With a work phone, you have to be reachable during working hours, but not after work or on holiday. You may only use it privately if your employer allows it. Your employer may check business connection data within reason.
Private messages stay off-limits, even when private use is allowed. In Germany, the reason today is the GDPR, no longer telecommunications secrecy.
That last point has shifted. For a long time, the rule was: an employer who allows private use becomes a telecommunications provider and is bound by telecommunications secrecy. That view is outdated.
For employers, this does not mean "more control", but "different rules". Clear agreements and a technical separation of work and private data, for example via MDM from a Device as a Service provider like Everphone, save both sides a lot of trouble.
As of October 2026. This article describes the legal situation in Germany. It is an overview and not legal advice.
Do I always have to be reachable on my work phone?
No. You have to be reachable during working hours, not afterwards. A work phone does not turn your free time into working time. After work, at weekends and on holiday, you can switch it off.
During working hours, things are different. If your employer provides a work phone, they can require you to carry and use it as part of their right to give instructions (Section 106 of the German Trade Regulation Act, GewO). You cannot refuse the device. Conversely, you have no right to a work phone, even if colleagues have one. That is the employer's decision alone.
Then there is the statutory rest period. After work, you are entitled to at least eleven hours of rest (Section 5 of the German Working Hours Act, ArbZG). If you regularly take business calls and solve problems in the evening, you are working during that time. In case of doubt, the rest period starts again afterwards.
On-call duty is not automatically working time
During on-call duty, you are reachable on your work phone but free to move around. Under German law, only the time you are actually deployed generally counts as working time: the call, the journey and the job itself.
The European Court of Justice made an important exception in 2021 (including case C-344/19). If on-call duty is so restrictive that you can hardly organise your free time, it counts as working time in full. Example: you have to be on site within ten minutes and are called several times a night. Standby duty, where you have to stay at a specific place, is different. It always counts as working time.
Availability on holiday and in management roles
Managers are often expected to be more available. Whether and to what extent this applies must be set out in the employment contract. The extra effort is then usually covered by a higher salary.
On holiday, this applies only to a very limited extent. The German Federal Labour Court has ruled that a contract clause obliging you to be reachable at all times on holiday is invalid (BAG, 20 June 2000 – 9 AZR 405/99).
That leaves genuine emergencies: if operations come to a standstill because only you know a password, your duty of consideration under the employment contract can oblige you to take a short call. It makes more sense to remove such dependencies before your holiday.
Can I use my work phone privately?
Only if your employer allows it. Without permission, the work phone is purely a work tool. Permission can be granted explicitly in the employment contract or in a usage agreement. It can also arise tacitly if the employer knows about and tolerates private use over a longer period.
Many companies deliberately allow private use as a benefit. At Everphone, we recommend this for our Device as a Service devices too. They are set up for it, and it is a real advantage for employees: they no longer need to buy a phone of their own and don't have to carry two smartphones around.
With Choose your own device, they can even pick the device they want (with an optional contribution to the cost).
Anyone who makes private calls or browses despite a ban is in breach of their employment contract. This can lead to a formal warning and, in serious cases, to dismissal. Our article on company phones, private use and termination explains when it can come to that.
Can my employer monitor my work phone?
Yes, but only within narrow limits. How narrow depends on whether private use is allowed. In both cases, every check needs a legal basis under the GDPR and must be proportionate. Blanket or covert permanent surveillance is practically never permitted.
| Private use prohibited | Private use allowed | |
|---|---|---|
| Spot checks of business connection data | permitted | permitted, business data only |
| Viewing business emails (e.g. during absence) | permitted if necessary | permitted if necessary and private content is excluded |
| Reading private messages, photos, chats | practically never permitted | practically never permitted |
| Permanent location tracking | only with a specific reason | only with a specific reason |
| Does telecommunications secrecy apply? | no | according to the now prevailing view, no |
| Legal framework | GDPR, BDSG, works constitution law | GDPR, BDSG, works constitution law |
When private use is prohibited
The employer may check that everyone sticks to the ban. Spot checks of connection records are allowed. The employer may also view business emails if there is an objective reason, such as covering for a colleague on holiday. Systematically analysing every single message, however, is disproportionate.
When private use is allowed
The employer may not analyse private emails, chats or calls. Private location data is off-limits too. The outcome has not changed in recent years. The legal reasoning has.
Does telecommunications secrecy still apply to employers?
According to the now prevailing view, no. Employers are not considered telecommunications providers, even if they allow private use of work phones, email or internet. Telecommunications secrecy under Section 3 of the German TDDDG (formerly Section 88 TKG, then Section 3 TTDSG) therefore does not bind them. Private communication is protected by the GDPR instead.
The old view goes back to a 2016 guidance paper by the German Data Protection Conference (DSK). According to it, an employer who allowed private use became a telecommunications provider. The result was an almost complete ban on checks, up to a risk of criminal liability under Section 206 of the German Criminal Code (StGB). Many guides still rely on it.
Since the reform of German telecommunications law in 2021, the picture has turned:
- By law, telecommunications services are services normally provided for remuneration. An employer who provides email or mobile service to employees free of charge does not do that.
- In its 2024 activity report, the North Rhine-Westphalia data protection authority made clear that telecommunications secrecy no longer applies to employers who allow or tolerate private use. The Hessian and the federal data protection commissioners take a similar view.
