What to do if…
your employer asks to search your personal phone or laptop for a workplace investigation
Short answer
Pause and ask for the request in writing before giving access. Offer to cooperate through a narrow method that provides only the work-related material they say they need, rather than handing over your whole personal device unlocked.
Do not do these things
- Do not hand over your device unlocked on the spot without written scope, a reason, and time to read any form they want you to sign.
- Do not delete, edit, hide, factory-reset, or “clean up” anything on the device; it can look like tampering even if you only mean to protect your privacy.
- Do not sign wording that gives open-ended access to everything on the device.
- Do not give your passcode to several people or leave the device unattended without asking who will access it and how it will be logged.
- Do not use the personal device to debate the allegation over calls or messages if you think the device may be requested again.
What to do now
-
Ask for the request in writing right away. Ask them to confirm:
- exactly which device, apps, accounts, files, messages, or date range they want
- what workplace issue or allegation the request relates to
- who will access the material, such as HR, IT, managers, or an external investigator
- the method, such as view-only review, targeted export, search terms, copying selected files, or full-device imaging
- how long any copied material will be kept and when the device will be returned if they want to hold it
-
Say you are willing to cooperate, but ask for a narrower method. Possible narrower options are:
- exporting only the relevant work messages or emails for named dates
- letting them obtain employer-system records from work email, Teams, Slack, or another work platform instead of your phone
- giving supervised access only to a managed work profile, work container, or work app
- using agreed search terms and date limits, with personal results excluded or redacted where possible
-
Ask how they will handle your personal data before you agree to any access. Ask in writing how they will minimise access to private material, keep any copied data secure, limit who sees it, and delete or return it when no longer needed. If the device contains highly private material, say that it contains sensitive personal content and ask for a work-app-only collection, search-term limits, or an independent reviewer or redaction process.
-
Check what you already agreed to. Look at your contract, staff handbook, BYOD policy, acceptable use policy, and any mobile device management terms you accepted. Note any clause about investigations, monitoring, access to work apps, remote wipe, or work information on personal devices.
-
Ask to have someone with you.
- For an investigation meeting, there is generally no legal right to be accompanied, but employers may allow it as good practice. Ask for a union representative or colleague to be present for any device review or questioning.
- For a disciplinary hearing that may give or confirm a formal warning or other disciplinary action, ask to use your right to be accompanied by a colleague, trade union representative, or trade union official.
-
If they want to take the device away, ask for safeguards first. Ask for:
- a written receipt with the make, model, serial number if available, who will hold it, and expected return time
- written confirmation of whether they will copy the whole device or collect only specified work material
- supervised time to protect immediate essentials, such as noting key contact numbers or arranging access to authentication, without deleting, resetting, or changing work apps or investigation-relevant material
-
Create a paper trail. Write down the date and time of the request, who asked, what they asked for, what deadline they gave, and what you said. Keep copies of any emails, forms, policies, and written instructions.
-
If you are told to hand it over now or face suspension, slow it down safely. Calmly say you are not refusing to cooperate, but you need written scope and a privacy-protecting method. Offer a targeted work-data export or a scheduled limited review with IT or an external investigator as soon as possible.
What can wait
- You do not need to decide today whether to raise a grievance, resign, appeal, or start legal action.
- You do not need to give a detailed statement about the allegation before you know the allegation, scope, and process.
- You can consider later whether to make a subject access request for personal data your employer holds about you; that is not an emergency step.
Important reassurance
It is normal to feel invaded or panicked when someone asks for your personal phone or laptop. Asking for written scope and a narrower collection method is a reasonable way to protect your privacy while still showing that you are willing to cooperate.
Scope note
These are first steps only. Later decisions may need specialist help and will depend on your contract, workplace policies, the type of investigation, and how the device has been used for work.
Important note
This is general information, not legal, data protection, employment, technical, therapeutic, financial, or professional advice. If you are under immediate pressure to surrender your device or sign broad access wording, consider getting support from your union if you have one, or from independent employment or data protection advice, before you agree.
Additional Resources
- Acas — Step 4: Holding investigation meetings - Investigations at work
- Acas — Acas Code of Practice on disciplinary and grievance procedures
- GOV.UK — Disciplinary procedures and action against you at work: Disciplinary hearings
- Citizens Advice — Dealing with disciplinary action at work
- Information Commissioner's Office — Bring your own device – what should we consider?
- Information Commissioner's Office — Subject access request Q and As for employers
- Information Commissioner's Office — Employment information
About this guide
This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.