Bring Your Own Device (BYOD) Policy

Bring Your Own Device (BYOD) Policy

Pauline Tarrant Consulting

Version 1.0 — September 2026

Next review: September 2027

1. Purpose

We allow people to use their own phones, laptops and tablets for work. It is convenient, it saves cost, and people work better on equipment they know. The trade-off is that client information ends up on devices we do not own and cannot see.

This policy sets the conditions on which that is acceptable. Its central requirement is simple: any device that holds or can reach client information must be encrypted.

The reason is practical, not bureaucratic. If an unencrypted laptop holding client records is stolen, we have almost certainly suffered an eligible data breach and will have to notify every affected person and the Information Commissioner. If the same laptop is encrypted with a strong passphrase and was powered off, the data is not accessible, serious harm is unlikely, and in most cases there is no notification obligation. Encryption is the difference between a bad afternoon and a reportable incident with client and reputational fallout.

2. Scope

This policy applies to every personally owned device used to access, store, transmit or process information belonging to Pauline Tarrant Consulting or its clients. That includes:

1. laptops and desktop computers,
2. phones and tablets,
3. USB flash drives, external hard drives, SD cards and other removable media,
4. personal cloud storage accounts used for work files, and
5. home or personal computers used to check work email.

It applies to principals, employees, contractors, and anyone else granted access to our systems.

Checking work email on a personal phone brings that phone within this policy. There is no informal tier.

3. The bargain

Using your own device for work is voluntary. If you would rather not accept these conditions, say so and we will arrange a firm-supplied device instead.

What we require of you is set out in sections 5 to 11.

What we will not do:

1. We will not read your personal email, photos, messages or browsing history.
2. We will not install monitoring software that captures your personal activity.
3. We will not track your location.
4. We will not take or inspect your device except with your agreement, or where a lost-device wipe is needed.

If we ever need to install management software that could affect your personal data, we will tell you exactly what it can see and do before you agree to it.

4. Approval and registration

Before using a personal device for work you must:

1. Ask the Principal for approval.
2. Confirm the device meets the standards in sections 5 and 6.
3. Have it entered in the device register (section 14).

Approval is per device. Adding a second device means a second approval.

5. Encryption requirements

Full-device encryption is mandatory on every device covered by this policy. No exceptions, no grace period.

Encryption only protects you if the device is locked or powered off, so the passcode requirements in section 6 are part of the same control, not a separate one.

5.1 By platform

Store your recovery key somewhere safe and off the device. A BitLocker or FileVault recovery key written on a note saved to the same laptop's desktop is not a backup. Use a password manager, or give a sealed copy to the Principal.

5.2 Removable media

Unencrypted USB drives and external hard disks must not be used for client information. Ever. They are the single most common way small firms lose data.

If you need removable media:

1. use a hardware-encrypted drive, or
2. encrypt the drive with BitLocker To Go, macOS Disk Utility encryption, or VeraCrypt, and
3. register it in the device register like any other device.

Do not accept an unencrypted drive from a client and leave the data on it. Copy the data to an encrypted location and wipe the drive before returning it, or return it unwiped and record that you did.

5.3 Encryption in transit

1. Access the Platform only over HTTPS. If your browser warns about the certificate, stop and report it.
2. Do not send client personal information in the body of an unencrypted email or as a plain attachment. Share it through the Platform, or send an encrypted archive with the password conveyed separately.
3. On public or untrusted Wi-Fi, use a VPN or your phone's hotspot. Café and airport Wi-Fi is not a working environment for client data.

6. Minimum device standards

Every registered device must have:

7. Accessing the Platform

1. Log in with your own named account. Never share credentials.
2. Enable multi-factor authentication.
3. Do not save your Platform password in a browser on a device other people use.
4. Log out when you finish on a shared or family device.
5. Do not use your Platform password anywhere else.

Prefer access over storage. The Platform is available in a browser. Working in it directly, rather than exporting records to your device, means there is nothing local to lose. Download client data only when you genuinely need to work offline, and delete the local copy when you are done.

