In short
Monitoring employees' personal devices is legal only within tight limits. The ICO says device monitoring is particularly intrusive on personal devices and employers should not capture private use. Most organisations instead use company-owned devices for monitored work, separate work apps and data with device management, or limit monitoring to clocked-in work sessions.
Get a quote for BYOD monitoring
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why personal devices are different
On a company laptop, the device exists for work and staff expect some oversight. On a personal laptop or phone, the same device holds family photos, personal messages, banking, health apps and browsing that has nothing to do with work. Any monitoring tool that records the whole device will see all of it.
The ICO's guidance on monitoring workers recognises this. It says some workers use personal devices for work, that it is not always easy to tell workplace and private information apart, and, in its section on device monitoring, that monitoring is particularly intrusive on personal devices and you should make sure you do not capture information about private use. Article 8 of the Human Rights Act 1998, the right to respect for private and family life, sits behind this. This is general information based on the ICO's published guidance, not legal advice; take legal advice for your situation.
What the ICO expects
The general rules apply, with the bar set higher:
- Purpose and necessity: be clear why you need to monitor a personal device at all, and whether the same aim can be met another way.
- Do not capture private use: configure monitoring so personal activity is out of scope, or do not monitor the device.
- DPIA: assess the risk before you start; on personal devices the risk to private life is higher. See employee monitoring DPIAs.
- Transparency and consultation: tell workers exactly what is and is not monitored on their own devices, and consider discussing it with them or their representatives first.
- Special category data: personal devices are more likely to hold health, religious, union or other sensitive information, which needs a special category condition if captured.
- Retention and access: if anything personal is captured by mistake, delete it and restrict who can see monitoring data.
Less intrusive alternatives
In most cases there is a better route than monitoring the whole of someone's own device. Listed from most to least protective of privacy:
| Approach | How it works | Privacy impact |
|---|---|---|
| Company-owned devices for monitored work | Provide a work laptop for roles that need monitoring; personal devices are used only for lighter tasks or not at all | Lowest on personal devices: they are not monitored |
| Separate work apps and data | Device management keeps work apps and data in a managed space, so the organisation controls work data without seeing personal use | Low: the focus is on protecting company data, not watching the person |
| Browser or app access controls | Limit access to company systems to managed apps or browsers, with security checks | Low to moderate |
| Clocked-in sessions only | If monitoring software must run, use a visible agent that records only while the worker is clocked in | Moderate: depends on strict scheduling and exclusions |
| Whole-device monitoring | An agent records everything the device does | High: very hard to justify on a personal device |
Forever Group can help with mobile device management, including Microsoft Intune, to separate work from personal use. For the security side of personal devices, see our sister site's guide to BYOD security.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
If you do use Teramind on a personal computer
Teramind's agent runs on Windows, macOS and Linux computers; there is no Teramind agent for phones and tablets. If monitoring software has to run on a personal computer, these settings keep it as narrow as possible:
- Revealed agent: visible on the computer and installed locally; the worker signs in and clocks in and out, so monitoring runs only during work sessions they control. Teramind describes it as suited to BYOD environments for this reason. See the Teramind agent.
- Schedules: restrict monitoring to agreed working hours as a second safeguard.
- Application and website scope: include only the work applications and sites you need to see, rather than excluding a list of personal ones. Teramind's privacy guide suggests this allow-list approach for BYOD, and rules can also be limited to a designated work browser.
- No covert agents: hidden monitoring of someone's own device is very unlikely to be justifiable; see covert monitoring of employees.
- Lighter channels: avoid keystrokes, continuous screen recording and audio on personal devices.
- Access and retention: role-based access and short retention for anything captured.
Even with these settings, monitored work often belongs on company devices instead. If we think that is the better option for you, we can say so and help with the alternatives.
BYOD, Cyber Essentials and security
Monitoring and security are different questions. Monitoring asks what a person is doing; security asks whether company data and systems are protected. For personal devices, security controls are usually the more proportionate answer.
If you are working towards Cyber Essentials, personal devices that access organisational data or services can come into scope. Our sister site explains the Cyber Essentials BYOD and home working requirements. Data loss controls on company systems, rather than monitoring of people's own devices, are often the cleaner way to stop sensitive information leaving; see data loss prevention.
Is BYOD monitoring the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Contractors and freelancers on their own equipment
Contractors and freelancers often work on their own computers, and the ICO's guidance covers anyone who carries out work on your behalf, whatever their contract. Their devices are personal devices in every sense, and they may work for other clients on the same machine, so the case for whole-device monitoring is even weaker.
Where you have a genuine need, such as time-based billing or protecting access to your systems, these options are more proportionate:
- Revealed agent with clock-in: Teramind positions the Revealed agent for contractors and freelancers who manage their own time; it records only while they are clocked in, and they choose the task they are working on.
- Access through managed systems: give contractors access to your data only through company-controlled systems or virtual desktops, so monitoring and security controls sit there rather than on their device.
- Clear contract terms: set out in the engagement what monitoring applies, when, and what happens to the data at the end.
Teramind supports recording sessions on terminal servers, Citrix and VMware Horizon, so where contractors work through a virtual desktop you control, monitoring can be confined to that session rather than their whole computer.
What to put in your BYOD and monitoring policies
Make sure your employee monitoring policy and BYOD policy agree on these points:
- whether personal devices may be used for work, and for which tasks
- which monitoring, if any, applies to personal devices, and what is not collected from them
- what device management or access controls are required, and what the organisation can and cannot see
- what happens to work data when someone leaves or loses a device
- how workers can raise concerns or ask what has been collected
For workers based at home, also read monitoring employees working from home.
How Forever Systems helps
We supply, set up and support Teramind, and Forever Group also supplies device management and security services. That means we can recommend the approach that fits rather than pushing monitoring onto devices where it does not belong. We can:
- Review which roles need monitoring and whether they use company or personal devices
- Suggest where company-owned devices or device management would be less intrusive than monitoring
- Where monitoring on a personal computer is justified, configure the Revealed agent with tight schedules and scope
- Give you the technical detail for your DPIA and policies
Contact us to discuss your mix of devices. Ask us for a quote.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
Can my employer monitor my personal phone or laptop?
Only within tight limits. The ICO says device monitoring is particularly intrusive on personal devices and employers should not capture private use. Any monitoring needs a clear purpose, a lawful basis, a DPIA and clear information for you. Many employers instead separate work apps and data with device management. This is general information, not legal advice.
Is BYOD monitoring legal in the UK?
It can be, if it is necessary, proportionate, transparent and avoids private use, but it is harder to justify than monitoring company devices. The ICO expects employers to choose the least intrusive way to meet their purpose, which for personal devices is often device management or company-owned equipment.
Does Teramind work on mobile phones?
No. Teramind's agent runs on Windows, macOS and Linux computers and terminal or virtual desktop sessions. There is no Teramind agent for phones and tablets.
What is the alternative to monitoring personal devices?
Common alternatives are providing company-owned devices for monitored work, using mobile device management to separate work apps and data from personal use, limiting access to company systems to managed apps, and applying data loss prevention to company systems rather than to people's own devices.
Can employers see personal data on a BYOD device with MDM?
That depends on how device management is set up. Approaches that manage only work apps and data are designed to protect company information without giving the employer visibility of personal use. Your BYOD policy should state clearly what the organisation can and cannot see.
Still have a question about BYOD monitoring?
Ask us and a member of our team will reply by email.