What stops a client email ending up in WhatsApp?

Your staff have work email on their own phones. That’s usually a sensible arrangement – right up until you ask what happens to the company data sitting on a device you don’t own.

“We’re going to let people use their own phones. Cheaper, more flexible, staff prefer it.”

Fine. And what stops company data leaving those phones?

“We trust our staff.”

That wasn’t the question.

It’s the exchange that happens in a lot of businesses, and it isn’t a stupid answer — it’s just an answer to a different question. Trust is about whether someone would do something deliberately. The question is what happens by accident, or on the day somebody’s circumstances change.

What’s actually true right now

On an ordinary personal phone with a work account signed in, and nothing else configured:

Someone can copy a confidential client email and paste it into WhatsApp. They can save a company file to their camera roll, from where it backs up to their personal cloud account. They can forward a document to their personal email to work on at the weekend. None of that is blocked, because none of it has been configured to be blocked.

That’s not an oversight by whoever set it up. It’s the default. Microsoft 365 arrives permissive, and unless somebody deliberately changed it, it stayed that way.

So if the honest answer to “what stops this?” is “our staff wouldn’t”, you don’t have a policy. You have a hope.

Why nobody has fixed it

Because most businesses believe there are only two options, and both are unattractive.

The first is to take control of the phones — install management software on your staff’s personal devices so the company can enforce settings and wipe them. People hate this, and they’re right to. It’s their phone, their photos, their messages, their bank apps. It causes arguments, HR gets involved, and some businesses have quietly abandoned the whole idea after the first round of complaints.

The second is to do nothing and hope.

Faced with those two, most firms pick the second. Which is why this problem is so common.

There is a third option

You can control the company’s data without controlling the phone.

The work apps — Outlook, Teams, the Office apps — get a boundary drawn around them. Inside that boundary, company data behaves how you’d want: it can move between work apps, and it can’t move out to personal ones. Outside the boundary, the phone is completely untouched. Nobody installs anything that can see personal photos, personal messages, or anything else.

In practice that means four things. Company data can’t be pasted into personal apps. Company files can’t be saved to the camera roll or backed up to a personal cloud account. Work apps can require their own PIN, so an unlocked phone left on a kitchen table doesn’t open your client correspondence. And a browser can’t be used to get around it.

The bit that matters most

Someone resigns on Friday.

Under the arrangement most businesses currently have, the company data on their personal phone stays there, indefinitely, and there is nothing you can do about it — because you can’t wipe a device you don’t own and never managed.

Under this arrangement, you remove the company data and only the company data. Their photos, their messages, their apps, their personal accounts are all untouched. They keep their phone exactly as it was, minus the work content.

That’s a materially different conversation to have with a departing salesperson, and it costs nothing to be able to have it — this is already included in Microsoft 365 Business Premium and the E3 licences, which is what most businesses of any size are already paying for.

Three questions to ask

1. Right now, can someone copy a client email from their work account into WhatsApp on their own phone? Ask for it to be tested rather than assumed. It takes two minutes.
2. When somebody leaves, what happens to the company data on their personal phone? If the answer is “nothing” or “we ask them to delete it”, that’s worth knowing before the next resignation rather than after.
3. Is this already covered by the licences we hold? For most businesses it is, which makes the only real cost an afternoon of somebody’s time.

Our founder configures this from scratch and demonstrates the result on an ordinary personal iPhone — the right thing to send whoever looks after your Microsoft 365.

The free Business Risk Audit asks what would happen if a salesperson left for a competitor. Four minutes, no jargon.