In most Polish SMEs, BYOD is not a project waiting to be rolled out. It is a fact that nobody announced. The sales rep has the company mailbox on a personal iPhone, the bookkeeper has both the corporate banking app and her kids' TikTok on the same device, and the owner reads offers in Outlook on his wife's tablet. The question is not "should we allow BYOD". It is "on what terms is this already happening".
BYOD (Bring Your Own Device) in a 15–40-person company looks different than in a corporation. There is no budget for 40 company phones at €900 each, no full-time admin to manage the fleet, and employees prefer their own devices to the corporate brick anyway. That is reality, not a problem — as long as you have a plan for it.
Three postures that actually work
We see three sensible models in practice. The right one depends on the industry, the company's size, and how sensitive the data your people handle really is.
Model 1: Company devices, zero personal. The company buys phones and laptops, employees don't use their own. Simple, expensive, tightly controlled. For 12 people in a law firm — reasonable. For a 35-person distribution company with regular turnover — usually dead on arrival, because someone will reply to a client on a Saturday from a personal phone anyway ("I left the work one at the office").
Model 2: BYOD with a work profile. The employee uses a personal phone, but company mail, calendar and files live in a separate profile (Android Work Profile or iOS User Enrollment). The company only manages that profile — it can enforce a PIN, encryption, and remotely wipe the corporate part when the person leaves. Vacation photos, WhatsApp and the gallery are untouched. This is the default choice for most SMEs.
Model 3: MAM without MDM (conditional access to apps). The company doesn't manage the whole device or even a profile — instead it enforces that company mail in Outlook requires a PIN, content can't be copied into personal apps, and the account signs itself out after X days of inactivity. The lightest form, good for companies where only Outlook and Teams ever land on a personal device.
The worst model is model four, which we see most often: no model at all — people do what they want, and IT finds out about it after the incident.
A real example
At one of our clients — a 22-person distribution company near Poznań — a sales rep lost a personal phone in a client's parking lot. On that phone he had the corporate Microsoft 365 mailbox, saved passwords in Chrome (including Comarch Optima), and a gallery full of order photos from key customers. The phone had no screen lock — because "it's private, I can't be bothered to unlock it every time".
The company found out on Monday morning. By then someone had sent 4 messages from that mailbox to trading partners asking them to change the bank account number on invoices. Three of them noticed the unusual tone and phoned in. The fourth transferred 47,000 PLN to the scammer's account. The money was never recovered.
Deploying Microsoft Intune work profiles for the whole team afterwards took 2 days. Cost: EMS E3 licences (~€12/month/user) and one afternoon of configuration. Result: company mail lives in a separate, encrypted profile with an enforced PIN, and if a phone is lost, the admin wipes the corporate part in 5 minutes from a browser dashboard. The same scenario in the new setup ends after three minutes of admin work, not 47,000 PLN sent to the wrong account.
What a work profile actually protects
When an owner hears "managing a personal phone", the first association is "we'll be poking around in employees' private photos". That's a misunderstanding worth clearing up immediately — without it, the whole idea won't fly.
The Android work profile and iOS User Enrollment behave like a partition inside the phone. Everything that's corporate (mail, calendar, work contacts, OneDrive, Teams) lives on one side. Everything private (photos, WhatsApp, banking, Spotify) lives on the other. The company physically cannot see the private side. No gallery access, no SMS history, no list of installed personal apps, no location.
What the company can and should do:
- Enforce a PIN or biometrics for access to the work profile — even if the phone itself has no lock.
- Enforce encryption of the corporate part (on modern phones this is automatic, but worth validating).
- Block copying data from work apps to personal ones (e.g. from Outlook to WhatsApp).
- Remotely wipe the work profile — leaving personal data untouched — when someone leaves or loses the phone.
- Enforce up-to-date OS versions — no unsupported Android or iOS versions allowed near corporate data.
None of the above requires looking into someone's private life. All of it, though, requires clear communication with the team — because an employee who doesn't understand where the work profile ends will be scared and will work around it.
The BYOD agreement without which none of this makes sense
Technical controls are one side. The other side is paper. In short: an employee using a personal phone for work needs to know, in writing, what's expected of them and what's expected of the company.
The minimum that has to be written down:
- Which systems can be used on a personal device (mail and calendar — yes; ERP and client documents — sometimes no).
- Requirement to enrol a work profile or accept MAM policies before the first login to company mail. Without that, access is blocked technically (Conditional Access).
- Duty to report a lost phone within an hour, with a clear number and contact person.
- The company's right to remotely wipe the corporate portion. Together with a written guarantee that personal data is not touched.
- Compensation — usually 30–80 PLN per month toward the plan, or a subsidy on a new phone. It's not about big money, it's about fairness: if the company uses your device and your data plan, it should chip in.
- GDPR — the employee processes customer personal data on their device. That has to be reflected in the record of processing activities, and the company's security policy has to permit it.
The agreement can be handled as a two-page addendum to the employment contract. Better to do it at onboarding than to explain later why we're suddenly installing "something" on someone's phone.
The mistakes we see repeatedly
Four errors we see over and over:
Banning WhatsApp as a work tool. A formal ban doesn't work until you offer an alternative. If reps coordinate with clients on WhatsApp because that's how the industry runs, banning it in policy just means they move to personal accounts and you lose all visibility. Allow it with judgment, or give Teams / Signal that will actually replace it.
Full MDM on a personal phone instead of a work profile. Employees hate it, and rightly — the company has no business seeing that someone installed Tinder. Always pick Work Profile / User Enrollment. "Full MDM" belongs on corporate-owned devices.
No procedure for when people leave. The sales rep leaves on Friday, the mail account is disabled Monday morning — but company files and offline mail stay on his phone forever. A remote wipe of the work profile has to be an item on the offboarding checklist, not something to "get to next week".
"The company app" on the owner's personal phone with zero protection. The irony: owners often let themselves off the hook. And the owner is the one with access to everything — from payroll to invoicing. Your own device has to be as secured as the team's. Ideally more.
Where to start
BYOD in an SME is not a six-month project. It's usually two weeks of work laid out like this:
- Write down the list of employees and which corporate systems they currently access on personal devices (the question alone will show you the scale).
- Pick a model — most often the work profile — and a licence (Microsoft Intune, Google Workspace Endpoint Management, or an alternative).
- Draft a one-page BYOD agreement and get it approved internally.
- Deploy the configuration on your own phone first, then on a trusted employee, then across the team.
- Set up Conditional Access so that company mail on a personal device without a work profile simply doesn't work.
- Add a remote wipe of the work profile to the offboarding checklist.
If you don't know which model fits your company, or how to approach it from the employment-contract side — half an hour of conversation will help you lay this out without drama and without scaring the team. Free of charge.
BYOD already exists in your company. The question is whether it's happening on your terms or outside them.