Bring Your Own Device (BYOD): What It Means for Employers

What it means in practice

What BYOD covers. NIST SP 800-46 Rev. 2, the federal guide to enterprise telework, remote access and BYOD security, groups personally owned employee laptops, smartphones and tablets with contractor and vendor devices as client devices "outside the organization's control." NIST SP 800-124 Rev. 2 places BYOD on a spectrum of deployment models: fully managed devices the organization issues; corporate-owned personally enabled (COPE) devices, which the organization owns but allows some personal use; and BYOD. BYOD is often part of a flexible workplace arrangement, but NIST notes it also covers personal devices used inside the office.

The federal wage baseline. The Fair Labor Standards Act has no general rule that employers pay for non-exempt employees' phones or data plans. The limit is the "free and clear" rule: wages count as paid only if paid "finally and unconditionally," and the wage requirements are not met if an employee "kicks back" part of the wage to the employer or for the employer's benefit, in cash or otherwise. The regulation's own example is tools of the trade: if the employer requires the employee to provide tools used in or specifically required for the employer's work, there is a violation "in any workweek when the cost of such tools purchased by the employee cuts into the minimum or overtime wages required" (29 CFR 531.35). Unpaid minimum wages and overtime carry an additional equal amount as liquidated damages (29 U.S.C. 216(b)). See minimum wage.

Phone stipends and the regular rate. Overtime is owed at one and one-half times the regular rate for hours over 40 in a workweek (29 U.S.C. 207(a)(1)). Reimbursements for expenses an employee incurs on the employer's behalf are excluded from the regular rate "if the amount of the reimbursement reasonably approximates the expense incurred," and the regulation lists "cell phone plans" among its examples (29 CFR 778.217(a) and (b)(1)). Two limits apply. If a "reimbursement" is "disproportionately large," the excess is included in the regular rate (778.217(c)(1)), and payments for expenses the employee normally incurs for personal benefit are not excluded (778.217(d)). See overtime.

After-hours messages as hours worked. Device ownership does not change the hours worked rules: work not requested but "suffered or permitted" is work time (29 CFR 785.11), the rule applies to work "away from the premises or the job site, or even at home" when the employer knows or has reason to believe it is being performed (785.12), and management "cannot sit back and accept the benefits without compensating for them." Merely issuing a rule against such work "is not enough" (785.13). WHD Fact Sheet #22 (revised July 2008) says such time must be paid. Insubstantial periods that cannot practically be recorded may be disregarded as de minimis, but only for "uncertain and indefinite periods of time" of a few seconds or minutes (29 CFR 785.47). For the broader rules, see hours worked and, for being reachable by phone, on call schedule.

Federal tax: employer-provided phones. IRS Notice 2011-72 says that when an employer provides a cell phone "primarily for noncompensatory business reasons," the IRS treats business use as a working condition fringe excludable from income, deems the substantiation requirements satisfied, and treats personal use as an excludable de minimis fringe. Substantial business reasons include reaching the employee at all times for work emergencies and client contact outside the office or normal workday. A phone provided to boost morale or goodwill, to attract a prospective employee or as extra pay does not qualify. Publication 15-B (2026) repeats these rules and says "cell phone" includes "other similar telecommunications equipment." See fringe benefits.

Federal tax: reimbursing a personal phone. Notice 2011-72 does not address reimbursements for business use of an employee's own phone. On the same day, September 14, 2011, the IRS issued an interim memo to its examiners (SBSE-04-0911-083). Where an employer requires employees to use personal phones for substantial noncompensatory business reasons and reimburses them, examiners "should not necessarily assert" that the reimbursement is extra income or wages. Conditions apply: the coverage must be reasonably related to business needs, the reimbursement must be reasonably calculated not to exceed actual expenses, and it must not substitute for regular wages. Unusual or excessive reimbursements get closer scrutiny. The memo shows an expiration date of September 19, 2012. Press release IR-2011-93 says the approach covers cash allowances and reimbursements common to small businesses. Its current status should be confirmed with the IRS or a tax adviser.

Accountable and nonaccountable plans. Under Publication 15 (2026) and 26 CFR 1.62-2, an arrangement is an accountable plan only if employees incurred allowable business expenses, substantiate them within a reasonable period, and return any excess. Accountable plan payments are not wages. Payments under a nonaccountable plan are wages, treated as supplemental wages and subject to income, Social Security, Medicare and FUTA taxes. That includes an amount paid whether or not the employer reasonably expects the employee to have business expenses, and an amount that would otherwise have been paid as wages. Publication 15 says timing is generally reasonable if expenses are accounted for within 60 days and any excess is returned within 120 days.

