Legal protection for BYOD models

“Bring Your Own Device,” or BYOD for short, refers to the use of personal devices and software for professional or work-related purposes. BYOD offers many advantages for employees and employers—but it also automatically raises legal questions.

Here you’ll learn what companies and government agencies need to know to ensure their BYOD model is legally sound.

Key Points at a Glance

• Even under a BYOD policy, employers remain responsible under data protection laws and must implement and document technical and organizational measures (TOMs).
• Regulatory authorities require that business data be stored in an encrypted, separate location and that it be possible to delete it remotely.
• In addition to the GDPR, this also affects confidentiality, copyright, retention requirements, and labor law.
• The works council or staff council, the data protection officer, and four other positions should be involved in the project from the very beginning.
• The following are required: technical documentation, a company policy, and an individual user agreement.

Implementing BYOD—These Legal Areas Are Affected

GDPR: What You Need to Know About Data Protection

Anyone who handles emails and documents is always processing personal data—that is, any information relating to an identified or identifiable individual (Art. 4(1) of the GDPR).

Employers’ Responsibilities: Companies and government agencies are “data controllers” within the meaning of Article 4(7) of the GDPR—even when employees process data on personal devices. Under Article 32 of the GDPR, they must implement adequate technical and organizational measures (TOMs). Specifically, this means that data on employees’ devices must be as secure as it is on the employer’s own IT infrastructure, for example through state-of-the-art encryption.

Data protection “by design and by default”: Regulatory authorities expect that, in BYOD scenarios, company data is stored separately in an encrypted area, personal and work-related data are strictly separated, and work-related data can be deleted remotely. Article 25 of the GDPR also requires privacy-friendly technology and default settings.

Fines: Violations of Art. 32 of the GDPR, fines of up to 10 million euros or 2 percent of global annual revenue may be imposed; for violations of the principles of processing, fines of up to 20 million euros or 4 percent may be imposed (Art. 83(4) and (5) of the GDPR). Due to the accountability requirement (Article 5(2) of the GDPR), it is sufficient for the TOMs not to be documented. Conversely, well-documented TOMs that go beyond what is customary have a positive effect on the calculation of a fine (Art. 83(2)(d) GDPR).

Protection of Trade Secrets: Safeguarding Corporate Assets

Mobile devices are easily lost or stolen. According to Section 2(1) of the Trade Secrets Act, trade secrets are protected only if appropriate confidentiality measures are in place—such as encrypted documents, access only with authentication, and end-to-end-encrypted emails. A data breach that is knowingly accepted may result in the complete loss of trade secret protection (Higher Regional Court of Stuttgart, Nov. 19, 2020, Case No. 2 U 575/19). With secure communication apps, business data stored in an encrypted container can be quickly “remotely” deleted in the event of loss or departure—while private apps and data remain intact.

Copyright: When Employers Are Liable Through No Fault of Their Own

Under Section 99 of the German Copyright Act (UrhG), the company is liable regardless of fault if employees infringe a copyright—for example, by using privately licensed software for work purposes. In addition, the management or board of directors may be personally liable (Section 43 of the German Limited Liability Companies Act (GmbHG) or Sections 91(2) and 93 of the German Stock Corporation Act (AktG)) if no appropriate safeguards have been put in place.

Retention Requirements for Business Communications

The record-keeping requirements under Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO), and the GoBD also apply to BYOD. Business communications must therefore be conducted through a work email account and stored centrally.

Solution: Data separation, encryption, remote data deletion, prevention of copy-and-paste, and centralized storage can be implemented using a specialized app. Container technology separates personal data from work-related data, and a dedicated authentication system—independent of the device password—protects against unauthorized access by third parties.

Clearly Establish Rules for BYOD Use with Employees

There are neither specific laws nor detailed case law regarding BYOD. Other issues must therefore be addressed through agreements with employees and, if necessary, a company policy.

• Data Security: Employees agree to keep their operating system and antivirus software up to date, not to jailbreak or root their devices, not to share their devices with others, and to back up their own private data. Provisions must also be made for the (temporary) handover of the device and the termination of participation.
• Reporting Requirements: In the event of loss or theft, employees must report it immediately so that remote data deletion can be performed. This is the only way the company can fulfill its reporting obligation under Article 33 of the GDPR—promptly, preferably within 72 hours, for every personal data breach.
• Notification of Data Subjects: In cases of high risk, the data subjects must also be notified (Art. 34 GDPR)—unless, for example, the data was encrypted (Art. 34(3)(a) GDPR). If data is encrypted using SecurePIM, for example, high costs and reputational damage can be avoided.

Have you really thought of everything?

