TL;DR
- Employers can monitor company-provided mobile phones, but must tell employees this is happening and have a lawful basis under UK GDPR.
- BYOD arrangements mean employees use personal devices for work; the employer's monitoring rights are narrower but not absent.
- A company mobile number belongs to the employer, not the employee; you cannot take it with you when you leave.
- Personal use policies should be written, communicated to staff, and consistently enforced to be legally meaningful.
- The ICO's Employment Practices guidance sets out the framework employers must follow when monitoring communications.
Company-provided phones versus BYOD
When an employer issues a handset and SIM on a business mobile contract, the device and the number are assets owned by the business. The employee is given use of those assets subject to the employer's policies. This is fundamentally different from a Bring Your Own Device (BYOD) arrangement, where the employee uses a personal handset - often on a personal contract - to carry out work tasks. Both models are common in UK workplaces, and both raise distinct questions about monitoring rights, personal use, and data ownership.
BYOD arrangements have grown in prevalence partly because they reduce capital expenditure for employers and allow employees to carry a single, familiar device. However, they introduce complexity around the boundary between personal and professional data, and they require careful policy design to ensure employer compliance with UK GDPR when accessing or managing the device. The ICO has published Employment Practices guidance that addresses these boundaries and is the primary reference point for employers designing or reviewing their mobile device policies.
Employer monitoring rights: the legal framework
An employer's right to monitor a company mobile phone is not unlimited. UK GDPR, which post-Brexit is retained in UK law as the UK General Data Protection Regulation and supplemented by the Data Protection Act 2018, requires that any monitoring of employees' communications is lawful, fair, and transparent. The employer must identify a lawful basis for processing - most commonly legitimate interests under Article 6(1)(f) UK GDPR - and carry out a Legitimate Interests Assessment that weighs the employer's interest in monitoring against the employee's reasonable expectation of privacy.
Critically, transparency is non-negotiable. The ICO's Employment Practices guidance states that workers must be told that monitoring is taking place, what is being monitored, for what purpose, and how the data will be used and retained. Covert monitoring of employees is lawful only in very limited circumstances - typically investigations into suspected criminal activity - and even then requires specific justification. Employers who monitor communications without adequate notice risk enforcement action from the ICO and potential claims under the Human Rights Act 1998 in respect of Article 8 rights (the right to respect for private life).
Personal use policies and their limits
Most employers that issue company mobiles allow some degree of personal use - a personal call during a lunch break, brief personal internet access - while prohibiting others such as accessing adult content, making excessive personal calls at company expense, or using the device for a second job. A personal use policy sets out what is permitted and what is not. For this policy to have any legal or disciplinary weight, it must be communicated clearly to employees before they use the device, form part of the employment contract or a document incorporated by reference into it, and be applied consistently.
Where an employer permits any personal use but then monitors all usage, the monitoring policy must explicitly address the personal use context. Employees need to understand that even personal calls or browsing on a company device may be subject to review. Failing to communicate this creates an expectation of privacy that UK GDPR and the Human Rights Act would give weight to, potentially undermining any disciplinary process that relied on monitoring data.
| Policy Area | Company-Provided Device | BYOD Device |
|---|---|---|
| Device ownership | Employer | Employee |
| Number ownership | Employer (business account) | Employee (personal contract) |
| Employer monitoring rights | Broad, subject to UK GDPR and notice | Narrower; limited to work containers or apps |
| Remote wipe authority | Full device wipe standard | Work container only (if MDM configured correctly) |
| Personal use permitted | Subject to employer's personal use policy | Yes, device is personal; work data governed by BYOD policy |
| Number retention on leaving | Number stays with employer | Number stays with employee |
What happens to your number when you leave
A mobile number on a business account belongs to the business, not the individual who used it. When an employee leaves, the employer retains the number and can reassign it to a successor or allow it to expire. The departing employee has no legal right to port the number to a personal account, because the number was never theirs: it was issued under a contract between the operator and the employer. Employees who have used their work number as a business contact number and wish to keep it should negotiate with the employer before leaving; some employers will agree to release the number, but they are not required to.
This contrasts sharply with BYOD arrangements, where the number on the employee's personal contract belongs to the employee in every respect. The employer cannot retain or block the number on departure. The Ofcom general switching and porting rules apply in the normal way, and the employee can port their number to a new network or continue on their existing contract as they choose. This difference is one of the practical reasons some employees prefer BYOD even where a company device is available.
