updates from its manufacturer. Rooted or jailbroken devices are not permitted.
3. Enrolment: Phones and tablets must be enrolled through [MDM tool] into a work profile or equivalent managed space before any work app is installed.
4. Security requirements: A screen lock of at least [six digits or biometric], device encryption switched on, and operating system updates installed within [14] days of release.
5. Acceptable use: Company data stays inside approved work apps. Do not copy it to personal apps, personal cloud storage or personal email.
6. Privacy: [Company] can see the device model, OS version, compliance status and work apps. [Company] will not access personal apps, photos, messages, browsing history or location.
7. Lost or stolen devices: Report a lost or stolen device to [IT contact] within [24 hours]. IT will remove work data remotely; personal data is not touched.
8. Leaving the company: On your last working day, IT removes the work profile and company accounts. You keep the device and your personal data.
9. Support and costs: IT supports work apps and access only. [Stipend or reimbursement terms, if any.]
10. Acknowledgement: I have read this policy and agree to its terms. [Name, date, signature.] This policy is reviewed every [12] months.

Pitfalls

BYOD policy mistakes to avoid

Most BYOD failures trace back to a handful of avoidable decisions.

Copying a template and enforcing nothing: an unenforced policy is a liability, not a control
Wiping the whole phone: on a personal device, remove the work profile, never the entire device
Vague privacy wording: 'IT may monitor devices' drives people away; list what is and is not visible
One rule for every role: finance and engineering need stricter terms than staff who only read email
Forgetting contractors: their phones hold the same data and they leave sooner
Never reviewing it: management options change with major OS releases

Infronest

Conclusion

A BYOD policy is easiest to enforce when personal phones, company phones and laptops sit in the same console, so one baseline and one leaver process cover all of them. Infronest's MDM covers Android (work profile and fully managed), iPhone and iPad through native Apple MDM, and Windows, macOS and Linux, on the same device record as the rest of your IT operations.

MDM Enterprise is ₹850 per endpoint per month, with a minimum of 50 endpoints.

See work-profile enrolment and compliance checks on a live Android device, and ask how the policy above maps to your own fleet.

Book a live MDM demo

Sources

The guidance and legal references above draw on these primary sources.

Frequently Asked Questions

What is a BYOD policy?: A BYOD policy is the set of rules for using personally owned phones, tablets and laptops for work. It covers eligible devices, minimum security settings, how work and personal data are separated, what the company can see, and how work data is removed when someone leaves.
What should be included in a BYOD policy?: At minimum: scope and eligible devices, a security baseline, separation of work and personal data, a plain privacy statement, acceptable use, lost-device reporting, offboarding, support and costs, data protection duties, and a signed acknowledgement with a review date. The template in this article covers all ten.
How do you create a BYOD security policy?: Start with the data and decide which systems personal devices may reach. Pick an ownership model for each role, write the clauses, choose the MDM enrolment method that enforces them, then train staff and collect acknowledgements. The NCSC's BYOD guidance follows a similar order: set objectives, write the policy, estimate costs, choose a deployment approach and put technical controls in place.
What is the difference between BYOD and COPE?: With BYOD the employee owns the device and the company manages only a work space on it. With COPE (corporate-owned, personally enabled) the company owns and manages the device but allows a separate personal space. COPE gives IT more control; BYOD gives the employee more privacy.
What happens to work data when an employee leaves?: Under a good BYOD policy, IT removes the work profile or managed accounts and revokes access on the last working day. Work apps and data are deleted; personal apps, photos and messages stay on the device.
Does India's DPDP Act apply to BYOD devices?: Once its main obligations take effect (13 May 2027), it applies to the personal data on them. From then, section 8(5) of the Digital Personal Data Protection Act, 2023 requires reasonable security safeguards for personal data in a company's possession or under its control, which can include work data on employees' own phones, and the Act's schedule allows penalties of up to ₹250 crore for failing that duty. Ask your legal team how it applies to your setup.
Do you need MDM for BYOD?: For anything beyond email on a few phones, yes. Without MDM there is no way to check the security baseline, separate work data or remove it when someone leaves. On Android and Apple devices, an MDM is also what creates the separate work space in the first place.

About the Author