BYOD Policy

What a BYOD policy is

A BYOD policy (سياسة استخدام الأجهزة الشخصية), where BYOD stands for bring your own device, is the internal document that sets out when an employee may do their work on a device they own, which of the organisation’s data and systems they may reach from it, and which controls they must accept in return.

The question a BYOD policy deals with is not the device but what the device reaches. The organisation’s email, files and systems remain its data wherever they are opened. Moving the work onto a device outside the organisation’s ownership is what calls for a written arrangement in place of custom, the shift from custom to written rules that formalization describes.

The questions a BYOD policy answers

A BYOD policy answers six questions.

• Who is covered. Which roles are permitted to work on a personal device, and which roles are excluded because of the nature of what they have access to.
• What is made available. Email only, operational systems as well, or files that can be downloaded onto the device.
• The minimum on the device. A screen lock, an updated operating system, and no sharing of the device with anyone other than its owner while it is being used for work.
• What happens on loss or theft. To whom the loss is reported, within what period, and what is done straight away on the employee’s accounts.
• What happens when the relationship ends. How the organisation’s data is removed from a device the organisation does not own, and who checks that the removal has been done.
• The cost. What the organisation bears and what the employee bears, where an allowance or a subscription is involved.

A BYOD policy that stops at a statement that personal devices may be used has answered none of these six. They are precisely the questions that are raised for the first time on the day an incident occurs.

The data side of a BYOD policy

Data on employees and on customers that passes through the device is personal data where it relates to an individual, and handling it is governed by the Personal Data Protection Law (نظام حماية البيانات الشخصية), or PDPL, issued by Royal Decree M/19 of 9/2/1443H and amended by Royal Decree M/148 of 5/9/1444H. Article 1 of the PDPL defines personal data as any data, whatever its source or form, that identifies an individual specifically or makes it possible to identify them directly or indirectly. Article 2 of the PDPL applies the law to any processing of personal data relating to individuals that takes place in the Kingdom, by any means.

Among the provisions of the PDPL that apply to that data are the following.

• Specifying the purpose of collection. Article 11 of the PDPL requires the purpose of collecting personal data to be directly related to the controller’s purposes. Article 10 of the PDPL limits the processing of personal data to the purpose for which it was collected, subject to the situations that Article 10 of the PDPL lists as exceptions.
• Collecting no more than the purpose needs. Article 11 of the PDPL requires the content of personal data to be appropriate and limited to the minimum necessary to achieve the purpose of its collection.
• Protecting what is collected. Article 19 of the PDPL requires the controller to take the organisational, administrative and technical measures needed to protect personal data, including when it is transferred. Article 19 of the PDPL names those three kinds of measure without specifying particular ones.
• Destroying data once it is no longer needed. Article 11 of the PDPL requires the controller, once personal data is no longer necessary for the purpose of its collection, to stop collecting it and to destroy what was collected without delay. Article 18 of the PDPL sets the same rule on destruction and qualifies it in two ways. Data may be kept after the purpose has ended once everything that identifies the data subject has been removed, in line with controls set by the PDPL’s Implementing Regulations, and data must be kept where a legal basis requires it to be retained for a set period or where it is closely connected to a case before a judicial body.
• Confidentiality after the relationship ends. Article 41 of the PDPL provides that the duty to keep personal data confidential continues after the occupational or contractual relationship has ended. It is addressed to anyone who carries out processing of personal data, not only to the controller.

Article 1 of the PDPL defines the controller (جهة التحكم) as the party that determines the purpose of processing personal data and the manner of that processing. For the data its staff reach on their personal devices, the organisation is the controller, and the duties that the PDPL places on the controller apply to the organisation in that capacity. The fact that the employee owns the device does not change those duties, since Article 2 of the PDPL reaches processing by any means. The duty of confidentiality under Article 41 of the PDPL is wider in whom it binds, because it reaches the employee who carried out the processing as well as the organisation.

Deciding who inside the organisation sees what is a different matter. It is a disciplined practice that the organisation chooses, and the duties set out above do not prescribe it in that form.

A BYOD policy and the line between the organisation’s device and the employee’s

Article 65 of the Saudi Labor Law (نظام العمل) lists duties of the worker in addition to those set by the Labor Law, its regulations and the decisions issued under it. Among them, Article 65 of the Labor Law requires the worker to take sufficient care of the machinery, tools, equipment and raw materials owned by the employer that are placed at the worker’s disposal or are in the worker’s custody, and to return unused materials to the employer. That duty is defined by the employer’s ownership of the item. It describes assets held in the worker’s custody (أصول العهدة), not a personal device.

Article 65 of the Labor Law also carries a second duty that does not concern the device at all. The worker must preserve the technical, commercial and industrial secrets of the materials they produce or contribute to producing, directly or indirectly, and all professional secrets relating to the work or the establishment whose disclosure would harm the employer’s interest. That duty binds the worker as a worker, whichever device the work is done on. The qualifier on harm to the employer’s interest is part of the text of Article 65 of the Labor Law, and the duty is examined in more detail under trade secret.

The provisions relied on are those of the Saudi Labor Law as published by the Ministry of Human Resources and Social Development, namely Article 65 of the Labor Law (the duty of care over items owned by the employer and the duty to preserve secrets). Royal Decree M/44 of 8/2/1446H amended articles of the Labor Law. That decree did not amend Article 65 of the Labor Law. The provisions of the Personal Data Protection Law relied on, as published by the Saudi Data and Artificial Intelligence Authority (SDAIA), are Article 1 (personal data and the controller), Article 2 (scope), Article 10 (processing within the purpose of collection), Article 11 (purpose, the minimum necessary, and destruction once no longer necessary), Article 18 (destruction and retention), Article 19 (protective measures) and Article 41 (confidentiality after the relationship ends).

Where a BYOD policy is written

The natural place for a BYOD policy is the employee handbook (دليل الموظف), the internal document that brings together the organisation’s policies, among them those on the use of its devices and its data. The parts of the policy that concern expected conduct, such as confidentiality and the handling of customer data, belong in the code of conduct (مدونة السلوك الوظيفي). The employee’s acknowledgement of receiving the policy is kept in the employee file, because the question raised later is whether the employee knew.

Why the question of a BYOD policy arises now

Hybrid work (العمل المختلط) arrangements have moved part of the work away from the workplace, so a personal device can become an established fact in an organisation before any policy exists for it. An organisation that has not written a BYOD policy has not prevented the use of personal devices. It has left that use without conditions, which is the worse of the two outcomes.

The exit point in a BYOD policy

The hardest part of the arrangement is its end. Closing digital access is an item in exit clearance (إخلاء الطرف), and on the organisation’s accounts and systems it is straightforward. Files copied onto a device the organisation does not own cannot be closed off by a procedure in the same way. For that reason the method for removing them is set out in the BYOD policy from the first day, not on the day the employee leaves.

This is an explanation of the concept and of the statutory provisions cited, not legal advice.