Question 1

Can my client require an employee to hand over their personal phone?

Accepted Answer

Framed as the handset: rarely, and unwisely. Framed as the work data: usually, via control, contract and reasonable instruction: delivered through the protocol route that takes the data without the device-as-such: Example 1's construction. The distinction is the whole game: demands drafted around data and protocol succeed; demands drafted around the object generate resistance and claims. And where the employee still refuses, §4's ladder and the inference record answer it.

Question 2

Is Whats App on a director's personal phone within the company's control?

Accepted Answer

For work threads, commonly yes: directors' duties, service agreements and the practical-ability limb make the company's case strong, and the courts have repeatedly proceeded on that footing in commercial disputes: the disclosure statement should address it expressly. The personal threads around them are not: which is why the collection answer is always the targeted protocol, never the full image to the company's advisers.

Question 3

What if the custodian's phone also holds another employer's confidential data?

Accepted Answer

A real and growing wrinkle: consultants and portfolio executives carry several employers per handset. The protocol handles it: app and participant scoping confines the take; the examiner-intermediary keeps third-party confidential material from the instructing party; and where a specific conflict is known, the protocol names it and the filters exclude it. The alternative: wholesale collection into a rival's solicitors: is the breach every on e spends the rest of the case regretting.

Question 4

Our custodian left the company last year and will not cooperate. Options?

Accepted Answer

In order: the corporate copy (what synced before exit: tenancy, MDM container, backups); surviving contractual duties invoked in correspondence; the counterpart layer (the threads' other ends, per guides 63-65); third-party disclosure against the leaver if the material justifies it; and the refusal chronology feeding inference against whoever benefits from the gap. Prospectively: the exit protocol of §7 is the answer, adopted this quarter, so the next leaver's phone is collected before the badge comes back.

Question 5

Does GDPR prevent BYOD collection?

Accepted Answer

No: it disciplines it. Legal-claims necessity and legitimate interests provide lawful bases; minimisation demands the targeting this guide teaches anyway; transparency is delivered by the protocol documents; and the household's data is protected by filter in g that never lets it reach the parties. Collections fail GDPR analysis when they are indiscriminate: which is also when they fail proportionality, custodian relations and judicial patience: the law and the craft point the same way.

Question 6

What should a BYOD policy say to make disclosure workable?

Accepted Answer

Five clauses: consent to targeted forensic collection under an independent-examiner protocol when legally required; cooperation with preservation instructions including suspension of deletion settings; exit protocol: work data collected, sync revoked, state documented before departure; MDM or work-profile enrolment where the role justifies it; and transparency about all of it, because consents extracted obscurely fail when tested. An after no on of drafting against this list converts BYOD from a litigation hazard into an administered estate: the cheapest disclosure improvement most companies can buy. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

BYOD And Disclosure