Benefit-in-kind tax treatment
HMRC treats employer-provided mobile phones as exempt from income tax as a benefit in kind, subject to specific conditions set out in the Employment Income Manual. The exemption applies to one mobile phone per employee, provided the phone is provided by the employer (not by the employee under a salary sacrifice arrangement that does not comply with the relevant rules) and is available for private use. A second phone provided to the same employee is a taxable benefit. Sole-director companies providing a phone to the director-employee qualify for the same exemption.
The BYOD stipend - where an employer pays an employee a fixed allowance to use their personal phone for work - is treated differently. HMRC's position is that such a payment is earnings and subject to income tax and National Insurance contributions unless it is a genuine reimbursement of actual business costs that can be demonstrated. Employers using BYOD stipend arrangements should take tax advice to ensure they are structuring payments correctly.
What this means in practice
Daniela, a regional sales manager at a logistics company, is issued a company mobile on the firm's business account. She uses it for personal calls in evenings and weekends as permitted by the personal use policy she signed on joining. When she resigns to join a competitor, she asks HR whether she can keep her work number, which she has given to many clients. HR confirms the number is owned by the business, but after discussion, the employer agrees to port the number to a new personal SIM in Daniela's name as a goodwill gesture. Without that agreement, Daniela would have had no entitlement: the number would have remained on the employer's business account.
Related Guides
How we verified this
This article draws on the UK General Data Protection Regulation and Data Protection Act 2018 as published on legislation.gov.uk, the ICO's Employment Practices guidance on monitoring at work (ico.org.uk), HMRC's Employment Income Manual EIM65830 on employer-provided mobile phones (gov.uk), the Human Rights Act 1998, and Ofcom's General Conditions of Entitlement regarding number portability.
Disclaimer: Kaeltripton.com is an independent UK editorial publisher. We are not regulated by Ofcom or the FCA and we do not sell or arrange mobile services, insurance, or financial products. This content is for general information only and is not legal, financial, or technical advice. Rules, prices, and operator policies change. Verify the current position with Ofcom, GOV.UK, the ICO, or your provider before acting. ICO registered ZC135439. Last reviewed: 2026-06-05.
Frequently Asked Questions
Can my employer monitor my company mobile phone?
Yes, but with conditions. Monitoring a company mobile is lawful under UK GDPR if the employer has a legitimate basis for doing so, has told employees clearly that monitoring takes place, explained what is monitored and why, and documented a Legitimate Interests Assessment where that basis applies. Covert monitoring without notice is only permitted in very limited circumstances such as criminal investigations. The ICO's Employment Practices guidance provides the definitive framework.
What is a BYOD policy?
A BYOD (Bring Your Own Device) policy is a written employer document governing how employees may use personal smartphones and tablets for work purposes. It typically covers which applications must be installed (including any MDM profile), what data the employer can access on the device, acceptable use rules for work data, and what happens to the device and data if the employee leaves or the device is lost. BYOD policies must be consistent with UK GDPR and communicated to employees before device enrolment.
What happens to my company mobile number when I leave?
A number on a business mobile account belongs to the employer, not you. When you leave, the employer retains the number and can reassign or retire it. You have no automatic right to port it to a personal account. If the number is important to you - for example, because contacts know it - you should negotiate with your employer before leaving; some will agree to release it, but they are under no legal obligation to do so.
Can I use a company mobile for personal calls?
That depends entirely on your employer's personal use policy. Many employers permit reasonable personal use - brief calls, limited browsing - while prohibiting excessive or inappropriate use. The policy should be written, provided to you before you use the device, and incorporated into your employment terms. If personal use is permitted but the device is monitored, you must be told both facts clearly; you cannot be disciplined using monitoring data obtained without adequate notice.
What are my rights if my employer provides a mobile phone?
You have the right to be told what the device may be used for, what monitoring is in place, and how any personal data captured will be handled, in accordance with UK GDPR and the ICO's Employment Practices guidance. You are entitled to a copy of any personal use and monitoring policy before you are given the device. You may also make a Subject Access Request to the employer for any personal data held about you obtained through monitoring of the device.
