How to Stop Company Data Leaving Android Phones

To stop company data leaving Android phones, close the everyday exits: printing, memory cards and USB drives, screenshots, and copying files over a USB cable. On company-owned phones, each of these is a setting in the security policy. In NounDesk you switch them on per policy, or pick the Maximum Security template, which blocks them all at once.

Most leaks are not clever. They are a phone plugged into a home laptop, or a photo saved to a card. Here is how to close those doors, and what each setting does and does not stop.

The clinic phone with patient photos

A small dermatology clinic uses two Android phones to photograph skin conditions for patient records. The photos go into the clinic’s records app. That is the plan.

In practice, one nurse plugs the phone into her laptop at home to charge it, and the laptop offers to import photos. Another takes a screenshot of a patient record to send a quick question to a colleague. A third phone has an SD card in it from before, and the camera has been saving there.

None of these people meant any harm. Each one has still put patient data somewhere the clinic does not control.

Clinics feel this most, but it is the same story for a sales team’s customer list, an insurance broker’s policy documents, or a contractor’s site plans. If you run front desk tablets in a clinic, our post on clinic tablets and patient privacy covers the shared-device side of this.

The four exits, and the settings that close them

Each one is a plain setting in the Security card of a security policy.

Printing. Block it, and no app on the phone can print. Useful where paper copies should not exist. This one needs Android 9 or newer.

SD cards and USB drives. Block it, and the phone will not use memory cards or USB storage, so files cannot be copied onto them. If a phone already has a card in it, the files on that card cannot be opened on that phone once this is blocked.

Screenshots. Block it, and the phone cannot take screenshots or record the screen. Notification details are also hidden on the lock screen.

USB data transfer. This has three options:

• Allowed: files can be copied over a cable.
• File transfer blocked: a computer cannot copy files off the phone over a cable, but the phone still charges and works with accessories. This is the Standard Business default and a good everyday choice.
• All data transfer blocked: the cable only charges. This needs Android 12 or newer. On older phones, NounDesk blocks file transfer only.

Every setting in NounDesk shows the Android version it needs, so you know before you publish which phones a setting will reach.

Maximum Security turns them all on

If a team handles sensitive information, such as patient records, customer data or payment details, the Maximum Security template is the quick route. It blocks printing, SD cards and USB drives, screenshots, and all USB data transfer. It also blocks the camera, hotspots and Bluetooth file sharing, and requires a strong password.

That camera block is the catch for the clinic. Their phones exist to take photos. Templates are starting points, so the answer is to start from Maximum Security and turn the camera back on before publishing. Screenshots and the camera are separate settings, so you can block one and keep the other.

Different teams, different rules

Data protection lives in each security policy, so you do not have to choose one rule for the whole business. The clinical phones can be strict. The front desk tablet can still print appointment letters. Field staff can keep USB transfer if they need it to move job photos to the office PC.

The publish preview lists every change and how many devices it affects before anything goes live. If a change turns out to be wrong, the policy’s version history lets you restore the previous version in one click.

How to set it up in NounDesk

You need to be an Owner or Admin to change settings.

1. Go to Security policies and open the policy for the team, or create one from the Maximum Security template.
2. In the Security card, set Printing, SD cards and USB drives, Screenshots and USB data transfer to the options you want.
3. Select Save draft, then Publish…. Check the preview, which lists every change.

Phones pick up the change at their next check-in. The full table of settings and template defaults is in the data protection docs.

Honest limits

Blocking screenshots does not stop a photo of the screen. Someone with a second phone can still photograph what is on the display. The settings close the easy exits, not every exit.

Older phones get partial USB blocking. All data transfer blocked needs Android 12. On older phones, file transfer is blocked but the connection is not cut completely.

Printing needs Android 9. On older phones, the printing setting will not apply.

Company-owned phones only. These settings apply to company-owned Android phones and tablets enrolled in NounDesk. NounDesk does not manage personal phones or work profiles, so it cannot separate work and personal data on an employee’s own phone.

Apps can still share data. Blocking the four exits does not stop someone emailing a file from an app that allows it. Keeping Apps from outside Google Play blocked and controlling which apps are installed is the other half of the job.

What to do this week

1. List the phones that hold sensitive data. Patient photos, customer lists, payment details. Those are the ones to lock down first.
2. Check their Android versions. The device list shows them. Note any below Android 9 or Android 12, so you know which settings will fully apply.
3. Set USB data transfer to at least File transfer blocked on every policy. It costs nothing in daily use.
4. Use Maximum Security for the sensitive group, and turn back on anything the team genuinely needs, like the camera.
5. Remove old SD cards. Copy anything the business needs off them first, because the files cannot be opened on the phone once cards are blocked.
6. Add a line to your phone policy. Our company phone policy template has a section where it fits.

FAQ

How do I stop staff copying files from a company Android phone to a laptop?

Set USB data transfer to File transfer blocked or All data transfer blocked in the security policy. File transfer blocked stops copying over a cable on any supported phone, and All data transfer blocked needs Android 12 or newer.

Can I block screenshots on company phones?

Yes. Set Screenshots to Blocked in the security policy and phones on that policy cannot take screenshots or record the screen.

Does blocking SD cards delete what is already on them?

No, but the phone cannot open files on the card once SD cards are blocked. Copy anything you need off the card first.

What does the Maximum Security template block?

It blocks printing, SD cards and USB drives, screenshots and all USB data transfer, plus the camera, hotspots and Bluetooth file sharing. You can change any setting before you publish.

For the wider picture of running a small fleet, see our guide to Android MDM for small business and the data protection feature page.

If your team handles data that should stay on the phone, try NounDesk and close the everyday exits this week.