DSIG 08A - Bring Your Own Device (BYOD) policy and guidelines

Aug 31, 2026

Upload by Rowan

Bring Your Own Device (BYOD) guidance sets out how staff may use personally owned smartphones, computers, tablets, and laptops to securely access organisational systems, applications, and information. The policy defines the scope of eligible users, the supported device requirements (latest Apple/Android versions, encryption, passcode/biometric lock, no jailbroken/rooted devices), and connectivity rules for secure WiFi or mobile data. It details access controls, staff responsibilities for confidentiality, acceptable use, incident reporting, and limits on support, costs, and liability for personal devices.

LanguageEnglish

CategoryLetters

FormatDOCX

Pages5

Reading Time2 min

AccessFree to download

Introduction

Scope

Aims

Support Devices

Access

Responsibilities

Loss or Damage

Acceptable Use

Costs

Monitoring

NHSmail

Lti Note: This document is intended to be used with: HYPERLINK "http://www.cpe.org.uk/dstemplates" DS&IG 08A Portable Computer Devices Introduction Bring Your Own Device (BYOD) allows staff to utilise personally owned devices (such as smartphones, computers tablets or laptops) for workers to securely access the organisation’s systems, applications and information securely and offered to provide greater flexibility. It may not be available to all staff. This policy provides guidance which must be followed when using your own device at work. All users of BYOD are required to read this policy in full and confirm that they understand and will comply with it. A summary of important points is provided below. Scope This policy applies to all staff and authorised third parties of the organisation who voluntarily choose to use BYOD. The BYOD service includes a range of systems and access may vary by individual depending on the requirements of individual roles. Available systems include: email; calendar; intranet and web browsing; internal web-based systems; rotas and scheduling; communication systems; reporting systems; and clinical systems. Aims To ensure BYOD systems and data are used appropriately, legally and securely. To ensure personally owned devices are used in a manner which protects confidentiality in accordance with GDPR. To ensure staff clearly understand their responsibilities when using BYOD. Support Devices Due to the rapid pace of change it is not possible to support BYOD on all devices. BYOD may only be supported on devices which will run the latest version of the Apple or Android operating system. Staff will be expected to ensure devices are kept updated or risk losing access to some systems. Devices must be encrypted and have passcode or biometric security if available with a timeout to lock automatically after 5 minutes of inactivity. Jailbroken or rooted devices are strictly prohibited. Staff must not circumvent security controls. The organisation’s BYOD software may be installed on devices for access to be granted to systems. Staff should not remove or modify the BYOD software on their device. Technical support will be limited to the organisation’s BYOD software and systems. Connectivity via WiFi or mobile data contracts will be the responsibility of the device owner. Digital information must only be downloaded or uploaded over a secure connection. It must not be downloaded over a public WiFi network because of the lesser security within public WiFi networks e.g. avoid downloading sensitive information using public WiFi from airports, hotels, coffee shops, public transport etc. Access Use of BYOD and access to corporate systems is subject to other organisation policies and practices and does not override or supersede them. BYOD is optional and may not be appropriate in all roles. The organisation reserves the right to revoke access if staff do not follow this policy. Responsibilities Staff may only connect to organisation systems for the purpose of authorised work. Use of a device that has access to work systems via BYOD should be limited to its owner and must not be shared. Devices must be maintained as stated in section 4. Account logon, passwords and pins must be kept confidential and never shared with others. Staff should be conscious of the setting in which devices are being operated and should ensure data and systems displayed are not visible to others. Data accessed must not be saved to the device or copied off it. Screenshots of systems must not be taken. Staff must inform senior staff if they leave employment with the organisation. Staff must comply with all relevant legislation including not using BYOD whilst driving. Staff must read and understand and adhere to other key policies such as data security policies. Staff must immediately inform the relevant person(s) if: their password has been breached; Their device gets lost or stolen; or organisational systems are not working normally. Loss or Dama

FAQs

Who does the BYOD policy apply to?

It applies to all staff and authorised third parties who voluntarily choose to use BYOD.

What device requirements must staff meet for BYOD support?

Devices must run the latest Apple or Android operating system, be encrypted, use passcode or biometric security with automatic timeout, and must not be jailbroken or rooted.

What should staff do if a security incident occurs?

Report any suspected breach to IT immediately, and inform the relevant person(s) if a password is breached or if the device is lost or stolen.

Aug 31, 2026

Upload by Rowan