Bring Your Own Device

Organizations that allow employees to bring their own devices to perform the organization’s work often see a variety of benefits such as lowering costs plus boosting effectiveness and morale. However, such a policy also presents risks to your organization. If your organization is interested in implementing something like a bring your own device policy, the policy needs to be tailored to your organization’s needs and well-crafted to address security concerns and legal issues.  

For example, your organization needs to comply with applicable laws related to wage and hour laws that are potentially implicated when employees may have ready access and capability to do work for the organization like responding to e-mails or making calls. Additionally, it is vital to protect your organization’s confidential or proprietary information, comply with any expense reimbursement that may be required by applicable law, and ensure that records are stored long enough to satisfy discovery requests. Consult with a local attorney so your interests are protected.

SAMPLE POLICY:
BRING YOUR OWN DEVICE

Employees may use their own personal electronic devices to perform work on behalf of [name of organization] in accordance with this policy and when prior written authorization has been provided by the employee’s supervisor. Such authorization may be revoked at any time and for any reason. For purposes of this policy, “personal electronic devices” shall mean personally owned cellphones, smartphones, tablets, laptops and computers that are used for the organization’s business. Employees violating this policy shall be subject to disciplinary action, up to and including termination of employment.

Security Measures

Any personal electronic devices shall be used in accordance with [name of organization’s] password policies and shall be password protected and lock themselves if idle for more than two minutes. Employees shall only access organization-related information through approved applications and [name of organization’s] email. All personal electronic devices shall have anti-virus and mobile device management software installed by [name of organization] to store any information related to the organization in an area that is secure and password protected. Such information is the only information allowed to be stored in this area, and employees may not transfer data related to the organization to unsecure locations. Personal electronic devices shall also not be shared with third parties, including, but not limited to, family members. Any data breach, suspected or actual unauthorized access of the personal electronic device, or any lost or stolen personal electronic device, shall be reported to your supervisor as soon as possible.

Non-Exempt Employees

Non-exempt employees shall not use personal electronic devices to perform work on behalf of [name of organization] outside of the employee’s normal work schedule, unless otherwise agreed to by the employee’s supervisor. This includes sending and responding to work emails, making work-related calls, etc.

Employee Privacy

In the event a remote wipe of a personal electronic device is needed, [name of organization] will endeavor to take reasonable precautions to prevent your personal data from being lost. In such a situation, it is your responsibility to back up any data on your personal electronic device, and [name of organization] cannot guarantee such data will not be lost. [Name of organization] shall have no responsibility for loss or damage resulting from use of [name of organization’s] applications or such a wipe.

[Name of organization] will also strive to use reasonable efforts to respect the privacy of your personal electronic device to the extent that it is not used for the organization’s purposes. However, an employee using a personal electronic device should not expect any privacy unless required by applicable law, and [name of organization] reserves the right to monitor and access any and all communications that use [name of organization’s] networks in any way.

Use Expectations: Compliance with Other Policies and Procedures

Employees are always expected to use personal electronic devices in an ethical manner and exercise good judgment when using them. Employees using personal electronic devices shall ensure that use of such devices adheres to all [name of organization’s] other policies and procedures, including, but not limited to, policies and procedures regarding confidential information, document retention, harassment, and equal employment opportunity.

Inspection Requests: Separation from Employment

If requested by [name of organization] or upon resignation or termination of employment, [name of organization] may require an employee to produce a personal electronic device for inspection. [Name of organization] shall remove any of the organization’s data from the personal electronic device upon resignation or termination of employment.

Reimbursement

[Name of organization] will comply with all applicable laws related to expense reimbursements for personal electronic devices.

This is a sample handbook policy only. Your organization is responsible for compliance with all applicable laws. Accordingly, this document should not be used or adopted by your organization without first being reviewed and approved by a licensed attorney in your area. Brotherhood Mutual assumes no liability in preparation and distribution of this sample document.

Working Together © 2022 Brotherhood Mutual Insurance Company. All rights reserved. www.brotherhoodmutual.com/working-together. Updated 9/2021.