Device management (MDM) looks at the state of a device, never at what the person using it is doing. Use this guide to show employees, their representatives and your legal team exactly where that line sits, and which rules apply in France, Germany, Spain, the UK and the US.
Feature/Functionality
Overview
This guide covers four things: what the agent reports on its own, what the product never collects, what an administrator can choose to trigger, and the legal framework around each one.
In several countries you must involve employee representatives before rolling out an MDM on staff devices: a works council consultation in France, a works agreement in Germany. The tables below are written so you can paste them straight into that file.
Once that step is done, Communication resources has the message to send to employees, and the Employee enrolment guide covers what they do on their side.
How to use
- Read What changes with device management to explain the security goals behind the rollout.
- Use What the agent reports, What Factorial IT never collects and What an administrator can trigger to describe the tool in your consultation file.
- Open the section for your country under The legal framework to see who must be involved and on what terms.
- Check The IT charter, country by country to know which document you need and how it is adopted.
- Send the employee message from Communication resources and point staff to the Employee enrolment guide.
What changes with device management
Each security goal is shown twice: how it works today and how it works with an MDM.
| Goal | Today | With device management |
|---|---|---|
| Encrypt every device | FileVault is switched on one device at a time, with no view of the others | Encryption is enforced and its status is reported. The company holds the recovery key. See Disk encryption |
| Keep devices up to date | Each employee updates whenever they remember, and known flaws stay open for months | A minimum OS version is required, and devices behind it are visible and can be fixed. See Enforce OS updates |
| Cover every device with antivirus | The agent is installed by hand, with no view of which devices are missing it | The MDM deploys the antivirus and coverage is shown on one page. See Endpoint protection |
| Catch a vulnerability before it is exploited | There is no list of the software installed across the company | Installed applications and their known vulnerabilities are reported |
| Control sensitive software | Nothing stops anyone installing unapproved software | Application blocking on macOS, first in Monitor mode, then in Lockdown. See App blocking |
| Answer an audit or a customer | Security evidence is pieced together by hand before every deadline | Controls run all the time and the evidence comes straight from the platform. See Compliance overview |
These controls describe the device: whether it is encrypted, updated and protected. They say nothing about the activity of the employee using it.
What the agent reports
The agent sends device data on its own, all the time. No administrator action is needed for anything below.
| Data | How often | Why |
|---|---|---|
| Model, serial number, OS and version | Continuously | Know which devices are managed and up to date |
| Disk encryption status | Continuously | Make sure a stolen device cannot be read |
| Disk recovery key | Continuously | Stored automatically, so the company can reopen a company device |
| Device security settings | Continuously | Screen lock delay, firewall, password policy |
| Disk, memory and processor use | Continuously | Work out why a device is slow or its disk is full |
| IP address | Continuously | Identify the device on the company network |
| Installed applications | Continuously | Names and versions only, never what is inside them |
| Software vulnerabilities | Continuously | Patch a flaw before someone exploits it |
What Factorial IT never collects
None of these exists in the product. They are not switched off; they are simply not there.
| Data | Status | Detail |
|---|---|---|
| Keystrokes | Never | There is no keylogger in the product |
| Browsing history | Never | The agent does not report it. See the script row in the next table |
| Email and chat content | Never | The MDM has no connection to messaging tools |
| Webcam and microphone | Never | No pictures or sound are captured |
| Personal passwords | Never | No access to password managers |
| File content | Never | A file's name and presence can be seen, never what is in it |
Factorial IT publishes the same boundary on a public transparency page: what is never collected, what is collected and why, and its GDPR and SOC 2 Type 2 position. Anyone can open it, so you can share it with employee representatives.
What an administrator can trigger
Each of these is a deliberate action on a single device. The audit log records it, with who did it, what they did and the result.
| Action | Detail |
|---|---|
| Remote control and screen sharing | Used for troubleshooting. On macOS the employee approves screen sharing the first time, and the MDM cannot give that approval for them. See Remote access |
| Running a script on the device | Available on macOS, Windows and Linux. Like any admin tool, a script can technically read the disk. Every run is logged: who ran it, what it was and the result. See Script library |
| Locating an iPhone or iPad | Only in Lost Mode, after the device is reported lost or stolen. There is no constant tracking, and nothing similar on Mac. See Lock devices |
| Remote lock or wipe | For a lost or stolen device, or when someone leaves. See Wipe devices |
A remote wipe cannot be undone. Nothing on the device can be recovered afterwards.