8. Storing client information on your device

Where you must hold client data locally:

1. keep it in a single known location, not scattered through Downloads,
2. do not sync it to a personal cloud account (iCloud Drive, Google Drive, Dropbox, OneDrive personal) unless the Principal has approved that account,
3. do not put it in personal note-taking or AI apps,
4. do not email it to your personal address to work on later, and
5. delete it when the task is finished, under the Data Retention and Destruction Policy.

9. Shared and family devices

A device used by other members of your household may be used for work only if you have a separate password-protected user account that no one else can access, and client data is stored only within that account.

Children's devices, shared family tablets and communal home computers must not be used for client work.

10. Lost, stolen or compromised devices

Report it to the Principal immediately — within 4 hours of discovery, at the latest. Do not wait to see if it turns up.

Reporting quickly is not a disciplinary matter. Delaying is.

On being notified we will:

1. Disable the device's access to the Platform and reset your credentials.
2. Ask you to trigger a remote wipe through Find My iPhone, Find My Device or Find My Mac.
3. Establish what data was on the device and whether it was encrypted and locked at the time.
4. Assess whether the incident is a notifiable data breach and act accordingly.

Step 3 is why encryption matters. A locked, encrypted device that goes missing is usually manageable. An unencrypted one usually is not.

Report a suspected malware infection or account compromise the same way and just as fast.

11. Leaving, or ending an engagement

When you stop working with us, or stop using a particular device for work:

1. Remove all firm and client data from the device, including downloads, caches, email and local files.
2. Remove work accounts from mail apps and browsers.
3. Uninstall any work applications.
4. Confirm in writing that you have done so.
5. We remove the device from the register and revoke its access.

If you sell, trade in, recycle or dispose of a registered device, wipe it to factory settings first and tell us. Section 6 of the Data Retention and Destruction Policy sets out media disposal requirements.

12. Support

We support access to our systems. We do not support your personal device.

We will not repair your hardware, recover your personal files, or reimburse repair costs, data plans or device purchases unless separately agreed in writing.

If a remote wipe is necessary because a device is lost or stolen, personal data on that device may be destroyed along with work data. Keep your own backups. We are not responsible for personal data lost in a wipe carried out under section 10.

13. Non-compliance

Using a non-compliant device with client data puts other people's information at risk, not just your own.

Where a device is found to be non-compliant, access is suspended until it is fixed. Repeated or deliberate non-compliance — particularly disabling encryption, using a rooted device, or failing to report a loss — may result in withdrawal of BYOD privileges and, for employees, disciplinary action.

14. Device register

The Principal maintains a register of approved devices containing:

Encryption status is re-verified annually and whenever a device is replaced or its operating system is upgraded.

15. Related documents

1. Privacy Policy
2. Data Retention and Destruction Policy
3. Cookies Policy

16. Review

Reviewed annually, and additionally after any device-related incident or material change to our systems.

Acknowledgement

I have read and understood the Bring Your Own Device Policy. I confirm that each device I use for work meets the requirements in sections 5 and 6, and I agree to comply with this policy, including reporting the loss or compromise of a device immediately.

I understand that a device may be remotely wiped if lost or stolen, and that this may delete my personal data.

Name: ________________________________

Devices covered: ________________________________

Signature: ________________________________  Date: ____________

Notes for completion

1. Multi-factor authentication is required in section 7. Confirm MFA is actually enabled and enforced on erp.paulinetarrant.com before adopting this — Frappe supports it, but it is off by default. A policy requiring a control that does not exist is worse than no policy.
2. Remote wipe relies on the device owner's own Find My account. We cannot wipe a device we do not manage. If that assurance is not good enough for a particular client's data, the answer is a firm-supplied managed device, not a stronger paragraph here.
3. Windows Home edition does not include full BitLocker. Device Encryption is available on compatible hardware but not on all machines. Check before approving a Windows laptop.
4. Contractors may already be bound by their own employer's device policy. Where the two conflict, the stricter applies.
5. This is an operational policy, not legal advice. If any client contract imposes specific device or data-handling obligations, those terms override this policy and should be checked before approving a device for that engagement.