What the Employer Can See, Honestly
The specific answer, because the general worry is larger than the configuration and the reassurance is only worth anything if it is accurate.
Employees asked what their employer can see on a personal device give answers that are too broad. Employers asked the same question frequently do not know. Both halves of that are fixable.
The privacy boundary in “What the Employer Can See, Honestly” should also govern workforce records created on a personal device. When a team evaluates employee monitoring software for employee monitoring software, it should disclose the purpose, limit manager access and retention, and give each person a practical correction route.
On a containerised personal device
Visible: the device model, operating system version, whether it is encrypted, whether it has a passcode, whether it is modified, and when it last connected. Plus everything inside the work profile space — work applications, work files, work mail.
For an independent reference relevant to “What the Employer Can See, Honestly”, consult the ICO employment-practices guidance; compare its principles with the proposed ownership model, access rules and real support process.
Not visible: personal applications, personal files, photographs, personal messages, personal accounts, browsing outside the work space, and location in ordinary configurations.
That division is maintained by the operating system rather than by the employer's forbearance, which is why it can be stated as a fact rather than as a promise.
On a fully enrolled personal device
Considerably more, and this is the arrangement to avoid on hardware the employee owns.
On several platforms full enrolment exposes the complete list of installed applications, which reveals health conditions, faith, dating, finances and politics from the names alone. It may permit configuration changes across the whole device and a wipe of everything.
If your arrangement is full enrolment on hardware the employee owns, the honest answer to the employee's question is uncomfortable, and that discomfort is the argument for changing the arrangement.
What nobody can see in any ordinary configuration
Passwords, which are protected by design.
The content of personal messages on personal accounts.
The camera or microphone, which modern systems indicate when active with an indicator ordinary software cannot suppress.
These three account for most of the anxiety and the answer to all three is reassuring and true.
The honest caveats
Work mail and messages sent through company systems are company records, wherever they were typed.
Network traffic through a company connection may be logged, which is about the network rather than the device.
And capability is not the same as practice: the question of what is technically visible is different from the question of who actually looks, which is governed by access controls and ought to be stated separately.
Why publishing this matters
An employee who does not know assumes the worst, and behaves accordingly: keeping work off the device, working around arrangements, or simply resenting it.
A published, accurate list — both halves, with the "not visible" half given equal prominence — costs an afternoon to produce and removes most of that.
Publishing both halves
A statement of what the employer can see, issued alone, reads as a warning. The same statement paired with an equally specific list of what it cannot see reads as information. The second list is longer, more reassuring and entirely true, and leaving it out is the commonest avoidable error in how these arrangements are communicated.
Capability against practice
What is technically visible and what anybody actually looks at are different questions, and employees conflate them. Saying who has access, under what process, and how often individual data is actually opened answers the second question, which is frequently the one people were really asking.
Reviewing the statement annually
What the employer can see changes with platform upgrades. A published statement that is no longer accurate is worse than none, because it was relied upon. Checking it against the live configuration once a year keeps it true and takes the same hour as the rest of the review. Could your people, from anything you have published, correctly describe what you can see on their phone?