Is Device as a Service GDPR compliant? Yes, with the right contract

Device as a Service is GDPR compliant if three things are in place: a data processing agreement under Art. 28 GDPR, an open list of subprocessors and verifiable data deletion every time a device is returned. Your company remains responsible for the data. A Device as a Service provider like Everphone processes it on your behalf.

The question usually comes from the data protection team or legal, just before the contract is due to be signed. Someone else's devices, an external service provider, employee data: it sounds like a risk.

Our view: rented devices are often cleaner from a data protection perspective than purchased ones. The reason is unspectacular. With rental, the return is a defined process with deletion and proof. Old purchased devices, by contrast, tend to end up in a drawer, unwiped and forgotten. But that only holds if the contract says so.

Who is responsible for data protection with Device as a Service

Your company remains the controller within the meaning of Art. 4(7) GDPR. For all data it processes on your behalf, the DaaS provider is a processor under Art. 4(8) and Art. 28 GDPR. It may only use that data on your instructions.

That sounds abstract, but it becomes concrete once you look at where personal data arises in day-to-day device operations:

The last row is the most sensitive. A company phone holds emails, contacts, chats and photos. Whoever takes it back has access to all of that, at least for a moment.

For your company's contract and billing data, incidentally, the provider acts as a controller in its own right, not on your behalf. That's normal and doesn't need a separate agreement.

What a data processing agreement for rental devices must cover

Without a data processing agreement (DPA), the collaboration is not GDPR compliant. Art. 28(3) GDPR sets out the minimum content. For Device as a Service, five points matter most.

1. Instructions and purpose: the provider only uses your employees' data for shipping, support and returns, not for its own analysis or advertising.
2. Technical and organisational measures under Art. 32 GDPR: encryption, access rights, logging. An ISO 27001 certificate is good evidence here, but it doesn't replace a concrete description.
3. Subprocessors: logistics, MDM platform, repair, erasure software. You need to know who they are and be able to object to new partners.
4. Deletion or return after the contract ends (Art. 28(3)(g)): this applies to data in the portal as well as content on the devices.
5. Evidence and audit rights: the provider must be able to prove to you that it complies with the agreement.

An example makes point 3 tangible. When a courier delivers a device to Lena's home office, it knows her name and home address. That courier belongs on the subprocessor list.

The German Data Protection Conference, the joint body of Germany's data protection authorities, has summarised the requirements in its Short Paper No. 13 on processing. Use it as a cross-check against your provider's draft agreement.

At Everphone, a DPA is part of the framework agreement.

Data deletion on device return: the most critical moment

The return is where DaaS wins or loses on data protection. It isn't enough that data is deleted. What matters is that you can prove it for each device.

Technically, deletion on current smartphones is solid. On iPhones and iPads, "Erase All Content and Settings" destroys the keys to the encrypted storage, as Apple describes it. The data can no longer be read afterwards.

The problem lies elsewhere. Under Art. 5(2) GDPR, you must be able to demonstrate that you handled data correctly. A factory reset that somebody did at some point is no proof. A deletion log with serial number, date and method is.

A typical scenario: someone from sales leaves the company, and their work phone ends up in an IT cupboard. Three months later, nobody knows whether it was wiped. A defined return process closes exactly this gap.

For comparison: at Everphone, returned devices are wiped with certified software from our partner Blancco and then refurbished, at no extra cost.

Also ask your provider what happens to devices that no longer switch on. Software can't help there, only physical destruction of the storage. You'll find more on erasure methods and disposal in our article on secure phone disposal.

MDM and security concept for Device as a Service

Mobile device management is the most important technical measure for running company phones in line with the GDPR. It enforces encryption and passcode locks, distributes updates and can wipe a lost device remotely.

With Device as a Service, there are two options. Either the provider enrols the devices in your own MDM and your IT stays in charge of management. Or the provider runs the MDM as a managed service. In that case, it is also a processor for that data, and this belongs in the DPA.

Either way, the MDM only sees what it needs for security. With work profiles on Android or User Enrollment on Apple devices, private photos and chats stay invisible to IT. How this works is explained in how to separate business and private data on smartphones. The GDPR principles for the MDM itself are covered in GDPR and mobile device management.

One point is often overlooked: many MDM platforms come from the US. Data transfers there are permitted if the service is certified under the EU-US Data Privacy Framework. The General Court of the EU upheld this framework on September 3, 2025 (case T-553/23). Still ask where the data is stored and which safeguard applies if the framework falls.

Checklist: how to check a DaaS provider for GDPR compliance

You can ask every provider these questions before signing. If there's no clear answer, treat it as a warning sign.

1. Is there a DPA under Art. 28 GDPR, and does it cover shipping, support, MDM and returns?
2. Is there an up-to-date list of all subprocessors with their location and role?
3. Where are portal and MDM data stored? What legal basis applies to transfers outside the EU?
4. Which certification backs up the technical measures, such as ISO 27001?
5. Which method is used to delete data on return? Is there a log for each serial number?
6. What happens to defective devices that can't be wiped?
7. How quickly does the provider report a data breach, so you can meet the 72-hour deadline under Art. 33 GDPR?
8. How is portal data deleted after the contract ends?

Everphone is ISO 27001 certified. Get the remaining answers in writing from every provider, including us.

When Device as a Service is the better choice for data protection

From a data protection perspective, Device as a Service pays off above all when your IT currently has no clean process for returns and old devices. That applies to a ten-person business just as much as to a group with several sites.

An external provider brings deletion, proof and device history as standard. Your IT doesn't have to build that itself. In an audit, you show the log instead of hunting for a spreadsheet.

DaaS is not a good idea with a provider that won't give you a DPA or won't name its subprocessors. Then you carry the risk without being able to control it. Infringements of Art. 28 and Art. 32 can cost up to €10 million or 2% of global annual turnover (Art. 83(4) GDPR).

Our recommendation: have your data protection officer review the DPA before you sign, and take the checklist above into the conversation. Our whitepaper on mobile security shows how to secure company phones beyond that.

Frequently asked questions

Do I need a data processing agreement for Device as a Service?

Yes. As soon as the provider processes your employees' data, such as names and delivery addresses or device contents on return, a DPA under Art. 28 GDPR is mandatory. Without one, your company is liable as the controller.

Is a factory reset before returning a device enough?

Technically, a factory reset makes data on current, encrypted smartphones unreadable. But for the GDPR, you lack the proof. Certified deletion by the provider with a log for each device is the better option.

Does the works council have to approve rental devices with MDM?

In Germany, usually yes. An MDM is technical equipment suitable for monitoring behaviour or performance. Under Section 87(1) no. 6 of the Works Constitution Act, the works council has a right of co-determination, regardless of whether the devices are bought or rented.

What applies if a rented company phone is lost?

Check whether there has been a data breach and, if there is a risk, report it to the supervisory authority within 72 hours (Art. 33 GDPR). If the device was encrypted and passcode-locked, the risk is usually low. With an MDM, you can also lock or wipe it remotely.

Is Device as a Service more secure than purchased devices?

The devices themselves are the same. DaaS becomes more secure through its processes: every device is inventoried, enrolled in the MDM and verifiably wiped on return. You can build these processes with purchased devices too, but then you have to run them yourself.