Bring-Your-Own-Device Policies

Startups, particularly in the early stages, often can’t afford to outfit their employees with computers, tablets, and smartphones, and so have their employees simply use their personal computers, tables, and smartphones. In such a case, it is imperative to have a bring-your-own-device (BYOD) policy, since employees will be storing all the company data their work with on these personal devices.

There are a number of issues a BYOD policy needs to address.

– Who is responsible for the expenses of the device (e.g., maintenance and repair)? If the employee fully paid for the device and was previously using it solely for their personal needs, it may be simple enough to say that the employee is responsible, but now that the employee is using the device partially for the business, there is a legal basis to argue that the employer should be partially responsible

– Ownership of the device: If the employee paid the full purchase price it again may be simple enough to say that the employee owns the device; however, if the company at least partially subsidizes a purchase, particularly if an employee needs to obtain a new or replacement device, that issue gets murkier. The ownership issue can become particularly contentious if your BYOD policy requires installation of company software on the device (and should also regulate removal of the software upon the employee’s departure from the company)

– Security: At a minimum, a BYOD policy will require employees to take steps to ensure the security of devices (and the company information contained on them!), such as installing commercial antivirus software, encrypting company files and password-protecting devices. But it can also involve company-installed software that can permit tracking of the device or remote lock/wipe in the event that the device is lost or stolen.

– Support: As a practical matter, will you permit any brand of device, or any operating system? Are company systems and software compatible with the devices you’ll permit. Will the company be providing IT support or will employees need to refer to their device manufacturers and service providers for help?

A BYOD policy is necessary where company information will end up on employee’s personal devices. But as a final word of advice, it is also important to draft a policy that balances the company’s need to protect its information against employees’ rights and expectations of use and privacy in their personal devices.