Email on a personal phone usually started as a convenience. An employee needed messages on the move, so IT set up work email on the phone the employee already owned. Over a few years, the amount of company data on those phones grew. The controls around it stayed the same.
Today a typical employee phone holds work email next to family photos, a customer spreadsheet in the downloads folder, and the authenticator app that protects the accounting system on the same home screen as games and social apps.
What actually lives on a personal phone
A phone connected to work systems holds more than email.
It holds attachments that were opened and cached, files synced from cloud storage for offline use, and photos of whiteboards, job sites, and documents taken for convenience. It holds chat messages with customers and coworkers, often with prices, addresses, and account details inside the thread. It holds sign in sessions that stay active for weeks, so opening an app goes straight to company data.
It also holds access itself. The authenticator app, text codes, and push approvals all land on that one device. Whoever holds the unlocked phone often holds a working path into email, files, and line of business systems.
The three moments this creates a problem
1. The phone is lost or replaced.
An employee leaves a phone in a truck, drops it, or trades it in. If the device had no screen lock requirement and no way to remove company data remotely, the company has to hope the finder does nothing with it. Hope is the only control left in that situation.
2. The employee leaves the company.
Offboarding usually covers the laptop, the building key, and the email password. Personal phones get missed. Weeks later, the former employee still has cached files, photos, and chat history on a device the company cannot inspect or clear. This gap shows up most often with sales staff and managers, who tend to carry the most customer information.
3. Personal backups copy work data elsewhere.
A phone backup to a personal cloud account can include work files and chat data. Family members signed into the same account on a shared tablet can see synced photos, including work photos. Each extra copy sits outside company retention and deletion processes.
What control looks like in practice
Control means the company manages the work portion of the phone, and the personal portion stays personal. Current mobile management tools support that split on both major phone platforms.
A work profile or managed apps setup keeps company email, files, and chat in a separate container. IT can require a screen lock, check encryption, and block sign in from a phone that is out of date. When an employee leaves or a phone is lost, IT removes the work container only. Personal photos, messages, and apps stay on the device.
Conditional access adds a check at sign in. The system confirms who is signing in and whether the device meets the rules you set. A sign in from an enrolled phone goes through. A sign in from an unknown phone gets blocked, or gets a limited browser view with downloads turned off.
A policy staff will actually follow
Write the rules in plain language and keep the list short. Cover which roles may use a personal phone for work and which roles use a company issued phone instead. State what data may not be stored on a phone at all, such as full customer lists or payroll files. State how quickly a lost phone must be reported and give a named number to call. State clearly that the company removes work data only at exit. Cover any stipend, and what happens if an employee declines enrollment.
For roles with sensitive access, provide a real alternative. A company issued phone removes the argument that personal enrollment is the only way to do the job.
Start with an inventory this week
Ask each department head for a simple list: who uses a personal phone for work, and which systems they reach from it. Compare that list to your mobile management enrollment report. The difference between the two lists is your current exposure, in names and systems you can act on.
Enroll the difference first, starting with managers, finance, and anyone with customer lists or payment information. Then test the exit process on one test phone: remove the work container, confirm company data is gone, and confirm personal photos remain. Record the result so the process is ready when a phone is actually lost.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.