Since the device remains the property of the employees, this raises further questions:

• Contract Law: Who Is Responsible for Maintenance and Repairs? Does the cell phone contract allow for business use?
• Tax Law: How are employees compensated, and does this constitute a taxable benefit in kind?
• Liability Law: In the event of loss or damage while on the job, an employee may be entitled to compensation from the employer in accordance with § 670 of the German Civil Code (BGB). It is advisable to have equipment insurance.

Contracts Without the Hassle: Take advantage of our free templates— the BYOD User Agreement and the COPE User Agreement.

Keeping an Eye on Labor Law

If employees are constantly reachable via their personal devices, agreed-upon working hours and rest periods must be observed in accordance with the Working Hours Act. A distinction must be made between whether employees work outside core working hours voluntarily or on instruction. Clear regulations are needed for this.

Recommendation: Involve employee representatives. A works council or staff council must be informed as early as the planning stage (Section 90(1) of the Works Constitution Act (BetrVG)). It has no authority over personal devices, but it does have authority over order and conduct in the workplace, working hours, and technical equipment used to monitor behavior or performance (Section 87(1)(1), (2), and (6) of the Works Constitution Act (BetrVG)).

Special Case: Mobile Device Management (MDM): If a company uses MDM in addition to a container solution, this creates extensive access capabilities. Employees must give their separate consent for this; otherwise, the company risks criminal liability under, for example, Sections 202a–c and 303a of the German Criminal Code (StGB). This also affects the right to informational self-determination and the confidentiality of telecommunications. Because employees can quickly feel as though they are being “monitored,” a solution without MDM is usually preferable.

Quick Check 1: You Should Involve These Departments

• IT Department: technical details, installation, or self-service; plan for increased effort due to a mix of devices
• IT Security Officer: Overseeing the IT Security Process
• Human Resources Department: Have agreements signed and file them in the personnel file
• Works Council and Staff Council: From the Very Beginning (Section 87(1)(1), (2), (6) of the Works Constitution Act (BetrVG))
• Legal Department: Draft the agreement and, if necessary, negotiate it with the committee
• Data Protection Officer: Provide timely notification regarding implementation and the contract

Quick Check 2: These documents are part of the contract package

• Technical documentation with an approval form: approved devices, minimum hardware and operating system requirements, permitted apps, installation procedure, approval, and technical operating procedures (TOMs) such as password policies, encryption, data segregation, patch management, and antivirus protection
• Company Agreement: Uniform Rules for the Use of Personal Devices When a Works Council or Employee Representative Committee Exists
• Terms of Use and Consent Form: Individual Participation Agreement, Acknowledgment of the Rules, and Consent to Data Processing (Art. 7 GDPR), as well as rules regarding device use, reimbursement of costs, and disclosure obligations

Conclusion: Should BYOD be allowed or banned?

Benefits of BYOD: just one device, happier employees, increased productivity and accessibility, less need for training, stronger identification with the employer, and lower acquisition costs.

Challenges: Managing a variety of devices (it is advisable to limit the selection to specific manufacturers), ensuring legal compliance through operating and usage agreements, and concerns about access to private data when an MDM solution is in use.

Voluntary Participation: No one may be required to participate, as employers are obligated to provide the necessary work equipment (Hesse Regional Labor Court, March 12, 2021, Case No. 14 Sa 306/20).

With the right app and the agreements described above, you can reap the benefits and minimize the risks. However, you should avoid using personal devices without a formal BYOD policy in place.

Recommended Solution: SecurePIM

With SecurePIM, employees can securely access emails, contacts, calendars, messaging apps, line-of-business applications, and documents on their own devices—on both iOS and Android—in compliance with the GDPR. SecurePIM is BYOD-ready:

• Strict separation of personal and work-related data within the app’s isolated section
• Encrypted storage on the device and encrypted email transmission
• Encrypted transmission from the server to the device—without a VPN
• Remote Deletion for Employers

Frequently Asked Questions

Who is responsible for data protection in the context of BYOD?
The employer or authority remains the data controller within the meaning of the GDPR – even on private devices.

Does the works council have to approve BYOD?
He should be involved early on and has a say in matters including working hours and technical monitoring equipment.

What contracts do I need for BYOD?
Technical documentation with an approval form, a workplace agreement, and an individual user agreement with a consent form.

Who is liable if a personal device is damaged? In the event of damage occurring during work-related use, a claim for reimbursement against the employer may be considered in accordance with § 670 of the German Civil Code (BGB).

Note: This brief overview is intended to provide a general understanding; it is not intended to be exhaustive and is not a substitute for legal advice in specific cases.

More white papers:
Implementing BYOD Models Simply and Securely

Container technology