Bring your own device to work! That’s roughly how you could translate “Bring Your Own Device” (BYOD). It refers to the use of personal devices and software for work purposes. Since the pandemic, BYOD has become a “quick-and-dirty” solution for many organizations—and continues to pose major challenges for IT and data protection departments to this day.
Read about how companies and government agencies are implementing a sustainable and secure BYOD model.
Key Points at a Glance:
- The use of personal devices for work purposes is rarely clearly regulated—either legally or organizationally.
- There are six challenges to address: data security, compliance, costs, IT support, legal issues, and work-life balance.
- Container technology separates personal and work data on the same device—just as required by the GDPR.
- Participation in BYOD must remain voluntary; management and the employee council must be involved from the very beginning.
- Conclusion: Allow BYOD instead of banning it—with the right solution.
BYOD: Generally Unregulated
The professional use of personal devices is rarely clearly regulated. Legally, too, the issue has remained a gray area until now. The pandemic has created a new reality: IT procurement was temporarily “outsourced” to employees—and data security fell by the wayside. A study by TÜV Süd of 501 companies (February 2021) shows:
- 39 percent work from home using a secure VPN connection.
- 19 percent of employees use personal devices or connect without secure VPN access.
- 9 percent rely entirely on unsecured BYOD models.
- The remaining 33 percent prohibit BYOD across the board.
Organizations that ban BYOD stifle employee engagement. Smart organizations use BYOD as a tool to ensure they can act at any time—and address the challenges that arise as a result.
The Six Biggest BYOD Challenges—and Their Solutions
1. Data Security: Using Tools with “Privacy by Design”
Data breaches and cyberattacks are a burden on companies, government agencies, and, in particular, operators of critical infrastructure. Many take robust security measures for their office devices but neglect security when working from home or in the field.
Under the GDPR, employers are required to implement technical and organizational measures (TOMs). Violations of Article 32 of the GDPR can result in fines of up to 10 million euros or 2 percent of annual revenue—even if the TOMs cannot be demonstrated.
Recommendation: Opt for solutions that incorporate “Privacy by Design” and “Privacy by Default,” where data protection is built in from the development stage. The BSI continuously reviews and recommends solutions from German manufacturers for secure mobile work.
2. Compliance: Isolating Data Using Container Technology
BYOD boosts productivity and satisfaction—but it creates a conflict between compliance requirements and user needs. BYOD devices contain personal data, such as family photos, which are also at risk in the event of cyberattacks. Furthermore, administrators could theoretically use Mobile Device Management (MDM) to access private data or track users’ movements—a “Big Brother” scenario that is increasingly concerning works council members.
Solution: Container technology separates personal and work data on the same device. Emails, phone calls, messaging apps, and documents are stored in an encrypted area. Internal information cannot be copied and pasted onto social media, and in the event of loss or theft, IT can only access work-related data. Personal data stays private. Data is transmitted in encrypted form via a gateway—without the need for a VPN.
3. Costs: Save on hardware, manage usage
BYOD is easy on the budget because fewer company devices need to be purchased. However, it isn’t free: Employees are entitled to reimbursement for certain costs, such as their cell phone plan.
Solution: Establish a financial plan and written agreements before implementation. The financial control and tax advisory departments should verify whether the assumption of costs results in monetary benefits that are subject to taxation.
4. IT Support: Implementing Device-Independent Solutions
The proliferation of personal devices runs counter to the IT sector’s need for standardization. But banning BYOD automatically creates shadow IT.
Solution: All-in-one solutions using container technology and self-service: Employees download the app from the App Store or Google Play—no MDM profile is required. Administrators set security rules through a management portal. Important: The solution must work on both iOS and Android.
5. Legal Considerations: Having a Contract Drafted
What happens if a personal device is stolen? How do you ensure compliance with copyright laws and data retention requirements? Make your BYOD policy “watertight” with a set of contracts. The IT department, HR department, works council or employee representative committee, legal department, and data protection officer should all be involved. The contractual framework includes technical documentation with an approval form, a company agreement, and an individual user agreement with a declaration of consent.
Read all the details in the white paper:
Ensuring the Legal Compliance of BYOD Models
Start with a legally sound foundation:
Download a Free Sample BYOD User Agreement Template
6. Work-Life Balance: Collaboration with and Protection of Employees
BYOD offers employees many benefits: just one device, higher productivity, less training required, and greater satisfaction. In the 2021 “Government and Public Administration” Future Panel, 55 percent cited greater user-friendliness, 44 percent cited cost savings, and 43 percent cited greater satisfaction as benefits. At the same time, employees and staff councils want to know how their time off will be protected despite the need to remain reachable.
Solution: Communicate your BYOD policy to employees and their representatives early on. Technical solutions such as SecurePIM help ensure compliance with work hours—for example, by automatically logging users out at the end of their shift or turning off email notifications after work.
Conclusion: Allow BYOD instead of banning it
The easiest and most secure way to implement BYOD is with a proven communication solution that is approved and recommended by the BSI: SecurePIM from Materna Virtual Solution. SecurePIM isolates emails, intranet access, and more on iOS and Android devices within an encrypted container—accessible via password, PIN, fingerprint, or facial recognition.
One SecurePIM, and four worries gone
- Avoid fines and damage to your reputation: out-of-the-box GDPR-compliant, even on personal devices.
- Save on hardware costs: SecurePIM supports both BYOD and COPE models.
- Comprehensive confidentiality protection up to the VS-NfD classification level, with certifications such as TISAX® and compliance with the German Confidentiality Protection Act.
- Maximum user convenience: quick setup, minimal training and administrative effort.
When does an MDM still make sense?
If your IT department needs to distribute in-house apps, monitor app installations, or locate devices via GPS. An existing MDM solution also supports SecurePIM.
Frequently Asked Questions
What does BYOD mean?
“Bring Your Own Device” refers to the use of personal smartphones, tablets, and software for professional or work-related purposes.
Is BYOD possible in a way that complies with the GDPR?
Yes, provided that personal and work-related data are technically separated and encrypted—for example, using a container solution—and the necessary agreements are in place.
Who bears the costs under BYOD?
Employers address this in the terms of use agreement. Cost reimbursements should be reviewed for tax purposes to determine whether they constitute non-cash benefits.
Can employers require employees to bring their own devices (BYOD)? No, participation must remain voluntary. Employers must provide any work equipment that is absolutely necessary.
More white papers:
Legal protection for BYOD models
Container technology
Webinar:
Secure mobile working: BYOD & COPE for public authorities
Find all the details in the full white paper:
Download the full PDF version of the BYOD white paper for free.
We would be happy to advise you on how to implement our solution.