Bring your own device (BYOD)

For this to work, three things are needed: a technical separation of private and business data, clear security requirements and an arrangement that is clean in terms of employment and data protection law.

BYOD, COPE, CYOD and COBO: the device models compared

BYOD is one of several models for how companies provide mobile devices. The abbreviations mainly describe two questions: who owns the device, and may it be used privately? From these two answers follows how far IT may manage the device and who bears the costs.

The table shows the core difference: with BYOD, the device does not belong to the company. It follows that the employer can and may only manage a clearly delimited part of it. With COPE and COBO, on the other hand, ownership allows complete management via mobile device management (MDM).

Technical separation: how private and business data stay separate

The central technical question with BYOD is: how does the company gain control over its data without intruding on employees' privacy? The major platforms offer their own procedures for this, which can be controlled during set-up via an enterprise mobility management system (EMM or UEM).

Android Enterprise: the work profile

For private devices, Android Enterprise provides the work profile. Google describes it as a way of separating business apps and data from personal apps and data. The organisation only manages the business area; personal apps and data remain private.

According to the Android developer documentation, the two profiles have separate storage areas, and most data transfers between the profiles are blocked by default. IT specifies which apps are allowed in the work profile. If the work profile is removed, Android deletes the data within this profile. A factory reset, which would also destroy private photos and messages, is not necessary in this case.

Apple User Enrollment

For iPhones and iPads owned by users, Apple offers User Enrollment, today in the account-driven variant. Apple explicitly describes it as a procedure for BYOD in which only a limited set of settings and restrictions can be managed. IT manages the organisation's accounts, settings and data, but not the personal Apple Account. Users can see what is being managed.

In practice this means: the company can distribute and remove managed apps and set rules, for example that documents from managed apps may not be transferred to private apps. The management cannot query apps that users have installed themselves from the App Store.

Containerisation and mobile application management (MAM)

A third variant works entirely without registering the device. With mobile application management, the individual app protects its data itself: its own login, encrypted storage, blocked copying into private apps and remote deletion of only the app data. A well-known example is the Microsoft Intune app protection policies for Outlook or Teams.

For BYOD, MAM is often the most privacy-friendly solution, because the company gets no access to the device itself at all. A login via single sign-on (SSO) with multi-factor authentication complements the app protection.

Security: what the BSI specifies for BYOD

The German Federal Office for Information Security (BSI) deals with BYOD in the IT-Grundschutz module SYS.3.2.1 "General smartphones and tablets" (2023 edition). This edition is the current one of the IT-Grundschutz Compendium. In parallel, the BSI has been piloting the successor Grundschutz++ since 2026, but according to consulting practice the classic IT-Grundschutz remains valid until the end of 2028.

In its threats section, the module explicitly names the risks typical of BYOD: legal problems with software licences, effects on private data if the MDM deletes business data in an emergency, the lack of a way to check every private device for suitability, access to company data during repairs and unregulated data when employees leave.

Of the module's requirements, these are particularly relevant for BYOD:

• SYS.3.2.1.A1 (basic): before use, a policy must specify who may access which of the institution's information with smartphones.
• SYS.3.2.1.A2 (basic): a strategy for cloud use must specify whether and how cloud services are permitted with private use.
• SYS.3.2.1.A10 (standard): a binding policy for employees should regulate use, maintenance and loss reporting and prohibit rooting as well as uninstalling the management software.
• SYS.3.2.1.A11 (standard): the device storage should be encrypted.
• SYS.3.2.1.A25 and A26 (increased protection requirements): separate working environments and encapsulated containers with their own authentication and encryption.

In practice this means: without a written policy and without technical separation, BYOD is not implemented cleanly by IT-Grundschutz standards. It is also worth looking at the principle of least privilege: a private device should only access the data that is really needed for the respective task.

Employment law, co-determination and data protection

The following points give an overview of the legal situation in Germany as it is predominantly presented in the employment law literature. They do not replace legal advice. For a specific policy or works agreement, you should involve advice on employment and data protection law.

No obligation to use a private device

In principle, the employer has to provide the work equipment needed for the work owed. According to the prevailing opinion, it cannot unilaterally oblige employees by instruction to use their private smartphone for work or to install a specific app on it. The business use of private devices is therefore generally based on a voluntary agreement. Anyone who does not take part must not suffer any disadvantage as a result, and an equivalent alternative is needed.

