In this guide · 8 sections
Company-owned vs personal devices
The first decision is which devices you own and which belong to staff, because you manage them differently.
| Company-owned device | Personal device (BYOD) | |
|---|---|---|
| What you control | The whole device | Only the work apps and work data |
| Typical set-up | Fully managed: encryption, updates, approved apps, remote wipe | Work profile or app protection: work data kept separate |
| If lost or stolen | Lock or wipe the whole device | Remove work data only |
| When the person leaves | Hand back and reset | Remove the work profile or work apps |
| Privacy for the user | It's a work device; set expectations | Personal apps, photos and messages stay private |
For laptops that hold customer data, company-owned and fully managed is the safer choice. For phones, BYOD with a work profile is a reasonable compromise for most small teams.
What device management actually does
- Requires a screen lock or PIN and locks the device after a short idle time.
- Turns on disk encryption (BitLocker on Windows, FileVault on Mac) and stores the recovery keys in your company account, not on a sticky note.
- Keeps the operating system updated, or at least reports which devices are behind.
- Separates work and personal data on phones, so company files can't be copied into personal apps.
- Locks or wipes a lost device, or removes just the work data from a personal one.
- Shows you a list of every device that can reach company data, who uses it, and whether it meets your rules.
The PDPC's guide on managing data breaches gives remotely disabling a lost notebook containing personal data as an example of a containment action. Without device management, that isn't an option.
A lost laptop that was encrypted, with a recovery key you control, is usually an inconvenience. The same laptop unencrypted, holding customer records, can be a data breach you have to assess under the PDPA.
Your options: Intune, Google endpoint management and others
Microsoft 365
Microsoft says Microsoft 365 Business Premium includes Microsoft Intune Plan 1, which lets you enrol, monitor and manage devices. Intune covers company-owned devices and personal devices (BYOD), on Windows, Mac, iPhone and Android. On Business Basic or Standard, you would need to add Intune or upgrade before managing devices this way.
Google Workspace
Google endpoint management is built into Workspace, with basic and advanced mobile management. Google's Android management overview explains that what you can control depends on how the device is set up, whether the user is on basic or advanced management, and the Workspace licence. For personal Android phones, a work profile keeps a separate space for work apps and data; you control that space, not the user's personal side.
Apple and others
iPhones and Macs can be managed through Intune or Google, or through Apple-focused tools. If most of your team uses Macs, check that the tool you pick handles FileVault keys and macOS updates well.
What to put in a BYOD policy
Keep it to one or two pages that staff will actually read and sign. Cover:
- Which devices may be used for work email, files and apps, and the minimum requirements (supported OS version, screen lock, encryption).
- What the company can and cannot see on a personal device. Be specific: work apps and data, yes; personal photos, messages and browsing, no.
- Enrolment: staff must enrol personal devices in the work profile or app protection before accessing company data.
- Lost or stolen devices: report within a set time (for example, the same day), and agree that work data will be wiped.
- Leaving the company: the work profile or work apps are removed on the last day.
- Don'ts: no saving customer data to personal cloud storage, no forwarding work email to personal accounts, no shared family logins on the work profile.
- Who to contact for help, and how support works.
If you hold customer personal data, the policy is also evidence of your reasonable security arrangements under the PDPA. Our PDPA checklist covers the other obligations.
How to roll it out
- List every device that reaches company data, and mark each one company-owned or personal.
- Check your licences: Business Premium for Intune, or the Google Workspace edition that includes the management level you need.
- Write the BYOD policy and get staff to read and sign it before enrolment.
- Set the rules in the console: screen lock, encryption, minimum OS version, work profile for personal phones.
- Enrol one test device of each type first, and test a remote lock and wipe on a company device.
- Enrol everyone else with a short step-by-step guide; expect about 15 minutes per device.
- Block access from devices that aren't enrolled, once everyone is done.
- Add device removal to your leaver checklist.
Device management alongside antivirus and other controls
Device management sets the rules, but it doesn't stop malware by itself. Pair it with business-grade antivirus or endpoint protection on every laptop, MFA on every account, and backups. Together these cover most of the device requirements in CSA's Cyber Essentials mark. Our Cyber Essentials checklist lists them area by area.
If staff share a single login on a shared device, such as a reception PC, give that device its own account with limited access rather than an owner's admin login.
Do it yourself or get help?
For a few company laptops on Microsoft 365 Business Premium, turning on BitLocker through Intune and setting a basic compliance policy is manageable with Microsoft's guides. Personal phones, Macs and mixed fleets are where it gets fiddly.
Device Encryption & Management (S$490) sets up Intune or Google endpoint management in your tenant, enrols up to 10 devices, turns on BitLocker or FileVault with recovery keys in your account, sets screen lock and update rules, configures work profiles for personal phones, tests a remote wipe, and gives you a short device policy for staff to sign. Add Antivirus & Endpoint Protection Rollout (S$390) for business-grade protection on every machine.
Frequently asked questions
Mobile device management (MDM) is software that lets a business set security rules on phones and laptops, such as screen locks, encryption and updates, and lock or wipe a device or its work data remotely. Microsoft Intune and Google endpoint management are common examples.
With a work profile or app protection on a personal device, the company manages the work apps and work data. Personal apps, photos and messages are outside that space. A good BYOD policy says exactly what the company can and cannot see.
Microsoft 365 Business Premium includes Microsoft Intune Plan 1. Business Basic and Business Standard do not include it, so you would need to add Intune or upgrade to manage devices this way.
If staff access customer data or company email on laptops and phones, yes. A lost unencrypted device can mean a data breach to assess under the PDPA, while an encrypted, managed device can be locked or wiped remotely.
Remove the work profile or work apps on their last day, which deletes company data without touching personal content. Also remove their accounts, licences and password manager access as part of your leaver checklist.