The Device You Don't Own Is Carrying the Data You Do

Bring Your Own Device (BYOD) programmes trade convenience for control. Employees use personal smartphones, tablets, and laptops for work email, cloud storage, collaborative documents, and business applications — and organisations tolerate this because it reduces hardware costs and staff expect the flexibility.

What most organisations have not fully grappled with is what happens to that data when an employee leaves. Not just what they take — but what remains accessible long after their last day.

What Leaves When an Employee Does

When an employee with a personal device exits your organisation, several things happen simultaneously:

Email remains accessible. If the employee connected to Exchange or Google Workspace using native mail apps — rather than a managed container app — their personal device retains cached email. Depending on mobile OS and app settings, this cache can persist for weeks or permanently. They can read, search, and forward that email after their access has been revoked from the server side, using data already stored locally on the device.

Cloud sync continues until it is explicitly severed. Files synced from OneDrive, SharePoint, Google Drive, or Dropbox remain on the device. If the sync was configured with the employee's personal credentials rather than a corporate SSO, revoking corporate directory access may not terminate the sync relationship at all.

Contacts and calendar data are typically unrecoverable. Once a contact or calendar entry has been synced to a personal device and then to the device's native contact and calendar stores, it becomes indistinguishable from personal data. You cannot retrieve it selectively.

Credentials and tokens persist. Authentication tokens stored by mobile apps may remain valid beyond session expiry if they are not explicitly revoked. An employee who knows a system's direct URL can sometimes bypass SSO by using a cached token.

Application data sits in personal storage. Business apps that store data locally — field service tools, CRM mobile apps, notes applications — write data to the device's internal storage. Without a management layer that can remote-wipe the application container, that data stays on the device.

The POPIA Dimension

For South African businesses subject to POPIA, BYOD creates a compliance gap that is difficult to close without tooling.

Personal information that your organisation processes — customer records, HR data, client contact details — ends up on employee personal devices as a natural consequence of BYOD. Your organisation remains the responsible party for that information under POPIA, regardless of what device it is stored on.

When an employee leaves with personal information still accessible on their device, your organisation has lost effective control over that information. If it is subsequently misused, disclosed to a competitor, or lost in a personal data breach (the employee's personal cloud account is compromised), the downstream consequences include a potential POPIA breach notification obligation and reputational exposure.

POPIA's Condition 7 requires "appropriate, reasonable technical and organisational measures" to protect personal information. Allowing personal information to leave unmanaged on personal devices — with no ability to remotely wipe or enforce policies — is difficult to defend as appropriate.

The Gap Between Policy and Reality

Most organisations with BYOD programmes have a BYOD policy. Most of those policies include language like "employees must not store company data on personal devices" or "employees must delete company data upon termination."

These policies are unenforceable without tooling. There is no mechanism to verify compliance, no audit trail, and no remediation capability. An employee who ignores the policy faces no consequences because the organisation cannot detect the violation.

The policy exists to create a paper trail for legal proceedings after a breach — not to prevent the breach.

What Unified Endpoint Management Changes

Unified Endpoint Management (UEM) solutions like IBM MaaS360 separate the problem of managing personal devices from the problem of managing corporate data on those devices.

Containerisation

The core capability is the managed container. Corporate email, applications, and documents run inside an encrypted container on the employee's personal device, isolated from personal applications. The container can be remotely wiped on termination without affecting the employee's personal data, photos, or applications. The device owner never sees the encryption keys.

This changes the offboarding calculation entirely. Instead of hoping the employee deletes corporate data and having no way to verify it, IT can initiate a container wipe from the management console the moment termination is confirmed. It takes seconds, and the corporate data is gone from the device regardless of whether the employee cooperates.

Policy Enforcement

UEM allows you to enforce policies that are currently only aspirational:

Minimum OS version: Devices running outdated operating systems with known vulnerabilities cannot enrol in the corporate container
Screen lock requirements: Force a minimum PIN or biometric requirement on enrolled devices
Jailbreak / root detection: Unenrol devices that have been compromised
App blocklist: Prevent data from being copied into personal applications
Geo-restrictions: Flag or block access from unusual locations

Visibility Without Invasion

A properly configured UEM deployment does not give IT access to personal photos, messages, or personal applications. The management agent has visibility into the device's hardware and OS state (OS version, encryption status, compliance posture) but not personal content. This distinction is important for POPIA — the organisation should not be processing employee personal data from their personal devices beyond what is necessary for security management.

Practical BYOD Scenarios and How UEM Changes Them

Employee resigns and gives two weeks' notice. Without UEM: IT has two weeks of uncertainty about what is being copied or retained. With UEM: Corporate container access can be restricted immediately while allowing the notice period to complete. On last day, container is wiped remotely.

Employee is terminated immediately. Without UEM: Device is in the employee's possession. Corporate data remains accessible. With UEM: Remote wipe is initiated within minutes of termination processing. Container is destroyed. No physical access to the device required.

Employee's personal device is stolen. Without UEM: If the employee had corporate email and files on the device, the thief has access to them. With UEM: The managed container is encrypted and the device can be remotely locked or wiped. Corporate data is not exposed.

Employee uses a personal cloud account to sync work files. Without UEM: Undetectable. Files leave the organisation. With UEM: Managed applications can be configured to prevent saving to personal cloud storage. Corporate documents remain within the managed container.

What a BYOD Policy Should Actually Include

If your organisation is not ready to deploy UEM, at minimum your BYOD policy should be honest about what it can and cannot enforce, and should include:

Explicit consent to remote wipe of corporate data as a condition of BYOD enrolment
Separation of personal and corporate accounts — corporate email must not be connected via personal credentials to native mail apps
A defined offboarding process with a checklist, acknowledgement form, and timeline for data deletion
Annual policy acknowledgement — not just sign-on-hire

The policy does not replace tooling, but it creates a contractual framework that reduces legal exposure if a breach does occur.

FAQ

Can an employer remotely wipe an employee's entire personal device?

This is legally inadvisable and, in many cases, a POPIA breach itself (destroying employee personal data without authority). UEM containerisation avoids this by enabling selective wipe of only the corporate container, leaving personal data intact.

What if employees refuse to enrol in MDM?

This is a policy question, not a technical one. Many organisations require UEM enrolment as a condition of BYOD access. The alternative is to not allow corporate data on personal devices — which is the correct answer if the organisation is not willing to enforce the requirement.

Does BYOD affect cyber insurance?

Increasingly, yes. Cyber insurers are asking more detailed questions about endpoint management in renewal questionnaires. An organisation with no visibility into personal devices used for work may face higher premiums or coverage exclusions.

We are a small business. Is UEM worth it?

For organisations with 20+ employees using personal devices for work, the cost of a UEM solution is modest relative to the risk. IBM MaaS360 pricing starts at a per-device monthly fee that is typically less than the cost of one hour of incident response after a data breach.

What about contractors and temporary staff?

Contractors present the same risk as employees — often with less loyalty and shorter relationships. UEM enrolment should apply to any device used to access corporate systems, regardless of employment type.

The Honest Conversation

BYOD is a convenience that transfers data risk from the organisation to the individual while leaving the organisation legally responsible for the outcome. Until the organisation has the tooling to enforce separation between personal and corporate data, that risk is unmanaged.

The first step is an honest inventory: which employees use personal devices for work, what corporate data is accessible on those devices, and what your current capability to retrieve or wipe that data is.

Talk to our team about IBM MaaS360 and how it changes the BYOD risk equation for your organisation.

BYOD Data Risk: What Leaves with the Employee