Following the implementation of the GDPR businesses must now ensure that any data stored on employees’ phones is as secure as it would be if it was stored on the company server. Employers should therefore be cautious in allowing employees to use personal mobile phones to deal with work-related matters using their personal devices or out of the office. The use of personal devices should only be authorised where the security of the data stored on the device can be guaranteed.
Interestingly, and worryingly, approximately 46% of employees who were surveyed stated they were unsure of how GDPR would affect their personal mobiles.
What are the Implications?
The UK GDPR regulations lay down the extent of financial penalties for non-compliance based on the nature of the breach:
- Up to £10 million or 2% of annual global turnover, whichever is the greater
- Up to £20 million, or 4% of annual global turnover, whichever is the greater
These fines are significant even for the largest of companies, so ensuring that your work-related data is being securely managed on all employee devices should be managed as a priority.
Recommendations
Practically speaking, employers should implement mandatory, companywide, GDPR training for all employees to ensure they are aware of how to keep their own data and their clients’ data safe and secure. Employers should liaise with their IT department to ensure that any work-related data stored on employees’ personal mobiles can be as secure as the data within company servers.
As a minimum, a best practice Bring Your Own Device (BYOD) policy should be in place.
If your employees use their own mobile phone for work, either formally with a BYOD policy in place, or informally without the company’s knowledge then you need to consider:
- Do you have a clear policy in place that all employees are aware of?
- Can you make it easy for employees to follow your policy?
- How can they keep work and personal contacts and communications separate?
- How secure is customer data and communications on their device? Is it as secure as it would be on the company server?
- Can you ensure that you retain customer data if an employee leaves your business?
Did you know, in September 2022 alone there were 35.6 million data records breached and this was considered a “comparatively quiet month” by data security experts at IT Governance.
In our experience, most customers that Tela have spoken to cannot ensure the majority of the above (either they do not have the IT resource in place to implement this, nor are they able to continually monitor it) and are therefore at risk of non-compliance with the UK GDPR, and large potential fines.
Our strongest recommendation would be that the safest, and most infosec compliant option is to have personal and work devices kept entirely separate for employees.
If you would like to discuss your current mobile device provision with one of our mobile and IT experts, please get in touch.