The legal framework
Being able to do something technically does not make it allowed. Three rules apply in every country below: a stated purpose backed by a lawful basis, employees informed before the rollout begins, and a control proportionate to its aim. What changes from country to country is who has to be involved first, and how.
France
| What the law says | What it means here |
|---|---|
| Works council consultation: French Labour Code, art. L2312-38 | The CSE must be informed and consulted before any means of monitoring employee activity is put in place |
| Informing employees first: French Labour Code, art. L1222-4 | No personal information about an employee may be collected by a tool they were not told about beforehand. That is why the employee message goes out before deployment |
| Proportionality: French Labour Code, art. L1121-1 | Any restriction must be justified by the job and proportionate to its aim. Checking a device's security state is fine. Monitoring what the person does is not |
| Data minimisation and transparency: GDPR art. 5 and 13 | Collect only what the stated purpose needs, keep it for a set period and record it in the register of processing activities |
| Files marked as personal: French Supreme Court case law | Files on a company device are presumed to be work files. Files the employee has marked as personal, for instance in a folder called "Personal", may only be opened with the employee present or properly called in |
Germany
| What the law says | What it means here |
|---|---|
| Co-determination: Works Constitution Act (BetrVG), § 87(1) no. 6 | If there is a works council, it decides jointly on bringing in and using technical tools able to monitor employee behaviour or performance. This is co-determination, not consultation: without its agreement, usually a works agreement (Betriebsvereinbarung), the tool cannot be rolled out |
| Informing the works council: BetrVG, § 80(2) | The works council gets the documents it needs to judge what the tool collects and what it can trigger |
| Processing employee data: Federal Data Protection Act (BDSG), § 26, and GDPR art. 88 | Processing must be necessary for the employment relationship. A works agreement can itself be the legal basis, within the limits of the GDPR |
| Proportionality: Federal Labour Court case law | Constant or hidden monitoring is rarely proportionate, and evidence gathered beyond these limits can be thrown out in court |
| Private use of the device | If staff may use a company device privately, accessing its contents faces extra limits. State the private-use rule clearly in the works agreement |
| Impact assessment: GDPR art. 35 | A DPIA is expected when the rollout is likely to create a high risk for employees |
Spain
| What the law says | What it means here |
|---|---|
| Employer's right to supervise: Workers' Statute, art. 20.3 | The employer may take the measures it sees fit to check that work duties are met, while respecting the employee's dignity |
| Rules for using digital devices: LOPDGDD, art. 87 | Employees have a right to privacy when using devices the employer provides. The employer sets the rules of use, and workers' representatives help draft them |
| Geolocation: LOPDGDD, art. 90 | Employees and their representatives must be told clearly and explicitly that a geolocation tool exists and how it works |
| Prior report from the works committee: Workers' Statute, art. 64.5 | The works committee gives a report before work organisation and control systems are introduced or changed |
| Data minimisation and transparency: GDPR art. 5 and 13 | Collect only what the stated purpose needs, keep it for a set period and record it in the register of processing activities |
United Kingdom
| What the law says | What it means here |
|---|---|
| Lawful basis and transparency: UK GDPR art. 6 and 13, Data Protection Act 2018 | A stated purpose and a lawful basis, with employees told what is collected and why before the rollout |
| Impact assessment: UK GDPR art. 35 | A DPIA when monitoring is likely to create a high risk. Art. 35(9) encourages asking for the views of workers or their representatives |
| Monitoring workers: ICO employment practices guidance | Monitoring must be necessary, proportionate to its purpose and the least intrusive option available |
| Interception of communications: Investigatory Powers Act 2016 and the 2018 business practice regulations | Governs any interception of message content. The controls in this guide do not collect message content |
| Expectation of privacy: Human Rights Act 1998, art. 8 ECHR | Employees keep a reasonable expectation of privacy at work, company devices included |
| Employee representatives | There is no legal duty to consult a works council. Where a union is recognised, a collective agreement may still require consultation |
