Key Takeaway: Regulators expect more than a standard Bring Your Own Device (BYOD) policy. Organizations must be able to prove that they are governing mobile and off-channel communications in practice. To do so, teams must establish approved channels, disable autodeletion where required, apply legal holds across devices and applications, train employees, and test controls before a preservation failure or regulatory inquiry exposes gaps.

As regulators continue to scrutinize off-channel communications, many organizations are updating their policies regarding Bring Your Own Device (BYOD), records retention, and business communications. Technology continues to change, and effective policy drafting requires an understanding of how modern mobile devices, messaging applications, cloud services, and mobile device management (MDM) technologies work in practice. Too often, organizations draft policies based on assumptions about technology rather than how people and systems create, store, synchronize, and preserve data. Resulting policies are difficult to enforce, nearly impossible to operationalize, or do not effectively support investigations, litigation, or regulatory inquiries.

BYOD Policies Must Address More Than Ownership

A common misconception is that a BYOD policy is primarily about allowing employees to use personal devices for work. In reality, the policy must define how the organization will preserve, access, and manage business information that resides on those devices.

Despite best efforts, personal devices cannot be fully governed by organizational security standards and therefore present elevated risks of data leakage, misuse, and preservation failures. As a result, many organizations rely on MDM controls, encryption, and acceptable use requirements to extend governance to business information residing on personally owned devices. 

A well-designed BYOD policy should answer critical questions:

• What business communications are permitted on personal devices, and through which applications?
• What retention requirements apply?
• What rights does the company have to access business communications?
• How will legal holds apply to personal devices?
• What technologies will be used to manage and preserve data?
• How will employee privacy concerns be balanced with compliance obligations?

These foundational considerations are the building blocks of a proactive BYOD policy.

DOJ Expectations Extend Beyond the Written Policy

Recent Department of Justice (DOJ) guidance reinforces that organizations should be prepared to explain how they govern business communications conducted through personal devices and third-party messaging platforms. The focus extends beyond whether a policy exists, and organizations may be expected to demonstrate how they preserve business communications, whether the company can access relevant communications when required, how they enforce retention expectations, and whether controls are in alignment with employee communication practices. A BYOD policy that does not account for how mobile technologies function in practice leaves significant gaps between written expectations and operational reality. significant gaps between written expectations and operational reality.

Mobile Data Is More Complex Than Most Policies Assume

Many compliance programs still treat mobile communications as if they function similarly to email, but mobile communications are more nuanced.

A business conversation may begin over native text messages on a personal phone, move to WhatsApp, transition to Teams, and include documents stored on the phone, in OneDrive, iCloud, or another cloud platform. Further complicating matters, not all visible data is actually stored on the phone; some messages may never be stored locally on the device, while others may be encrypted, synchronized across multiple devices, or automatically deleted based on application-specific settings. Understanding where data resides and how it is retained is a critical consideration when designing compliance policies.

The Growing Compliance Risk of Ephemeral Messaging

Ephemeral messaging continues to evolve and poses significant compliance challenges. Applications such as WhatsApp, Signal, Telegram, and others allow users to specify automatic deletion of messages after a defined period, and in some cases, any participant can control deletion settings in the thread regardless of the settings of the other participants. This creates an obvious conflict with regulatory retention obligations. Once data is deleted, recovery may be impossible. 

Consequently, preservation must occur before deletion rather than relying on recovery after the fact, and the ideal solution may be moving conversations to enterprise platforms with preservation safeguards. The use of unauthorized messaging platforms, disappearing messages, and off-channel communications is receiving increased attention and scrutiny from prosecutors and regulators. Organizations are not only being asked whether policies exist, but also whether and how they are communicated, monitored, and enforced in practice.

Technology Controls and Policies Must Work Together

Policy should be informed by the technologies that govern business communications. MDM tools, retention settings, and messaging application configurations directly affect preservation, access, and legal hold obligations. For example, MDM platforms can help organizations manage security settings, enforce encryption, and separate corporate and personal data. But organizations must understand how their MDM platform works in practice. This includes which applications it governs and how it impacts the user’s interactions with their device, including creating backups, downloading applications, password controls, and more.

Similarly, retention policies must account for application-specific settings and should provide instructional guidance on how to adjust settings to meet preservation expectations. Instructions should include guidance for disabling auto-deletion features in text messaging, WhatsApp, and other messaging applications as these settings can undermine preservation obligations. 

An effective compliance program therefore requires coordination among compliance, legal, information security, records management, and IT teams rather than treating mobile governance as something to address simply by implementing a generic standalone policy.

Steps To Strengthen Mobile Device Compliance

Organizations developing or revising BYOD and off-channel communications policies should consider several steps:

1. Maintain a clear list of approved communication platforms.
2. Define whether personal devices may be used for business communications and under what conditions.
3. Implement technical controls that support retention and preservation requirements.
4. Address ephemeral messaging directly rather than relying on broad acceptable use language.
5. Ensure legal hold processes explicitly cover personal devices and messaging applications.
6. Train employees on when and how to transition business communications from personal or unauthorized channels to approved enterprise platforms.
7. Periodically test and assess communication controls to ensure you can preserve, access, and retain business communications as required.

Strengthen Compliance Through Smarter Mobile Governance

Modern compliance policies require a clear understanding of how devices, cloud services, messaging platforms, retention settings, and MDM solutions interact. Successful compliance programs recognize that technology should inform policy. Organizations need to understand how mobile data is created, stored, managed, and retained. Clear, enforceable policies enable them to meet regulatory expectations while reducing the risks of BYOD and off-channel communications.

Learn more about Epiq Compliance Advisory and Technology.

Devon Avallone-Graves, Director, Global Investigations, Strategic Data Advisory

Devon establishes and operates defensible, efficient forensic collection workflows that enable corporate legal departments and law firms to meet regulatory and compliance obligations during government investigations, antitrust matters, white collar litigation, and internal reviews.

As a licensed lawyer, Devon combines legal knowledge with forensic expertise to assist clients in high‑stakes matters.