BYOD policy template for SMEs

Bring-Your-Own-Device sounds like a cost saving until your first breach. The personal device of a single employee can drag your entire organisation into GDPR Article 33 notification, NIS2 incident reporting, and supplier-contract breaches with B2B customers — without you having any technical control of the affected device. A defensible BYOD policy is the only thing standing between you and that scenario.

• GDPR Article 32 demands appropriate technical measures regardless of device ownership
• NIS2 Article 21(2)(i) requires HR security and asset management — BYOD complicates both
• Most cyber-insurance policies exclude BYOD breaches without a written policy
• Spanish, French, German labour law restricts what controls you can impose on personal devices

Our template, refined across 40+ SME deployments, contains seven clauses that survive both DPA scrutiny and labour-tribunal challenges.

• Eligibility — which roles can use BYOD, approval workflow, exclusions
• Permitted devices and minimum security baseline (OS version, encryption, screen lock)
• Mandatory MDM/MAM enrolment with clear data separation (work container vs personal)
• Acceptable apps and data classification (what work data is allowed on BYOD at all)
• Loss/theft procedure with immediate remote wipe authority for the work container
• Off-boarding — wipe of work container, employee verification, evidence record
• Cost reimbursement, support boundaries, and data subject rights for the personal device

Full Mobile Device Management (MDM) wipes the entire device on revocation — including the employee's personal photos. EU labour tribunals have repeatedly ruled this disproportionate. Mobile Application Management (MAM) using a work container (Microsoft Intune App Protection, Workspace ONE) targets only work data and is now the legally defensible standard.

• Microsoft Intune App Protection Policies — protects M365 apps without device enrolment
• Selective wipe affects only the work container
• Conditional Access enforces compliance without device control
• Documented in your DPIA as the proportionate measure

In our SME audit reviews these are the top BYOD policy failures — each is a finding in any ISO 27001 or NIS2 audit.

• Policy exists but no MAM enforcement (paper compliance only)
• No off-boarding evidence (when employee leaves, no record of work container wipe)
• Personal devices accessing work email without conditional access
• No documented exception process — informal exceptions everywhere
• No periodic review — policy hasn't changed since 2019

Our template is a DOCX with the seven clauses, an MAM enrolment workflow diagram, an Intune App Protection Policy JSON export ready to import, and an off-boarding evidence form. Deployed in 40+ SME tenants without DPA findings.

• Format: DOCX policy + JSON Intune export + PDF workflow diagram
• Pre-aligned with ES/FR/NL/DE labour-law constraints
• Includes the proportionality justification block for your DPIA
• Free download — no account required