Direct Answer
A company device policy is a short written agreement that covers which devices employees receive, confirms they remain company property, and sets out whether private use is allowed, who pays for damage, how quickly a loss must be reported and what has to come back on the last working day. SMBs should keep it to two or three pages and write separate rules for personal devices, because on those the company may only remove company data. In Germany, any device monitoring also needs to be agreed with the works council. deeploi, the All-in-One IT Management Platform for SMBs with or without an in-house IT team, makes the policy enforceable with a live device inventory, remote lock and wipe, and automated offboarding.
Key Takeaways
A device policy records who owns the hardware, what private use is allowed, who pays for damage, how loss gets reported, and what comes back on the last working day.
Most SMBs skip it because nobody formally owns IT, so the rules only get written after something has already gone wrong.
Personal devices need their own section, because the company's right to wipe is limited to company data.
In Germany, device monitoring and usage logging can require works council approval, and personal data on devices falls under GDPR.
The free template at the end covers scope, handover, private use, loss, BYOD and return, with a handover record both sides sign.
Most SMBs hand over a laptop with a quick "look after it" and nothing in writing. That works fine until a screen cracks, a phone disappears on a train, or someone leaves and their MacBook stays in their hallway. A written company device policy settles those questions before they turn into awkward conversations. Below are the rules the policy needs, plus a free template your team can sign.
What should a company device policy include?
A solid policy answers six questions: which devices are covered, who owns them, what private use is permitted, who carries the cost of damage, how loss gets reported, and what happens at the end. Keep it to two or three pages, because short policies get read, and only a policy people have read changes how they handle their devices.
Scope and ownership
Start by listing what counts as a company device: laptops, phones, tablets, monitors, docks, headsets and anything else you issue. State plainly that these items stay company property and are provided for work. Then name who the policy applies to, including working students, interns and freelancers who get hardware from you.
This section is also where a clean inventory earns its keep. If you can't say which serial number sits with which person, you can't enforce anything. Our guide to the IT asset lifecycle walks through how that record stays current, and our practical guide to managing laptops covers the day-to-day side. If you’d rather see how an automated device inventory works in practice, book a demo with deeploi.
{{cta}}
Device handover and employee sign-off
Every handover should produce a short record: device model, serial number, accessories, date, and two signatures. It takes two minutes and it removes all doubt later about what the person actually received.
Sign-off matters most when things go sideways. Without it, you're relying on memory to prove a dock or second monitor was ever issued. A documented equipment handover process turns that into a simple paper trail.
Permitted private use and care responsibilities
Decide whether private use is allowed, then write the decision down. Many SMBs permit moderate private use, which is friendly and realistic, but it needs limits: no family members using the device, no installing software outside the approved list, no storing private data you'd later have to work around during a wipe.
Spell out liability too. Normal wear is on the company. Damage from clear carelessness, such as a laptop left on a car roof, can be shared, within what German employment law allows. Mention who to contact for repairs and whether a device is insured, since the math behind extended warranty for business laptops changes what employees owe. A line about software is worth adding as well, especially around unapproved AI tools at work.
Loss and theft reporting
Give people a deadline and a name. Something like: report loss or theft to [policy owner] within four hours, by phone if email isn’t possible. Fast reporting is what makes a remote lock useful instead of symbolic.
Written guidance on this point is still far from standard. In the UK government's 2025/2026 breaches survey, half of small businesses had written guidance on whom to notify about a cybersecurity incident (UK Department for Science, Innovation and Technology and Home Office). The other half had no written answer on whom to notify when something goes wrong.
The rule only holds if someone can act on it. That means a current device list and the ability to lock or wipe remotely. deeploi, the All-in-One IT Management Platform for SMBs with or without an in-house IT team, covers both: central device management for macOS, Windows, iOS and Android, an IT inventory that keeps the record for every enrolled device current automatically, and IT experts on hand when a device goes missing.