Working time and availability

A work phone in a private pocket blurs the line between work and leisure. Reading and answering business messages can be working time. According to § 5 of the German Working Hours Act (ArbZG), employees are entitled to an uninterrupted rest period of at least eleven hours after the end of their daily working time. Whether even briefly reading a message interrupts this rest period is disputed in the literature and has not been conclusively clarified by the highest courts.

Since the decision of the Federal Labour Court of 13 September 2022 (1 ABR 22/21), it has also been recognised that employers must record working time systematically. For BYOD, a clear rule is therefore advisable: no expectation of availability outside working hours, and technical aids such as work profiles that can be paused or time-controlled push notifications.

Co-determination of the works council

If there is a works council, it generally has to be involved. According to § 87(1) no. 6 BetrVG, it has a right of co-determination in the introduction and use of technical devices intended to monitor the conduct or performance of employees. The Federal Labour Court interprets this broadly: it is sufficient that a device is objectively suitable for monitoring. MDM software and employee apps with logs typically meet this criterion. Depending on the design, no. 1 (rules of conduct) and no. 2 (working time) may also apply.

Data protection: the employer remains responsible

Even if the device is private, the company remains the controller within the meaning of the GDPR for the business personal data on it. Under Art. 32 GDPR it must take appropriate technical and organisational measures, such as encryption, access protection and a way of deleting company data. At the same time, it may not access employees' private data. That is exactly why the work profile, User Enrollment or MAM are the obvious tools from a data protection point of view. More on the basics can be found under data protection.

Reimbursement of costs

If someone uses their private device in the employer's interest, a claim for reimbursement of expenses by analogous application of § 670 BGB may come into consideration according to a widespread view. This concerns a proportion of the costs of the device and data tariff and, under certain circumstances, also damage that arises during business use. In practice, many companies regulate this with a monthly flat rate. Whether, and to what extent, it can be tax-free should be checked by a tax adviser.

Checklist for a BYOD policy

A BYOD policy, usually a works agreement in establishments with a works council, should regulate at least these points:

1. Scope and voluntariness: who may take part, and what is the alternative for those who do not?
2. Approved devices and operating systems: minimum versions, no rooted or jailbroken devices, obligation to install security updates.
3. Technical separation: work profile, User Enrollment or MAM, and which data IT can see and which it cannot.
4. Access rights: which systems and data can be reached, graded by role, for example via role-based access control.
5. Authentication: screen lock, multi-factor login, handling of biometrics.
6. Loss and theft: reporting channel, deadline and the assurance that only business data will be deleted.
7. Availability and working time: no obligation to respond outside working hours, rules for notifications.
8. Costs and liability: flat rate or individual reimbursement, handling of damage and repairs.
9. Leaving the company: removal of the work profile or app data on the last working day.
10. Control and logs: which logs are created, who may evaluate them and when they are deleted.

BYOD and employee apps: voluntary use, offer alternatives

BYOD becomes particularly relevant with employee apps for staff without a fixed office workplace, for example in production, care, retail or logistics. These groups often have no work device but are supposed to reach shift schedules, news or forms. Which functions and costs are typical here is shown in our article employee app: use cases, features and costs.

Because, according to the prevailing opinion, an obligation to install an app on a private phone cannot be enforced, the app should be designed for voluntary use from the outset. Equivalent alternatives are, for example, a shared terminal in the break room, loan devices or a work device for key roles. A progressive web app can also help, because it runs in the browser and does not force an installation on the private device.

In development itself, privacy-friendly design pays off: minimal permissions, no access to contacts or location without a clear purpose, in-app encryption, remote deletion of only the app data and a quiet time function for push notifications.

Frequently asked questions about bring your own device (BYOD)

May my employer demand that I install an app on my private phone?

According to the prevailing opinion in the employment law literature, not unilaterally. In principle, the employer has to provide the work equipment. The use of the private device is generally based on a voluntary agreement. The situation may be different in individual cases, which is why this assessment does not replace legal advice.

Can the company see or delete my private data with BYOD?

With a cleanly implemented Android work profile, Apple User Enrollment or app protection via MAM, the company only manages the business area. On removal, only business data is deleted. Complete device management with a factory reset is not appropriate for BYOD and should be ruled out in the policy.

Who pays for the device and the data tariff?

Ideally, the BYOD policy regulates this. Without a rule, reimbursement of expenses by analogous application of § 670 BGB may come into consideration. Many companies pay a monthly flat rate that covers costs for the device, data volume and wear and tear.

Does BYOD need the approval of the works council?

If there is a works council, generally yes. Device management software and many employee apps are technical devices that are suitable for monitoring and therefore fall under § 87(1) no. 6 BetrVG. A works agreement is customary.