Employers may manage and secure company phones, but they may not keep the people using them under constant watch. Device inventory, security policies, updates, and locating or wiping a lost device are allowed. Constant location tracking, reading private messages and covert spy apps are off limits. The easiest way to stay on the right side of that line is a properly configured MDM, for example through a Device as a Service provider like Everphone.
The question usually comes up in one of two situations: first, when IT introduces new mobile device management software and the works council starts asking questions. Or second, when a phone goes missing and someone wants to know "where it is right now".
In both cases, the same distinction helps: are you controlling the device or the person?
Our position is clear. Company phone setups have to be legally sound. Monitoring users around the clock is not advisable in any way. Employees would never accept it either. This article is not legal advice. It focuses on German and EU law and shows you where the limits currently lie.
Device as a Service is designed so that company devices actually get used – otherwise the whole exercise would be pointless. On top of that, Everphone company phones are meant to be usable for private purposes as standard. That is more sustainable and a good benefit for the company issuing them. Both only work if employees accept the devices and don't leave them gathering dust in a drawer.
What is the legal basis for company phone monitoring?
Every check on a company phone processes personal data. That means it needs a legal basis under the GDPR, a clear purpose, and it has to be proportionate. You'll find more on this in our MDM whitepaper.
The German Federal Data Protection Act
For a long time, Section 26 of the German Federal Data Protection Act (BDSG) was the key provision. That changed with the ruling of the Court of Justice of the EU of March 30, 2023 (C-34/21). The court decided that national rules on employee data protection must be disregarded if they merely repeat the GDPR. The data protection authority of the German state of Hesse explicitly applies this to the equivalent rule in Section 26(1) BDSG.
Performance of the employment contract and legitimate interest
In practice, employers therefore base processing directly on Art. 6 GDPR, above all on the performance of the employment contract or a legitimate interest.
Works agreements
The second solid basis is a works agreement, a binding agreement between management and the works council. For you, this means every measure has to be justified on its own. "We're allowed to because it's our device" is not enough.
The works council has a say as soon as technology can monitor
If your company has a works council – an elected employee body that German law gives co-determination rights – it has a say when MDM, location or monitoring software is introduced. The basis is Section 87(1) no. 6 of the Works Constitution Act (BetrVG): technical equipment capable of monitoring employees' behaviour or performance.
The Federal Labour Court interprets this broadly. It is enough that the software is objectively suitable for monitoring. Whether you intend to use it that way makes no difference. An MDM with a location feature is covered, even if the feature stays switched off.
An example: a company with 300 employees rolls out 250 iPhones with a new MDM. The works council finds out from the company-wide email. It can demand that the rollout stop until an agreement is in place. So plan the works agreement before the rollout, not after.
If you need help with this: Everphone offers managed services for MDM that support you in selecting and implementing your MDM solution.
https://youtu.be/yWr9f7O2d8s?si=lGidj_dPhQJhZZOj
What employers may and may not check on a company phone
The line runs between device management and monitoring behaviour. The table below sums up the position set by data protection authorities and courts.
| Measure | Allowed? | Condition |
|---|---|---|
| Device inventory (model, serial number, operating system) | Yes | Purpose is asset management, employees informed |
| Security policies (PIN, encryption, updates) | Yes | Part of IT security, documented in the MDM |
| Installing and removing work apps | Yes | Only in the work area of the device |
| Locating a lost or stolen device | Yes | For a specific reason, not permanently |
| Remote wipe after loss or when someone leaves | Yes | Announced in advance, private area kept separate where possible |
| Constant tracking, movement profiles | No, in principle | Exceptions only for a specific business purpose, strictly limited |
| Tracking outside working hours | No | Not even when private use is allowed |
| Viewing private messages, photos, browsing history | No | No legitimate purpose |
| Keyloggers, covert screenshots | No | Only with specific suspicion of a criminal offence, then strictly limited |
Two points from the table deserve an explanation, because they go wrong most often.
Location tracking: yes after a loss, no as a permanent state
The data protection authority of Rhineland-Palatinate puts it unambiguously: location systems that can be used to monitor employees permanently are inadmissible in principle.
Consent doesn't fix this, because in an employment relationship it isn't given freely when monitoring is comprehensive. Tracking during permitted private use is also inadmissible.
The technology supports this limit. A supervised iPhone can only be located via MDM once IT puts it into Managed Lost Mode. The device is then locked. When IT ends the mode, the user is told that their location was requested. It can't be done secretly.
