When his company’s main server was crashing every day a panicked business owner contacted us with what he thought was a simple problem. Productivity was tanking. The team was frustrated.
The initial assumption? The server was too small. Maybe it needed more memory, or perhaps it was time for a complete upgrade.
But when we investigated, we found something nobody had expected.
One employee was using nearly a third of the company’s storage for personal files. Photos, family videos, personal backups and all sorts of other things that had nothing to do with work.
The employee probably hadn’t given it much thought. But the business was paying to store and back up files it didn’t need, while its server struggled under the load.
It’s a good example of why personal use of company devices isn’t always as harmless as it seems.
When personal use creeps onto work devices, it can create unnecessary cost and risk for the business. You can read more about managing company data in our blog; Data Storage: Out of Sight, Out of Mind
Why Personal Use on Work Computers Can Become a Problem
It’s easy for the lines between work and personal use to become blurred. Checking a personal email at lunchtime probably doesn’t feel particularly significant. Neither does saving a few photographs or logging into a personal account.
The problem is that there’s rarely an obvious point where occasional personal use becomes a business risk.
Personal files take up storage and may be included in company backups. Unapproved applications can introduce security risks. Personal accounts can make it harder to separate business and private information. And if a device ever needs to be investigated, things can become considerably more complicated.
What Are the Risks of Using Work Computers for Personal Use?
Allowing personal use on company devices isn’t just about lost productivity or wasted storage. There are other risks to consider too:
1. Security Risks
• Downloading software, opening personal email attachments or visiting less reputable websites can expose a company device to risks that wouldn’t otherwise be there.
• Reusing passwords across personal and work accounts can also increase the risk of an account being compromised.
2. Data Protection and Compliance
Company devices often contain customer information, commercially sensitive documents and other data the business is responsible for protecting. Mixing personal and business activity makes it harder to maintain that separation and can create unnecessary data protection and compliance issues.
3. Legal Complications
There can also be more serious situations. If a company device becomes part of an investigation into an employee’s personal activity, business information stored on that device could potentially become caught up in the investigation too.
It’s an extreme example, but another reason why keeping business devices for business use makes sense.
Where do you draw the line?
This is where businesses can struggle. Does checking personal email count? What about online shopping during a lunch break? Saving a few photographs? Installing an application that makes someone’s job easier?
There isn’t necessarily one rule that suits every organisation. What matters is that you’ve decided what’s acceptable, documented it and made sure employees understand it.
What Should Businesses Do?
A clear acceptable use or device usage policy removes much of the uncertainty. Employees shouldn’t have to guess what’s permitted, and managers shouldn’t be making the rules up after something has gone wrong.
Your policy should explain what personal use is acceptable, whether personal files can be stored on company devices, whether employees can install their own applications and how company devices may be monitored.
It should also explain what happens when someone leaves the business and how company information and devices are returned.
A clear policy should cover:
What personal use is acceptable
Be clear about whether employees can use work devices for occasional personal activity and where the boundaries are.
Personal files and applications
Explain whether personal files can be stored on company devices and whether employees are allowed to install their own applications.
Monitoring
Employees should understand how company devices are monitored and what information may be recorded.
What happens when someone leaves
Set out how devices are returned and how access to company information is removed.
What happens if the policy isn’t followed
Employees should understand the consequences of repeatedly or seriously ignoring the policy.
Reducing the Risk
Technology can help reduce the risk too.
Mobile Device Management (MDM) can help businesses manage and secure the devices employees use for work, whether they are company owned or, where appropriate, personal devices. It can help ensure security settings are applied consistently, devices are kept up to date and company information remains protected if a device is lost, stolen or an employee leaves.
Regular security awareness training also helps employees understand why the rules are there and the part they play in protecting company information.
Where employees use their own devices for work, clear policies and appropriate controls are particularly important. Business information needs to remain protected without unnecessarily interfering with an employee’s personal data.
Personal Use Doesn’t Have to Become an IT Problem
The employee filling the server with personal photographs and videos probably didn’t set out to cause a problem. They simply hadn’t considered the impact their personal files were having on the business.
That’s why clear policies matter.
People need to know what’s acceptable, company devices need to be properly managed and the technology should help enforce the rules rather than relying entirely on employees remembering them.
A little clarity now can prevent a surprising amount of cost, disruption and risk later.
If you’re unsure how personal use is being managed across your company devices, it’s worth finding out before it becomes a problem.
