Answers

Can employees use their own phones and laptops for work, and what if one is lost?

Ascent Vision · Published October 30, 2026

Yes, employees can use their own phones and laptops for work, but it works best with a short written rule: a screen lock, updates turned on, work apps only, and an immediate report if a device is lost. Keep sensitive customer data off personal devices where you can. Have a lost-device plan ready: change the passwords, sign the device out of work accounts from another device and, if it was set up, wipe it remotely.

What personal devices give you and what they risk

People already own and know their devices, so the business usually buys fewer. The risks are that customer information sits next to personal apps and family use, that the business may not be able to control or wipe the device, and that work data can stay on it after the person leaves.

The FTC's page "Cybersecurity for Small Business" (dated September 2025) says that whether employees or vendors use company-issued or personal devices to connect remotely to your network, those devices should be secure.

A short written rule

On that page, the FTC's guidance for devices that connect remotely includes keeping software up to date, mobile devices included, considering full-disk encryption for laptops and other mobile devices, changing smartphone settings to stop automatic connections to public Wi-Fi, and requiring multi-factor authentication for areas with sensitive information. The items below are general advice for a one-page rule:

• A screen lock on every device used for work.
• Work apps only: customer files are not saved to personal apps or sent to personal email.
• Who may wipe the device: all of it, or only the work apps. Agree it in writing first, because a personal phone also holds personal photos. If unsure how this applies to your staff, ask an attorney.
• What happens to work data when the person leaves. The related answer on removing an employee's access when they leave covers moving sign-in codes tied to their phone to a device the business controls.
• Report a lost device at once, to a named person.

Keep sensitive data off the device unless it is needed

The FTC's guide "Protecting Personal Information: A Guide for Business" (October 2016) has a section on laptop security. It says to "Assess whether sensitive information really needs to be stored on a laptop." It advises that a laptop holding sensitive data be encrypted and set up so users cannot download software or change security settings without approval from IT.

A personal laptop can be hard to lock down that way, so as general advice the simpler rule is to open customer records through the business's own tools and keep no copies on personal devices. The related answer on setting up a new employee's accounts and devices covers a device the business issues.

If a device is lost or stolen

The same guide mentions considering an auto-destroy function for laptops reported stolen, and the related answer on an AI policy for employees covers asking staff to report a lost device right away. The steps below are general advice.

• Change the passwords for the work accounts the device was signed in to, starting with email.
• From another device, use each account's security settings to sign the lost device out.
• If remote wipe was set up in advance, use it as your rule allows.
• Note what customer information could have been on it. If it may have been exposed, the related answer on what to do after a data breach covers next steps.

Sources

1. FTC, "Cybersecurity for Small Business" (Secure Remote Access; page dated September 2025)
2. FTC, "Protecting Personal Information: A Guide for Business" (October 2016)

Related answers

• How do you remove an employee's access to accounts when they leave?
• How do you set up a new employee's accounts and devices?
• What should a small business do after a data breach?
• Does a small business need an AI policy for its employees?