Bring-your-own-device is the reality in most Indian companies whether or not it was ever decided deliberately — an employee simply adds their work email to their personal phone, and from that moment, company data lives on a device IT has no control over, no visibility into, and no ability to wipe if the phone is lost or the employee leaves under difficult circumstances.
Mobile device management doesn't require taking full control of a personal device, and asking to do so is precisely what makes BYOD programmes fail — employees resist enrolling a personal phone into a system that can, in principle, wipe their family photos along with company data. The workable middle ground is a containerised approach: work email, documents and apps live inside a managed, encrypted container on the device, separate from personal data, and IT's control extends only to that container, not the whole phone.
The policy conversation that actually matters is what happens when someone leaves the company, because this is where BYOD programmes without a clear plan create real problems. A containerised MDM setup lets IT remove the work container remotely without touching anything personal, which is a considerably cleaner offboarding step than the alternative of asking a departing employee to manually delete company data from their own device and trusting that they did.
For companies with genuinely sensitive data — financial services, healthcare, anything under the sectoral regulations covered elsewhere on this site — BYOD may not be an appropriate policy at all for roles touching that data, regardless of how well the MDM containerisation works technically. Deciding which roles get company-issued devices and which can use personal devices under MDM should follow from what data the role actually touches, not from a blanket policy applied uniformly across every function.