Reading content: what is private stays private
Employers may not view private chats, photos or browsing history. That applies even when the company owns the device.
How strictly courts take this is shown by the Federal Labour Court's keylogger ruling of July 27, 2017 (2 AZR 681/16). An employer had recorded every keystroke without any specific suspicion. It was not allowed to use what it found in the unfair dismissal case.
Private use allowed? Then email gets tricky
If you allow private use, an old dispute comes up: are you then bound by telecommunications secrecy, like a telecoms provider? If so, you would practically never be allowed to access private communication over company services.
The answer is contested. In 2016, the German Data Protection Conference, the joint body of Germany's data protection authorities, still assumed that telecommunications secrecy applies. The authority in North Rhine-Westphalia has taken a different view since its 2024 report. Even then, you still need a legal basis under the GDPR for every access.
The pragmatic solution separates technically rather than legally. An Android work profile splits the device into two areas. IT manages the work area and cannot see private apps, data or usage.
On iPhones, Apple limits the MDM interface itself: IT cannot view messages, emails or browsing history through it. Put the rules for private use in writing as well, for example in a work phone private use agreement.
What covert or excessive monitoring can lead to
Anyone who monitors company phones covertly or without a legal basis risks more than a bad atmosphere. The consequences hit the company on three levels.
First, employment law: findings from inadmissible monitoring may be unusable in court, as in the keylogger case. A dismissal built on them then fails.
Second, data protection law: supervisory authorities can impose fines under Art. 83 GDPR, and those affected can claim damages under Art. 82 GDPR.
Third, internal operations: without a works agreement, the works council can have use of the software prohibited. That affects every device, not just the one the dispute was about.
How to set up company phone controls the legally sound way
Most conflicts arise because the technology comes first and the rules come later. Reverse the order.
- Define the purpose. Write down which data you need for what, such as asset management, security and lost devices. Anything that doesn't serve a purpose gets switched off in the MDM.
- Decide on private use. Allowed or prohibited, but not "tolerated". Tolerating it creates the murkiest legal situation.
- Involve the works council early. The works agreement covers purpose, scope of data, access rights and deletion periods.
- Separate devices technically. On Android with a work profile, on iPhones with clear MDM policies, so the private area never becomes visible in the first place.
- Inform people transparently. Under Art. 13 GDPR, employees learn which data the MDM collects and who can see it.
- Treat location tracking and remote wipe as a process. Who may trigger them, in which cases, and how is it documented?
With Everphone, the MDM is included in the rental. We set it up so that security policies take effect and the private area stays separate.
For more on bringing MDM and the GDPR together, read our article on MDM and the GDPR.
Who needs strict controls – and who doesn't
Most companies don't need monitoring, they need device management. Inventory, updates, encryption and remote wipe cover almost every security need. None of these measures watches what employees do.
Anything more only makes sense in narrow cases. One example is a logistics company that dispatches drivers by phone and needs their locations during shifts. Even then: only during working hours, only for dispatching, and with a works agreement.
If, on the other hand, you're considering constant tracking or app monitoring to check on performance: don't. The legal risk is high, the benefit small. And you lose your employees' trust along the way.
Frequently asked questions
Can an employer track a work phone?
Yes, but only for a specific reason, for example when the device has been lost or stolen. Constant tracking or movement profiles are inadmissible in principle, and so is tracking outside working hours. Employees must be informed in advance. If there is a works council, its consent is required.
Can an employer read WhatsApp messages on a company phone?
Not private messages, regardless of who owns the device. Employers may view work communication within narrow limits, for example to cover for an absent colleague or for archiving, if this has been agreed in advance. A separate work area helps technically, so private chats are never within reach.
Is employee consent enough to allow monitoring?
Usually not. In an employment relationship, consent is only valid if it is given freely. Where monitoring is a condition of doing the job, data protection authorities generally don't accept that it is. A works agreement or a legal basis under Art. 6 GDPR is more reliable.
Does the works council have to approve an MDM on company phones?
Yes. An MDM can technically collect data on usage and location, so it falls under Section 87(1) no. 6 of the German Works Constitution Act. Whether you plan to use these features is irrelevant. Without a works agreement, the works council can have the rollout stopped.
What happens if an employer monitors employees covertly?
Covert monitoring is almost always inadmissible. Findings from it are often unusable in court. On top of that, there is the risk of fines from the data protection authority and damages claims from those affected under the GDPR.