Remote work and BYOD – what should the employer regulate?

Short answer: Remote work and BYOD should be clearly regulated because matters regarding the work environment, working hours, information security, costs, and personal data otherwise easily fall through the cracks. A remote work agreement or policy should outline both practical terms and the boundaries of liability.

Responsibility for the work environment follows the employee home

Systematic work environment management also includes remote work. Employers therefore need to establish procedures for how ergonomics, workload, recovery, and the social work environment are followed up when work is performed at another location.

What should a remote work arrangement regulate?

• which days or situations remote work is permitted
• which workplace may be used
• availability and working hours
• equipment, support, and cost responsibility
• information security and confidentiality
• handling of personal data
• work environment and reporting of problems
• the possibility to change or revoke the remote work arrangement

BYOD – private equipment at work

Bring Your Own Device can be practical but creates specific risks. Employers should define which devices may be used, minimum requirements for operating systems and security, requirements for screen locks and encryption, handling in case of loss, and how company data is separated from private data.

GDPR and monitoring

Security tools, MDM, and logging can involve the processing of employee personal data. Employers therefore need to assess the legal basis, information provision, proportionality, and access. A security interest does not grant an unlimited right to monitor private use.

Information security in practice

Home networks, shared computers, printing, and working in public places can create risks. The policy should therefore regulate VPN, storage, local copies, USB drives, private cloud services, privacy screens, printing, and how incidents are reported.

Co-determination and collective agreements

Major changes to work organization or terms may trigger negotiations under the Co-Determination Act (MBL), and collective agreements may contain additional rules. Employers should therefore check the employment law process before a new policy is introduced widely.

Common mistakes

• treating remote work as an informal benefit without clear terms
• lacking rules for what happens when employment ends
• allowing private equipment without the ability to erase company data
• not performing a risk assessment of the work environment
• collecting more monitoring data than is necessary

See Mallbutiken's template package for remote work, hybrid work, and BYOD.

FAQ

Do employees have the right to work from home?

There is no general right to remote work. What applies depends on, among other things, the employment contract, the employer's decision, and any collective agreements.

Can the employer require MDM on a private phone?

It may be possible in certain arrangements, but the requirements must be clear, proportionate, and consistent with data protection and employment law. Many organizations therefore choose to limit BYOD or provide company devices.

Are both a policy and an individual agreement needed?

A general policy can describe overall rules, while an individual agreement can regulate the employee's specific remote work arrangement.

The article provides general information and does not replace legal advice.