A Simple Company Phone Policy Template for Small Businesses

A company phone policy needs to answer six questions: who gets a device, what it is for, what is managed on it, what happens if it is lost, what happens when someone leaves, and who to ask. One page. Anything longer will not be read, and a policy nobody reads is not a policy.

Below is a template you can copy and change. It is written for a small business with company-owned Android phones, not for a corporation, and it is deliberately plain.

This is a practical template rather than legal advice. Employment law varies, so have someone qualified look at it before you issue it.

---

Company phone policy

Applies to: everyone issued a company-owned mobile phone or tablet. Last updated: [date] Questions: [name, email]

1. What the device is

The phone or tablet is company property, provided so you can do your job. It stays the property of [Company] and must be returned when you leave or when asked.

2. What it is for

The device is for work. Reasonable personal use is fine: calls home, a map, music on the road. Do not store anything personal on it that you would not want to lose, because a wiped device loses everything on it.

Do not use the device for anything illegal, for another business, or in a way that could embarrass or expose [Company].

3. How it is managed

The device is centrally managed. That means:

• A screen lock is required and enforced.
• Device storage is encrypted.
• Apps are installed from an approved list. You can request additions.
• Security updates are applied on a schedule.
• If the device is lost or stolen, we can lock it, display a message on the screen, see where it last reported, and erase it.

What we do not do. We do not read your messages, emails, or WhatsApp. We do not log calls or record them. We do not record keystrokes, capture screens, or collect browsing history. We do not track your location during normal use. Location is reported only while a device is in lost mode, and while that is active the device is locked and says so on screen.

Every administrator action is recorded in an audit log that cannot be edited.

4. Your responsibilities

• Keep the screen lock on and do not share the code.
• Report a lost or stolen device immediately. Immediately means within the hour, not at the end of the shift. You will not be in trouble for reporting it fast.
• Do not attempt to remove management, root the device, or install software from outside the approved store.
• Take reasonable care of the hardware. Accidents happen; leaving a phone on a van roof twice does not.

5. If a device is lost or stolen

Tell [name] as soon as you notice. We will lock the device and put a contact number on the screen. If it does not come back, or if it holds sensitive information, we will erase it.

If it was stolen, we will report it to the police and you may be asked for details.

6. When you leave

Return the device on your last working day, along with the case, charger and SIM.

Before your last day, save anything personal elsewhere. The device will be wiped before it is reissued, and a wipe removes everything on it.

If you have signed into a personal Google account on the device, remove it before handing it back.

7. Damage, loss and cost

[Choose one and delete the others. Check local employment law before using any wording that deducts from pay.]

• Normal wear, accidental damage and loss are covered by the company.
• The first replacement in any twelve-month period is covered; repeated losses will be discussed individually.
• [Your own wording.]

8. Acknowledgement

I have read and understood this policy.

Name: ………… Signature: ………… Date: …………

---

Notes on adapting it

Keep section three specific. The “what we do not do” list is the part that earns trust, and vague wording defeats it. Make sure it matches what your tooling actually does, because you will be held to it. Our security page is the equivalent list for NounDesk.

Be careful with section seven. Deducting the cost of a lost phone from wages is restricted or unlawful in many places. Get advice before you write anything that does.

Do not bury the reporting rule. The single most valuable sentence in the whole document is the one telling people they will not be in trouble for reporting a lost phone quickly. Most delays in an incident come from an employee hoping it will turn up.

Revisit it when the setup changes. If you add kiosk devices, or start issuing tablets, or change what is monitored, the policy needs to follow. A policy describing a configuration you no longer run is worse than none.

Two clauses people forget

Personal Google accounts. If someone signs into their own Google account on a company phone and then leaves without removing it, factory reset protection can lock the handset permanently. One line in the policy prevents an expensive paperweight. The mechanics are in our post on wiping a phone before reissuing it.

Tethering and data. If the device has a data plan, say whether hotspotting for personal devices is allowed. It is a small thing that causes surprising bill disputes.

What to do this week

1. Copy the template and fill in the brackets. Twenty minutes.
2. Check section three against your actual configuration. If your tool does something the policy says it does not, fix one of them.
3. Hand it out with the phones, not afterwards. Issuing a policy six months into a rollout looks like a reaction to something.

FAQ

Does a small business really need a written phone policy?

Once you have more than a couple of devices, yes. It is mostly not about enforcement; it is so that everyone has the same understanding of what happens when a phone is lost or someone leaves.

Should employees sign it?

Signing makes people read it, which is the real benefit. It is also useful to be able to show it was issued.

What if we allow personal phones too?

That needs separate wording, because most of this policy assumes the business owns the device. Do not apply company-owned rules to somebody’s personal handset.

How often should it be reviewed?

Once a year, or whenever the device setup changes materially.

A page that people read beats ten pages that sit in a folder. Start with this one and adapt it as your fleet grows.

See what NounDesk collects, or start a free trial to match the policy to a real configuration.