Guide

BYOD & Remote Work Policy Guide

How to write a BYOD and remote work policy for a small business: device rules, access, lost-device steps, and protecting data you do not own.

By SecureBusinessHub Editorial, International cybersecurity desk · 2026-07-24 · 9 min read

A BYOD and remote work policy is the written rule for work that happens outside the office and on devices your company may not own. BYOD stands for "bring your own device": the phones, laptops, and tablets that staff use for work but that belong to them personally. Add remote and hybrid working and you have a problem that is simple to state and hard to manage: company and customer data now lives on hardware and networks you do not fully control. This policy is how a small business sets clear, enforceable ground rules for that situation, so that flexible working does not turn into your biggest security gap.

This guide covers what a BYOD and remote work policy should contain (device requirements, network expectations, access rules, and what happens when someone leaves or loses a device) and how to write it so that it protects company data without micromanaging people's personal property. It is one of the four foundation documents in our small business security policy guide, and it pairs with your data retention policy, which governs how long the data on all those devices should exist in the first place.

Why work outside the office needs its own policy

In an office, a lot of security happens without anyone noticing: a managed network, company-owned machines, a locked door. Once work moves to a kitchen table, a coffee shop, or a personal phone, those defaults disappear. Company data gets accessed over home wifi you did not configure, saved onto a laptop shared with family, and carried around on a phone that might be lost on a train. Nobody is being reckless here, and this is ordinary modern work, but the assumptions your other security controls relied on no longer hold. A written policy puts back the ground rules the office used to provide for free.

BYOD is harder than company-owned equipment for one specific reason: you do not own the device, so you cannot do whatever you like to it. You cannot wipe someone's personal phone on a whim, inspect their private photos, or dictate what apps they install for their own life. A good policy writes down a balance between the security requirements the business needs and the personal ownership it has to respect. Get that balance right and staff will enrol their devices instead of working around the rules.

What the policy should cover

A BYOD and remote work policy covers the security of the device, the security of the connection, the rules for accessing and storing company data, and the process for joining and leaving. It should also make clear which of these apply to company-owned equipment used remotely and which apply to personal devices, since the two carry different rights and expectations. Keep it practical: a set of rules a non-technical person can follow.

Device requirements: the baseline any device must meet before it touches company data.
Network and connection rules: how staff connect safely from home, while travelling, and in public spaces.
Data access and storage: where company data may live on a device and where it may not.
Personal device boundaries: what the company will and will not do to a device it does not own.
Joining and leaving: how a device is approved for work, and how company access and data are removed when someone departs or loses it.

Device and access rules

Set a clear baseline that every device must meet, personal or company-owned, before it is used for work. A sensible minimum is a device that locks with a strong passcode or biometrics, encrypts its storage, receives current security updates, and runs supported software rather than an operating system the maker abandoned years ago. Require that company accounts on the device are protected with the multi-factor authentication your account-security rules already mandate, and that work data is accessed through managed apps or accounts rather than copied into personal ones. Where the risk justifies it, require a mobile-device-management or endpoint tool that can enforce these settings and remove company data if needed.

Cover the connection as well as the device. Staff should avoid doing sensitive work over untrusted public wifi without protection, keep their home routers updated and password-protected, and use whatever secure access method your business provides for reaching internal systems. This policy sets the rules. For the practical side of working securely away from the office, meaning the habits, tools, and configurations that make it work day to day, point your team to our companion guide on securing a remote team.

Offboarding, lost devices, and privacy

The riskiest moments for BYOD are the transitions: someone leaves the company, or a device goes missing. Your policy must state clearly what happens in each case. When a person departs, their access to company systems is revoked the same day and any company data on their personal device is removed, ideally through a selective wipe that clears work data and leaves personal content untouched. That is why the enrolment and tooling decisions earlier in the policy matter. When a device is lost or stolen, staff must report it immediately, so accounts can be secured and, if necessary, company data wiped remotely before anyone accesses it.

Be explicit and honest about privacy, because trust is what makes a BYOD policy work. State what the company can and cannot see or do on a personal device: that it will remove company data but not access personal files, that any monitoring is limited to work accounts, and that a wipe is selective wherever the technology allows. People enrol their own devices willingly when they understand the boundaries and believe them. A policy that reserves sweeping rights over personal property, or stays vague about them, pushes staff to keep company data on unmanaged devices instead.

Adopting and enforcing the policy

Because this policy asks something of people's personal property, adoption deserves a proper conversation rather than a silent signature. Explain why each requirement exists and what the company will and will not do to their device, then have staff acknowledge the policy and, where you use device management, enrol their equipment as part of the process. Fold it into onboarding so new hires meet the rules before they start working remotely, and revisit it whenever your tools or working patterns change. Enforcement leans heavily on the technical controls: much of this policy can be applied through device settings and access rules, so it does not depend on goodwill alone.

Company-owned versus personal devices

One distinction shapes the whole policy: whether the device belongs to the company or to the person using it. On company-owned equipment you have broad rights, because it is your property: you can require specific software, enforce settings, monitor within reason, and wipe the whole device when someone leaves. On a personal device, you have only the rights the employee agrees to grant, and those rights should be limited to what protects company data and nothing more. Draw that line clearly in the policy, because a blurred one invites disputes.

A practical approach is to write the policy in two tiers. Set a common baseline that applies to any device touching company data (a lock, encryption, current updates, MFA on company accounts), then add the extra requirements and rights that apply only to company-owned equipment. For personal devices, state plainly that the company's reach is confined to company data and accounts: it may enforce those baseline protections and remove its own data, but it will not access personal content or wipe personal files. Some businesses decide the simplest answer for sensitive roles is to issue company-owned devices and keep personal ones out of scope entirely; that is a legitimate choice, and your policy can say so.

