Company mobile phone policy: what to include

Why a written phone policy matters

Most phone problems in a business are not technical. They are disagreements about who pays for a roaming bill, whether a leaver can keep their number, or whether IT can wipe a phone that holds personal photos. A written policy settles those questions before they come up.

A good policy also does practical work:

• It tells staff what to do in the first minutes after a phone is lost, which is when it matters most
• It supports your security controls, including the device management (MDM) rules that phones must meet
• It gives you something to point to if you hold, or are working towards, Cyber Essentials
• It makes tax treatment cleaner, by recording that phones and lines are provided by the business on its own account

Keep it to a few pages in plain English. A policy staff actually read beats a long one they sign without opening. This page covers what to include; it is practical guidance, not legal advice, so have your HR adviser or solicitor review the final version, particularly anything about deductions from pay or monitoring.

Eligibility and allocation

Start with who gets a company phone and why. Typical wording sets out:

• The roles or criteria that qualify for a phone (field work, on-call duties, customer-facing roles, handling sensitive data)
• Which types of handset and plan are available for each role, and who approves exceptions
• Whether some roles get a work line on their own phone instead (a company SIM or eSIM in a dual SIM handset)
• That the phone, the SIM and the number belong to the business

Recording that the business owns the number matters later. When someone leaves, the number stays with the business, which avoids a dispute about customers who have that number saved. Our guide to company mobile phones explains how to decide who needs one.

Acceptable use and personal use

Say clearly what the phone is for and what is not allowed. Most policies cover:

• Business use first. The phone is provided for work and must be available for work during working hours.
• Personal use. Whether reasonable personal calls, messages and data are allowed. HMRC's exemption for one company phone covers private calls the employer pays for on that phone, so allowing personal use does not usually create a tax charge (see are company mobile phones a benefit in kind?).
• Costs that are not allowed. Premium-rate numbers, paid subscriptions and in-app purchases, unless approved.
• Driving. It is illegal to hold a phone while driving. State that staff must not hold or use a handheld phone while driving for work, and should only take calls on a hands-free set-up where it is safe and lawful.
• Professional conduct. Business messages on the phone may be company records, and the business's usual rules on behaviour and confidentiality apply.
• Sharing. The phone must not be lent to family members or anyone outside the business.

Security requirements

This is the section that protects company data. Match it to the controls you actually apply through your MDM, so the policy and the technology say the same thing:

• Screen lock. A PIN, passcode or biometric lock, with the minimum length and auto-lock time you require.
• Updates. Install operating system and app updates promptly; phones that stop receiving security updates are replaced.
• Device management. Company phones are enrolled in the business's MDM and must not be removed from it.
• Apps. Install apps only from the official app stores or the company app catalogue; no jailbreaking or rooting.
• Sign-in. Use the company's multi-factor authentication app and do not share passcodes or sign-in codes.
• Networks. Take care on public Wi-Fi and use the company VPN where one is provided.
• Suspicious messages. Report suspected phishing texts, messages and calls rather than replying or clicking links.

If you hold or are working towards Cyber Essentials, phones that access work data, including personal phones, are in scope and need to meet its requirements; our sister site explains this in Cyber Essentials, BYOD and home working. For the tools that enforce these rules, see mobile device management software.

If a phone is lost or stolen

Speed matters more than anything else here, so give staff a short, numbered process and a named contact:

1. Report the loss straight away to the named contact (IT, the office manager or whoever runs the phones), day or night as your business decides
2. The business locks the phone, or wipes it if it is unlikely to be recovered, through the MDM
3. The business asks the network to bar the SIM so it cannot be used to run up charges
4. The employee changes the passwords for any accounts that were signed in on the phone, and the business signs those sessions out
5. If the phone was stolen, the employee reports it to the police and passes on the reference
6. A replacement handset is issued and enrolled; the number can be moved to a new SIM or eSIM

The policy should also say who pays for a replacement if a phone is lost through carelessness, if that is something your business wants to recover. Take HR or legal advice before including any deduction from pay.

Roaming and travel

Roaming is where unexpected bills come from. Each network sets its own roaming zones, daily charges and fair use terms, so the policy should say what staff need to do before they travel:

• Tell the named contact before travelling abroad with a company phone, so roaming can be switched on or an add-on arranged
• Follow the rules for roaming data, such as using Wi-Fi where it is secure and turning off data roaming outside approved trips
• Use Wi-Fi Calling where the network and phone support it
• Understand that spend caps may stop service once a limit is reached

Our guide to business roaming explains how roaming works on business accounts.

Bring your own device (BYOD) terms

If staff use their own phones for work email or apps, the policy needs a separate section, because the business is asking for some control over a device it does not own. Cover:

• Which roles may use a personal phone for work, and for which apps
• The minimum requirements: a supported operating system, a screen lock and enrolment for work access
• How work data is kept separate. Android phones can use a work profile and iPhones can use user enrolment, so the business manages work apps and data rather than the whole phone
• What the business can and cannot see, in plain words, and what happens to work data if the phone is lost or the person leaves
• Whether the business contributes to the cost, noting that paying towards an employee's own contract has tax and National Insurance consequences

Done properly, BYOD lets the business remove its apps and data from a personal phone without touching the owner's photos or messages. Spell that out, because it is usually the first question staff ask. For phones you give staff instead, see company mobile phones.

Leavers, returns and data wipe

Close the loop with what happens when someone leaves or changes role:

• Return. The phone, charger, SIM and accessories are returned on or before the last day, in working order.
• Unlocking. The employee signs out of any personal accounts and removes any personal lock, so the phone can be reset.
• The number. The number belongs to the business and stays with it; the employee may not port it away without approval.
• Data wipe. The business wipes the phone, or removes work data from a personal phone, through the MDM.
• Personal data. Staff should move any personal photos or contacts off a company phone before they leave, because it will be reset.

If you want to let a long-serving employee keep their number when they leave, say who can approve that and how it works: they can request a PAC to move it to their own contract once the business agrees.

Template headings for your phone policy

Use these headings as the skeleton of your policy. Fill each with a few short paragraphs that match how your business works.

1. Purpose and scope: who and which devices the policy covers
2. Eligibility and allocation: who gets a company phone and what type
3. Ownership: the business owns the phone, SIM and number
4. Acceptable use: business use, personal use and costs that are not allowed
5. Driving and safety
6. Security requirements: screen lock, updates, MDM enrolment, apps and sign-in
7. Lost or stolen phones: who to tell and what happens next
8. Roaming and travel abroad
9. Spend caps, excess charges and replacements
10. Personal devices used for work (BYOD)
11. Monitoring and privacy: what the business can and cannot see
12. Leavers and role changes: returns, numbers and data wipe
13. Breaches of the policy
14. Review: who owns the policy and when it is reviewed

Review the policy whenever you change network, MDM or the way you provide phones, and at least once a year.

We help with the parts of your policy that depend on your phones and contracts: which controls your network and MDM can enforce, how spend caps and roaming bars are set, and how leavers' numbers are handled. Contact us to talk it through.