Mobile Device Security and BYOD

Your phone is a front door to the business

In many Indian MSMEs, the owner approves payments from a phone, the sales team shares quotations on WhatsApp and the accountant reads supplier emails on a tablet. That is convenient and normal. It also means a lost or poorly protected phone can expose email, chats, banking approvals, customer lists and photos of documents. The good news is that most mobile risk is reduced by a few simple habits that take minutes to set up and very little effort to keep.

The basic protections for any phone used for work

• Screen lock: use a PIN of reasonable length, a strong pattern-free passcode or biometrics backed by a PIN. Set the screen to lock automatically after a short idle time.
• Updates: install operating system and app updates when they are offered. If a phone no longer receives security updates from its maker, plan to replace it for work use.
• Official app stores only: install apps from the device’s official store. Avoid APK files shared on WhatsApp, Telegram or websites, even if they promise a ‘pro’ version for free.
• App permissions: check what each app can access. A torch or wallpaper app does not need your contacts, SMS or location. Remove permissions that do not make sense.
• Encryption and backups: most modern phones encrypt data when a screen lock is set. Make sure important work data is backed up through an approved method, not only stored on the phone.
• Find and lock features: switch on the phone’s built-in ‘find my device’ option so it can be located, locked or erased if lost.

BYOD: personal phones, business data

BYOD means staff use their own phones for work. It saves cost, but the business does not own the device, and the employee has a right to privacy. A good BYOD arrangement is short, fair and written down. It explains which work apps and data may be on the phone, the minimum protections required (screen lock, updates, official stores), what the business can and cannot see or do, how to report a lost device, and what happens to work data when someone leaves. Employees should agree to it before work data goes on their phone.

Keeping business and personal data apart

• Use a separate work profile or work container where the phone supports it, so work apps and files sit in their own space.
• Use business versions of tools where possible, such as a business account for customer chats, instead of mixing customers into personal chats.
• Keep work files in the approved business storage, not in the personal photo gallery or personal cloud drive.
• Avoid photographing invoices, ID documents or customer records with the personal camera app unless the business has agreed a safe way to do it and delete them afterwards.
• When remote erase is needed on a personal phone, the aim should be to remove only the work profile or work apps, not the person’s family photos. This only works if the separation was set up in advance.

If a phone with work access is lost or stolen

1. 1Stay calm and act quickly. Tell the designated contact (owner, manager or IT partner) straight away. Do not wait to see if it turns up.
2. 2Use the built-in find feature from another device to locate the phone, lock it and show a contact message.
3. 3Ask the responsible person to sign the device out of business email, cloud storage and other work apps, and to revoke its sessions where the service allows.
4. 4Change passwords for key accounts used on the phone through the normal approved process, starting with email.
5. 5If banking or UPI apps were on the phone, contact the bank through its official helpline to block or restrict access. If money is lost, call 1930 or report at cybercrime.gov.in.
6. 6If recovery is unlikely, erase the device or the work profile through the approved method. Note what was done and when.