United States
| What the law says | What it means here |
|---|---|
| Company-owned devices | Monitoring devices the company owns is generally legal, and giving notice is what makes it defensible |
| Interception of communications: Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq. | Governs intercepting communications in transit, with exceptions for consent and providers. The controls in this guide do not collect message content |
| Written monitoring notice by state: e.g. New York Civil Rights Law § 52-c, Connecticut Gen. Stat. § 31-48d, Delaware Code tit. 19 § 705 | Employees get written notice of electronic monitoring when hired or before monitoring begins, depending on the state |
| California employee data: CCPA as amended by the CPRA | A notice at collection listing what is collected, why and for how long, plus a process for employee rights requests |
| Unionised workforces: NLRA, § 8(a)(5) | Bringing in new monitoring may have to be bargained with the union |
| Federal works council | There is none. Employee representatives are only involved when a union contract requires it |
The tool itself decides nothing. Every MDM on the market has the capabilities listed here. What a company chooses to do with them is governed by the framework above and by its own IT charter.
The IT charter, country by country
Every country here expects a written document that lists the permitted uses of a company device, the controls applied to it, when IT steps in and how long data is kept. Only the name, its legal weight and how it is adopted differ.
| Country | Document | How it is adopted |
|---|---|---|
| France | IT charter (charte informatique), attached to the internal rules (règlement intérieur) | CSE consultation, filed with the labour court registry, sent to the labour inspectorate |
| Germany | Works agreement (Betriebsvereinbarung), or an IT usage policy where there is no works council | Negotiated and signed with the works council, binding on both sides |
| Spain | Rules for using digital devices (LOPDGDD, art. 87) | Drafted with workers' representatives, then shared with employees |
| United Kingdom | Acceptable use policy in the staff handbook | Issued by the employer, supported by a DPIA and a privacy notice. Consultation only if a collective agreement requires it |
| United States | Acceptable use and electronic monitoring policy | Signed by the employee at hire, with state notices where required and bargaining where staff are unionised |
This guide summarises information and is not legal advice. Rules vary by country, and in the US by state. Only your legal team or local counsel can decide how your processing is classified and how your IT charter should be written.
Tips and Best Practices
- Involve representatives before you deploy, not after. In France and Germany the consultation or agreement comes first. In Germany, without the works council's agreement, the tool cannot go live.
- Reuse the tables. They are written to be pasted into a consultation file or an IT charter.
- Tell employees before the rollout starts. Every country listed expects people to know what is collected before collection begins.
- Write the private-use rule down. Whether staff may use company devices privately changes what you may access, especially in Germany.
- Keep scripts and remote actions for real needs. They are logged, and proportionality applies to every one of them.
- Get your legal team to sign off. This guide is a summary, not legal advice.
Troubleshooting and FAQ
Troubleshooting
- Employee representatives ask whether browsing or messages are monitored. Show them the table of what Factorial IT never collects. Browsing history, message content, keystrokes, webcam, microphone, personal passwords and file content are not in the product.
- Someone points out that a script could read the disk. That is true of any admin tool. Every script run is logged with who ran it, what it was and the result, and it is a deliberate action on one device.
- Screen sharing does not work on a Mac. On macOS the employee has to approve screen sharing the first time. The MDM cannot approve it for them.
FAQ
-
Can an administrator track where an employee is?
Only for an iPhone or iPad in Lost Mode, after it is reported lost or stolen. There is no constant tracking and nothing similar on Mac.
-
Does the agent read the content of files?
No. It can see that a file exists and its name, never what is inside.
-
Can a remote wipe be reversed?
No. Data on the device is gone for good.
-
Do we need works council approval in Germany?
Where a works council exists, yes. It co-decides on tools able to monitor behaviour or performance, usually through a works agreement.
-
Is this guide legal advice?
No. It is a summary. Your legal team or local counsel has the final word.