Consider a common scenario. An employee using their personal laptop leaves the company on short notice, and it emerges that months of client files were saved to the laptop's desktop rather than kept in company systems. If the device was enrolled and company data was contained in a managed space, offboarding is a clean, selective removal of that data. If it was never enrolled and data was allowed to sprawl across personal folders, you are left negotiating with a former employee for the return or deletion of files you cannot see or control. This is the ordinary result of not having the policy, and it is what the enrolment, containment, and offboarding clauses are there to prevent.

Networks, travel, and home working

Where people work is as much a part of this policy as what they work on. Home wifi, hotel networks, and café connections carry different risks from a managed office network, and a few plain rules cover most of the exposure. Ask staff to keep their home routers current and password-protected, since an unpatched router with its factory password is a real weak point, and to treat public wifi as untrusted, using the secure access method your business provides rather than logging into sensitive systems over an open network. A short set of habits that shrink the obvious risks covers it, with a pointer to fuller guidance for those who want it.

Travel adds a physical dimension the policy should name. Devices are lost and stolen far more often on the move: left in taxis, lifted from bags, forgotten in lounges. That is why the earlier requirements for a strong lock and full-disk encryption matter, because they turn a lost device from a data breach into an inconvenience and an insurance claim. Add a couple of travel-specific expectations: keep devices physically with you or locked away rather than left unattended, be wary of shoulder-surfing when working on sensitive material in public, and report any loss immediately so accounts can be secured. These rules are small and easy to remember, and they cover a device once it leaves the desk.

Where the BYOD and remote work policy fits

This policy is one of the four foundations in our small business security policy guide, works alongside your data retention policy to control where company data lives and for how long, and is complemented by the practical advice in our guide to securing a remote team. If you would rather adapt a ready-made document than draft one from scratch, our editable policy template pack includes a remote work and BYOD policy written for small businesses, ready for you to tailor to the devices, tools, and working patterns your team uses.

NIS2 requirements: the second regime to know about

Data protection law is not the only European regime a business gets asked about. The NIS2 directive sets baseline cybersecurity and incident-reporting obligations for organisations in a defined list of sectors, and it is the source of most of the security questions that now arrive attached to contracts. The two regimes cover different ground: data protection law governs personal data and what people can ask you to do with it, while the NIS2 requirements govern the security and resilience of network and information systems, whether or not personal data is involved. A single incident can engage both, on separate clocks, to separate authorities.

The directive applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet above ten million euros. Under that size rule, a ten-person company is usually not regulated by the directive at all. The requirements can still reach you, because one of them is supply chain security: organisations inside scope are expected to consider the security practices of their direct suppliers, and in practice that expectation arrives as a questionnaire in your inbox.

The measures the directive names are a reasonable checklist for any business, which is why they are worth knowing even when they do not apply to you directly. They cover risk analysis and written security policies, incident handling, business continuity and backups, supply chain security, secure development and vulnerability handling, basic cyber hygiene and training including for management, encryption and access control policies, and multi-factor authentication. Reporting is staged and fast for the organisations it covers: an early warning within twenty-four hours of becoming aware of a significant incident, a fuller notification within seventy-two hours, and a final report within one month.

Because the directive is national law in each member state rather than a single rulebook, the details of scope, thresholds and reporting differ by country. For a fuller explanation of the instrument itself, see our guide to what the NIS2 directive is, and for the supplier side of the supply chain obligation, our walkthrough of vendor risk assessment. The reporting clocks that run alongside data protection deadlines are covered in data breach notification requirements.

Frequently asked questions

Does NIS2 apply to a small business?

NIS2 generally applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet total above ten million euros. A smaller business falls outside its direct scope unless a member state has specifically designated it or it sits in one of the size-independent categories, such as DNS service providers or trust service providers. Being outside scope does not stop the directive reaching you through customers who are inside it.

What is the difference between GDPR and NIS2?

GDPR governs personal data: what you may collect, why you may hold it, and what rights people have over it. NIS2 governs the security and resilience of network and information systems in specific sectors, whether or not personal data is involved. One incident can engage both regimes at once, on separate reporting clocks and to separate authorities.

How long do you have to report a data breach?

Under the European model, a personal data breach is reported to the supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware of it, and affected individuals are told without undue delay where the risk to them is high. Organisations in scope of NIS2 carry a separate obligation: an early warning within twenty-four hours, a fuller notification within seventy-two hours, and a final report within one month.

Does a small business need a data protection officer?

Under GDPR a data protection officer is required where the organisation is a public authority, where its core activities involve regular and systematic monitoring of people on a large scale, or where its core activities involve large-scale processing of special category or criminal offence data. A small business that meets none of those tests is not required to appoint one, though naming someone internally as the contact for privacy questions is worth doing regardless.

What should a small business do when a client's security questionnaire asks about NIS2?

Answer with what you do now rather than what you think the client wants to hear. The questions usually cover written security policies, incident handling and how fast you would notify them, multi-factor authentication, access control when staff join and leave, backup and recovery arrangements, and which of your own subprocessors touch their data. Gaps are common, and disclosing one with a date for closing it lands far better than an answer that does not survive the follow-up question.

Do these rules reach a business based outside the EU?

They can. GDPR reaches organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour, and other regions have their own regimes with their own triggers. NIS2 obligations follow the sectors and the member states that transpose it, but its supply chain expectations travel through contracts, which is how they reach suppliers anywhere in the world.