What must employers do to stay compliant when employees text about work on their own cell phones?

Work-related text messages can be records regardless of who owns the phone. When employees discuss business on personal devices, those messages may carry the same legal, regulatory, and evidentiary weight as messages sent from company-issued equipment. The ownership of the device does not change the nature of the content. What matters is whether the message documents a business activity, decision, or transaction.

Start With Policy

Compliance begins with a clear, written policy. Employers should state whether personal devices may be used for work at all, and if so, under what conditions. A “bring your own device” (BYOD) policy should explain that work-related texts must be preserved, define what counts as a business communication, and require employees to acknowledge the rules in writing.

Capture and Preserve

A policy is only effective if the records it covers can actually be captured. Employers should provide a reliable way to retain work-related texts so they remain complete, accurate, and retrievable. Practical options include:

• Directing work communications to approved, retainable channels whenever possible.
• Establishing a defined method for employees to forward or copy business texts into official systems.
• Avoiding tools or settings that auto-delete messages before retention obligations are met.

The goal is to prevent gaps that could undermine litigation holds, audits, or public-records and FOIA-style requests.

Apply Retention Rules

Work texts on personal phones are subject to the same retention schedules as any other record of equivalent content. They should be kept for the required period and disposed of consistently, not left to chance on an individual’s device. Treating these messages as ad hoc invites spoliation claims and inconsistent recordkeeping.

Train, Monitor, and Document

Employees cannot follow rules they do not understand. Regular training, periodic reminders, and reasonable monitoring help ensure the policy works in practice. Document that training occurred and that the program is reviewed over time.

Balance Privacy

Because personal devices contain private data, employers should limit capture to genuine business communications and handle any personal information appropriately. A narrowly scoped approach reduces privacy friction while still meeting recordkeeping duties.

For related guidance, see the email and messaging topic hub. Sound recordkeeping principles, applied consistently, keep an organization defensible no matter which device a message originates from.