- The Federal Network Agency (Bundesnetzagentur), responsible for classifying email and messaging services, followed this line in a 2025 guidance paper.
- Several courts had already taken this view, for example the Berlin-Brandenburg Regional Labour Court (14 January 2016 – 5 Sa 657/15).
The picture is not completely uniform, though. The Data Protection Conference has not officially withdrawn its 2016 guidance, and there is no ruling from the Federal Labour Court yet. If you want to be on the safe side, plan so that both views are respected. The easiest way to do this is a technical separation of work and private data.
What the GDPR requires for monitoring
The GDPR does not prohibit checks, it sets conditions. Every access needs a clear purpose and a legal basis, and it must be limited to what is necessary. In practice, this is about as strict for companies as telecommunications secrecy, but easier to plan for.
The main legal bases are the performance of the employment relationship and legitimate interests (Art. 6(1)(b) and (f) GDPR). Nobody should rely solely on the general clause in Section 26(1) of the German Federal Data Protection Act (BDSG) any more. In 2023, the European Court of Justice declared an identically structured state provision inapplicable (C-34/21). A dedicated German employee data protection act has been under discussion since 2024 but has not been passed.
Employee consent rarely helps. In an employment relationship, it is only valid if it is freely given and can be withdrawn at any time. You cannot build a check that has to work in an emergency on that basis.
This is what permissible access to a business mailbox looks like when an employee is off sick for a longer period:
- There is a specific reason, such as an expected reply from a customer.
- Access is limited to business folders and senders.
- Two people are present, for example IT and the works council or the data protection officer.
- Messages that are recognisably private are not opened.
- The access is documented and the employee is informed afterwards.
Works council and MDM: who has a say in the technology
If there is a works council, it has a right of co-determination for technical systems that can monitor employees' behaviour or performance (Section 87(1) no. 6 of the German Works Constitution Act, BetrVG). Practically every device management software falls under this. Without a works agreement, the MDM must not be rolled out.
At the same time, mobile device management is the best answer to the question of how control and privacy fit together. It creates a separate work profile on the smartphone. IT manages only this area, distributes apps and can wipe it if the device is lost. It has no access to private photos, chats or apps. Our article on data separation on company phones explains how this works.
Even when private use is allowed, the employer has a say in what ends up on the device. They can specify that only approved apps may be installed in the work profile. Anyone who ignores this risks a formal warning.
Can my employer take the work phone back?
In principle, yes. The work phone belongs to the company. If it is purely a work tool, the employer can ask for it back at any time. Anyone who refuses risks a formal warning or a lawsuit for its return.
It is different if private use is part of your remuneration. In that case, the employer cannot simply withdraw it during the employment relationship. They need a valid revocation clause in the contract, with comprehensible reasons.
When the employment relationship ends, you have to return the work phone. This also applies if you were allowed to use it privately. You can only keep it if you explicitly agree on this, for example by buying it at its residual value. Business data must be returned in any case. Back up your private data beforehand and then delete it from the device.
Usage agreement: what to include
Most disputes about work phones arise because nobody put anything in writing. A usage agreement creates clarity for both sides. It names the contracting parties, the device, the SIM card and any accessories provided. In terms of content, it should cover at least these points:
- Is private use allowed? If so, to what extent, and under what conditions can permission be withdrawn?
- What checks are there, who carries them out and how are employees informed?
- How are the work and private areas technically separated (MDM, work profile)?
- When does the device have to be reachable, and when not?
- What happens in the event of loss, theft or damage? The company is liable for normal wear and tear.
- When and how is the device returned, and what happens to private data?
You can find a detailed template with sample wording in our article on work phone agreements for private use.
Our recommendation for employers
Allow private use, but only with a work profile and a written agreement. For employees, a smartphone they can use privately is a noticeable benefit, and in Germany a tax-free one. For IT, the separate profile is the simplest way to protect company data without looking at private data.
A ban on private use only makes sense if you are actually willing to enforce it. In practice, many employees then carry two phones, or they use the work phone privately anyway and the ban quietly turns into tolerance. Both are worse than a clear rule.
Frequently asked questions
Can my boss read my WhatsApp messages on my work phone?
Your boss may practically never read private chats, whether private use is allowed or not. Business communication may only be viewed for a specific reason and to the extent necessary. Our article on WhatsApp on company phones explains how to use WhatsApp in a privacy-compliant way.
Does telecommunications secrecy apply if my employer allows private use?
According to the now prevailing view in Germany, no. The Federal Network Agency and several data protection authorities do not consider employers to be telecommunications providers. Your private communication is still protected, by the GDPR.
Can my employer track the location of my work phone?
Permanent tracking is only permitted with a specific reason, for example for scheduling field staff. After working hours, it is off-limits. Locating a lost or stolen device, on the other hand, is generally allowed.
Do I have to take business calls on holiday?
No. An obligation to be reachable on holiday cannot be validly agreed. Only in a genuine emergency, when serious damage would occur without you, can a short contact be reasonable.
Can I refuse a work phone?
Not during working hours if your employer instructs you to use it. You do not have to accept private use, though. Nobody can oblige you to store private data or apps on a company device.