Remote work and BYOD policy: a practical guide for Australian businesses

Personal-phone MFA, MDM visibility, remote wiping and the cost of using private equipment generate the strongest employee concern. Home-network security and offboarding are discussed less often, but they are recurring sources of preventable exposure.

• business with remote employees, contractors or outsourced service providers — Apply the policy to every person and device that can reach business systems or information, not only permanent employees.
• APP entity covered by the Privacy Act — Remote and BYOD controls form part of the reasonable technical and organisational measures used to protect personal information under APP 11.
• small business with annual turnover of $3 million or less — Do not assume the Privacy Act never applies; several categories of small business are covered, and contractual, sector and state obligations may still apply.

Remote work and access from a personally owned device are permitted only where the organisation has approved the user, work arrangement, device, applications, information and access method. Users must comply with the organisation’s acceptable-use, access-control, privacy and security requirements, maintain the required device and network safeguards, protect business information from household members and other unauthorised people, and immediately report loss, compromise or suspected unauthorised access.

• New South Wales workforce subject to computer surveillance — Include or link to the prior written notice and notified policy required by the Workplace Surveillance Act 2005.
• business handling sensitive or high-value information — Restrict access to organisation-issued or tightly managed devices where BYOD controls cannot reduce the residual risk to an acceptable level.
• ISM-aligned organisation — Map the policy to the enterprise-mobility controls for private devices, MDM, encryption, data separation, mobile-device use and emergency sanitisation.

This policy covers eligibility and approval, work locations and hours, approved devices and platforms, minimum security configuration, home and public networks, remote access, multi-factor authentication, storage and transfer of business information, separation of work and personal data, mobile device management, monitoring and privacy, software and cloud services, technical and financial support, incident reporting, loss and theft, after-hours contact, exceptions, offboarding and removal of business access and data.

• home-based employee using a shared household network — Use a guest network or separate work network where practical and do not share the work device or work account with household members.
• business providing remote access to internal systems — Require approved, hardened devices and MFA in addition to a VPN; do not treat network encryption as a substitute for endpoint security.
• worker using public or shared locations — Limit sensitive work, protect screens and conversations, avoid public Wi-Fi and use approved secure connectivity.

Remote work must be performed on an approved, supported and updated device using multi-factor authentication and the organisation’s approved remote-access method. Users must secure home routers and Wi-Fi by changing default credentials, using the strongest available encryption, applying updates, disabling remote management and Universal Plug and Play, and separating untrusted devices where practical. Work devices must automatically lock within five minutes, must not be shared, and must be protected from observation, overhearing, theft and unauthorised physical access.

• business allowing low-risk email or calendar access — A limited managed-app or browser-based approach may be sufficient if local storage, forwarding and personal backups are controlled.
• business handling health, identity, financial, legal or other sensitive information — Prefer organisation-issued and fully managed devices or remote virtual access that prevents sensitive information being stored locally.
• APP entity — Apply APP 11 controls to personal information wherever the organisation holds or controls it, including copies on approved personal devices and third-party services.

Business information may only be accessed, stored, created or transferred through approved work applications, managed profiles, virtual desktops and repositories. Users must not copy business information to personal email, consumer cloud storage, personal messaging services, photo libraries, removable media or personal backups. The organisation may prohibit local storage or require an organisation-issued device where the sensitivity of the information or the available controls make BYOD risk unacceptable.

• employee asked to install only an authenticator or passkey — Explain the app's permissions, data collected, support and alternatives; do not describe a simple authentication app as full-device management.
• employee asked to enrol a private phone in MDM — Complete a privacy and employment-law assessment, disclose the control and wipe capabilities, obtain any required agreement and offer a managed work device where the intrusion is not proportionate.
• award or enterprise-agreement workforce — Check whether the applicable instrument requires an allowance, reimbursement, consultation or other condition for using personal equipment or incurring work expenses.

Multi-factor authentication is mandatory for the systems designated by the organisation. Where authentication would require use of a personally owned device, the organisation will explain the application, permissions, information collected and support arrangements and will provide an approved alternative where the user has no suitable device or where personal-device use is not lawful, reasonable or proportionate. Full-device management of a personal phone is not implied by a requirement to use an authenticator and requires separate approval and disclosure.

• New South Wales employee subject to computer surveillance — Give the statutory prior notice, ordinarily at least 14 days, and conduct computer surveillance under a policy notified in advance so the employee can reasonably be assumed to understand it.
• APP entity collecting device or employee information — Assess whether the monitoring itself is privacy-invasive and limit collection, access, retention and disclosure to what is reasonably necessary.
• personal device using a managed work profile — State precisely whether the organisation can view device compliance, work applications and work data, and whether it can selectively wipe only the work container.

Before a personal device is enrolled, the organisation must disclose the management mode, permissions, information collected, monitoring performed, settings enforced, people authorised to access management data, retention period and whether the organisation can selectively wipe work data or erase the entire device. Monitoring and management must be lawful, necessary and proportionate and must be limited to approved security, compliance, support and investigation purposes. Personal content must not be accessed merely because the device is enrolled.

• routine resignation or end of contract — Schedule access removal for the same day the legitimate business need ends and obtain confirmation that managed work data and profiles were removed.
• lost, stolen or maliciously used device — Revoke access immediately, preserve relevant evidence and use selective or emergency sanitisation where technically available and proportionate.
• APP entity with personal information on a private device — Verify that personal information no longer needed is destroyed or de-identified across controlled copies, subject to lawful retention obligations.

When a user leaves, changes duties, loses a device or no longer has a business need, the organisation must promptly disable relevant accounts, sessions, tokens, certificates and remote access and remove organisational profiles, applications and data. Selective removal of the managed work container must be used wherever available. A full-device wipe may only be authorised where the capability, circumstances, consent or other legal basis and risk justify it. The organisation must verify removal and address downloaded files, synchronised copies and personal backups rather than relying on remote wipe alone.

• business with a master information security policy — Place acceptable use, access control and remote work and BYOD beneath the master policy and define precedence where requirements overlap.
• business using SaaS and personal phones without a corporate network — The relationship still matters: access-control rules govern identities and MFA, acceptable-use rules govern behaviour, and BYOD rules govern the endpoint and data boundary.
• business using an MSP — Require the provider to implement the same approved-device, identity, monitoring, logging and offboarding controls and retain evidence.

This policy must be read with the Information Security Policy, Acceptable Use Policy, Access Control Policy, Privacy Policy and Incident Response Plan. The Acceptable Use Policy governs permitted behaviour; the Access Control Policy governs identity, authentication, authorisation and access removal; and this policy governs the devices, networks, locations, management controls and data-separation conditions for remote access. Where requirements differ, the more protective lawful requirement applies unless an approved exception states otherwise.

• business with informal or employee-led BYOD — Inventory existing devices and access paths before writing the policy; otherwise unauthorised arrangements will remain outside the control set.
• multi-state employer — Use a national core policy plus jurisdiction-specific surveillance and privacy notices rather than assuming the NSW position applies everywhere.
• business unable to meet a control immediately — Record an owner, reason, compensating controls and expiry date for the exception rather than silently treating the gap as compliant.

Unapproved devices, rooted or jailbroken devices, shared user accounts, personal email or cloud storage for business information, undisclosed monitoring, unmanaged copies and standing remote access without a current business need are prohibited. Every exception must record the affected user and device, business reason, risk, compensating controls, approver and expiry date. Possession of a work application, account, device or SIM does not by itself require a user to monitor or respond to contact outside working hours.

This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.