Staff using personal devices for client work

Q: How might this work in a small firm?

Illustration only. A five person practice lets staff read email and approve documents on their own phones. It enrols each phone in management software that creates a separate work profile, enforces a six digit passcode and encryption, and allows the work profile to be wiped remotely. Client files open only inside the document app and cannot be saved to the phone's own storage. When a bookkeeper's phone is stolen on a train, she reports it within the hour, the work profile is wiped, and the firm records the incident, its risk assessment and the decision not to notify the ICO in its breach log.

A practice that lets staff use their own phones or laptops for client work stays fully responsible for the client data on them. The ICO’s position is that the controller must remain in control of the personal data regardless of who owns the device, and HMRC tells agents that personal computers used for work must have the same security controls as office computers. In practice that means a written policy, technical controls such as encryption, screen locks and remote wipe, a clear line between work and personal data, and a plan for lost devices and leavers.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Is the practice still responsible if the device belongs to the employee?

Yes. The UK GDPR security principle requires appropriate technical and organisational measures to protect personal data, and the ICO says those measures must protect its confidentiality, integrity and availability. Ownership of the hardware does not move that duty to the employee. The ICO’s guidance on bring your own device (BYOD) puts it plainly: the controller must remain in control of the personal data for which it is responsible, regardless of the ownership of the device used to process it.

That guidance was written under the Data Protection Act 1998 and the ICO notes it has not been updated since the 2018 Act, but it still lists it as useful and links to it from its current data security guide. The principles it sets out map directly onto the security principle in today’s law.

For tax agents there is a second source. HMRC’s guidance on keeping online security information safe says personal computers used for work must have the same security controls as office computers, that sign in details must not be shared, and that where other people need access the firm should set up administrators and standard users rather than lend credentials.

What are the main risks for an accountancy practice?

The ICO lists what a controller has to assess before allowing personal devices: the type of data held, where it may be stored, how it is transferred, the potential for leakage, the blurring of personal and business use, the device’s security capabilities, what happens when the owner leaves, and how to deal with loss, theft, failure and support.

In a practice those risks look like this:

bank statements and payslips downloaded to a phone’s photo library or downloads folder and synced to the employee’s personal cloud account;
a family laptop shared with children, with the practice software left signed in;
client documents sent through a personal messaging app or personal email account;
an old phone sold or traded in without the work data being removed;
HMRC agent services accessed from an unpatched device.

The ICO specifically warns about automatic backups to a user’s own cloud account, removable memory cards whose loss may go unnoticed, and devices shared between family members.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What should a personal device policy say?

The ICO recommends an acceptable use policy developed with IT, HR and the people who will use the devices, which states clearly which types of personal data may be processed on personal devices and which may not. It also stresses that audit and ongoing monitoring of compliance is an important part of any policy. For a practice, a workable policy usually covers:

which devices and operating systems are allowed, and the minimum security settings;
that client data is accessed only through approved apps, the practice management system or a client portal, and is never saved to the device’s own storage or personal cloud;
that client work is never done through personal email or personal messaging accounts;
whether the firm will install management software, what it can see and what it can delete;
how to report a lost or stolen device, and how fast; and
what happens to work data when the employee leaves or replaces the device.

Staff should sign it before they are given access, and it should be reviewed alongside the firm’s wider cyber security controls.

Which technical controls are expected?

The ICO’s top tips for personal devices are to use a strong password, encrypt data stored on the device, lock the device or delete data after too many incorrect password attempts, set an automatic lock after inactivity, and keep work data separate from personal data, for example by using different apps for business and personal use. For data in transit it recommends an encrypted channel such as a VPN or HTTPS, especially on untrusted networks such as public wifi in a café, and extreme caution with public cloud sharing and backup services the firm has not assessed.

The ICO also expects the firm to think about patching, because security updates for some devices depend on the manufacturer or mobile network and may not arrive at all, about devices that have been rooted or jailbroken, and about which apps may be installed. Its data security checklist includes basic technical controls such as those in established frameworks like Cyber Essentials.

The simplest way to meet most of this is to keep client data off the device altogether: staff work through a browser based system or remote desktop, files stay on the firm’s servers or cloud platform, and the device acts only as a window. Then a lost phone is a security incident to manage rather than a large data loss.

Can the practice monitor or wipe an employee’s own phone?

Only with care. The ICO says mobile device management can locate a device and delete data on demand, but any tracking data must be used only for its stated purpose and not for ongoing surveillance, and users must be told exactly how tracking works and which data might be remotely deleted and when. Its separate guidance on monitoring workers says monitoring can be particularly intrusive when workers use their own devices, that firms should make sure they are not capturing private use of the device, and that a data protection impact assessment should address any monitoring of emails and messages.

A container approach, where the management software controls only a separate work profile or app and can wipe that without touching photos and personal messages, is usually more proportionate than full device control. If monitoring is planned, a data protection impact assessment is the place to justify it.

What happens when a device is lost or an employee leaves?

The ICO gives computing devices containing personal data being lost or stolen as an example of a personal data breach. Every breach must be recorded, and a breach that is likely to result in a risk to individuals must be reported to the ICO within 72 hours of becoming aware of it where feasible. Strong encryption and a quick remote wipe often reduce the risk enough that reporting is not required, but that is a judgement the firm must document; see reporting a personal data breach.

Leavers need a checklist of their own: remove access to systems and HMRC services on the last day, wipe the work profile, confirm in writing that no client data remains on personal devices or accounts, and check that nothing was forwarded to personal email in the final weeks. The ICO highlights safe deletion throughout a device’s life, particularly when it is sold or passed on.

How might this work in a small firm?

Illustration only. A five person practice lets staff read email and approve documents on their own phones. It enrols each phone in management software that creates a separate work profile, enforces a six digit passcode and encryption, and allows the work profile to be wiped remotely. Client files open only inside the document app and cannot be saved to the phone’s own storage. When a bookkeeper’s phone is stolen on a train, she reports it within the hour, the work profile is wiped, and the firm records the incident, its risk assessment and the decision not to notify the ICO in its breach log.

What mistakes do practices make?

Allowing personal devices informally, with no written policy and no record of which devices hold client data.
Letting staff email client documents to their personal accounts to work at home.
Using personal messaging apps for client conversations, leaving records outside the firm’s systems.
Installing full device monitoring when a work profile would do, then capturing staff’s private data.
Forgetting personal devices in the leaver process.
Assuming a lost phone is not a breach because it had a passcode, without assessing what was on it.

For the firm’s wider duties, see data protection for accountancy practices.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.