BYOD limits
Company data is already on personal devices, whether you planned for it or not. In a 2024 survey commissioned by 1Password, 56% of employees said they had worked on a personal device in the previous year (1Password).
So set conditions. Say which access is allowed (browser only, or specific apps), require a screen lock and a supported operating system version, and state clearly that the company may remove company data from the device but never wipes the device itself. If you're still weighing the models, our comparison of BYOD versus company devices covers the cost side. Encryption, password and access rules belong in a separate document: use our IT security policy template for those.
How does the policy connect to offboarding and device returns?
The return clause is the part SMBs regret skipping. Write down the deadline (typically the last working day), the expected condition, who pays for shipping if the person works remotely, and what happens if nothing arrives.
Access removal belongs in the same clause. Accounts get blocked, licenses come back, company data gets removed from the device before it goes to the next team member. A written rule makes the exit predictable instead of a last-minute scramble, and our IT offboarding checklist breaks the steps down.
Policy and practice still drift apart when every step is manual. With automated offboarding, a leaving date in a connected HR system starts the process. The IT owner decides what happens and when: sign-in blocked or the account suspended, SaaS accounts deactivated, the device locked remotely and its return tracked, and a separate cleanup date for final deletion.
What legal and works council rules apply in Germany?
Two points deserve attention before you publish anything. First, if you have a works council, measures that allow monitoring of employee behavior or performance, including usage logging on devices, generally require their involvement. Agreeing the policy early is faster than renegotiating it later.
Second, GDPR applies to any personal data on the device. That shapes how much you log, how long you keep it, and how you handle a wipe when private files may be mixed in. Permitting private use raises the bar on this point, which is one reason some companies keep work devices strictly professional.
How do you roll out a device policy?
Draft the policy with the template below and adapt the placeholders. Name a policy owner: in most SMBs, that’s the HR lead, office manager or a founder.
Have legal counsel review it if private use or liability is involved.
Agree it with the works council, where one exists.
Add signing to your employee onboarding checklist so it happens before the device is handed over, which fits neatly into a structured IT onboarding flow.
Review it once a year, or whenever your device setup changes.
Free template: company device usage agreement
Copy the clauses below into your own document and fill the placeholders.
Scope and ownership: "[Company name] provides [employee name] with the devices and accessories listed in the handover record. All items remain the property of [Company name] and are provided for work purposes."
Private use: "Moderate private use is [permitted / not permitted]. Use by third parties, including family members, is not permitted."
Care and liability: "The employee handles the device with reasonable care. Normal wear is covered by [Company name]. Repairs are arranged through [policy owner]."
Loss and theft: “Loss, theft or damage must be reported to [policy owner] within [reporting window, e.g. four hours].”
Personal devices: "Company data may be accessed from a personal device only under [conditions]. [Company name] may remove company data from that device at any time."
Return: "All devices and accessories are returned by [return deadline], in working condition, with all company data intact for transfer."
Handover record: device type and model, serial number, accessories included, handover date, employee signature, company signature. Keep one copy in the personnel file and one with the device record.
{{cta}}
FAQ
Do we need a policy if we already use an MDM solution?
Yes. Device management enforces technical controls like encryption and remote wipe. The policy covers the human agreement: ownership, permitted use, liability and return obligations. One without the other leaves a gap.
Can one template cover both company devices and BYOD?
Keep them separate. The obligations differ, and so do your rights. On a company device you can wipe everything; on a personal one you may only remove company data.
Who should sign the device usage agreement?
Everyone who receives or uses a company device, including working students and freelancers. Sign it during onboarding, before the hardware changes hands.
Where to go from here
A written device policy protects the company and, just as importantly, gives your team clear answers about what they can and can't do with their laptop. Adapt the template above this week, pair it with your IT security policy, and make signing part of every onboarding from now on. If you want device tracking, remote lock and returns handled for you, book a demo with deeploi.