Security policy: what NIST recommends. NIST SP 800-46 Rev. 2 recommends a telework security policy that defines BYOD requirements, planned on the assumption that external environments "contain hostile threats" and that devices will be lost, stolen or infected. It suggests tiered access: organization-owned computers reach many resources, BYOD computers a limited set, and BYOD smartphones and tablets only "one or two lower-risk resources, such as webmail." Its example table limits a personnel system to organization-issued devices in the office because of the personal information it holds. For personal devices used in the office, it says to strongly consider a separate, external network. The FTC's small business sheet on secure remote access says devices should be secure "whether employees or vendors use company-issued devices or their own," and recommends encryption, antivirus software, a VPN on public Wi-Fi, multi-factor authentication and checking devices before they connect. CISA (updated April 2024) says to mandate multi-factor authentication "using technical controls, not faith." See also payroll security.

Management tools and employee privacy. NIST SP 800-124 Rev. 2 explains that mobile device management (MDM) enrolls the whole device, while mobile application management (MAM) controls only enterprise apps and does not require enrolling the device. For BYOD, it says MAM "may help address users' privacy concerns." It warns that management systems can collect sensitive information about an employee. Location tracking "should require user consent and a thorough description of what type of personal information the enterprise can access." It also observes that restrictive or intrusive policies can push staff toward shadow IT, such as forwarding work email to personal accounts.

Offboarding and lost devices. NIST SP 800-124 Rev. 2 describes remote wipe at two levels: a full-device wipe, typically for enterprise-owned devices, and an enterprise wipe that deletes only the settings, data and apps pushed for work, "typically" used for work data on an employee's personal device. MAM systems often tie remote wipe to employees who leave or change roles. NIST calls remote wipe "a fundamentally unreliable security control" on its own: an attacker can read data first or power the device off. See offboarding.

Where states differ: California (example). The California Labor Commissioner's deductions FAQ says an employee is entitled to reimbursement "for all expenses or losses incurred in the direct consequence of the discharge of the employee's work duties" (Labor Code 2802). The statute text in the Labor Commissioner's wage law compilation (Rev. October 2013) adds that court or Labor Commissioner awards carry interest from the date the expense was incurred, and that "necessary expenditures or losses" include reasonable costs, including attorney's fees to enforce the right. Unlike the FLSA floor, it applies even when wages stay above the minimum. See California labor laws.

Where states differ: Illinois (example). The Illinois Department of Labor announced that, effective January 1, 2019, Public Act 100-1094 amended the Wage Payment and Collection Act (820 ILCS 115). Employers must reimburse employees for "necessary expenditures or losses" incurred within the scope of employment and directly related to services performed for the employer. Employees must submit expenses within 30 days or within the employer's reimbursement policy. IDOL's summary also addresses employers that have their own reimbursement policy, so Illinois employers may want to read the statute's exact wording with counsel. The DOL lists other state labor offices.

Recordkeeping. FLSA payroll records must show hours worked each workday and each workweek, which includes compensable after-hours device work. They must also show the amount and nature of each payment excluded from the regular rate, such as expense reimbursements (29 CFR 516.2(a)(6) and (a)(7)). Payroll records and written plans under section 7(e) are kept at least 3 years (516.5), and basic time and earnings records and wage rate tables at least 2 years (516.6). Many employers put the BYOD policy in the employee handbook.

Questions employers ask. Does federal law require paying for an employee's phone? Not as a general rule. The FLSA is violated only when required, unreimbursed costs cut into minimum or overtime wages in a workweek (29 CFR 531.35); some states, such as California and Illinois, require reimbursement. Does a phone stipend raise the overtime rate? Not if it reasonably approximates the actual expense (29 CFR 778.217). Are quick after-hours emails paid time? Known work is hours worked, and only uncertain, indefinite periods of seconds or minutes may be disregarded (29 CFR 785.12 and 785.47). Can work data be removed from a departing employee's phone? NIST describes enterprise wipe for this situation, but it warns that remote wipe should be one layer of protection, not the only one.

Why it matters and common mistakes

How Remindax helps

Related terms

See all terms in Org Structure, Strategy & General HR or browse the full HR Glossary.