Why This Matters

For a charity such as IWA, it is essential that volunteers can use their own computers, laptops, tablets or phones to transact IWA business, as the Association cannot provide everyone with IWA paid-for hardware! There is a data risk with any Bring Your Own Device arrangement, but this risk can be managed. These guidelines will help keep personal data safe, protect the charity, and protect you.

What “BYOD” Means

BYOD (Bring Your Own Device) means using your personal device – such as a mobile phone, tablet, or laptop – to carry out tasks for IWA.

Examples:

• Sending emails or messages related to your volunteer role
• Accessing details of meetings and events, online systems, or cloud documents
• Taking photos for charity events (with permission)
• Storing contact numbers for coordination

Key Principles

• Your device, your responsibility – but when it holds IWA information, you must protect it.
• Only store what you need and delete it when you no longer need it.
• Personal data must be handled securely at all times, especially on your own device.

Security Requirements

To keep IWA information safe, you should:

Device Security

• Use a passcode, fingerprint, or face unlock.
• Keep your device updated with the latest operating system and anti-virus software, and keep software updated to the latest version
• Turn on automatic screen lock.
• Do not use rooted/jailbroken devices for IWA business.

Apps & Accounts

• Use your @waterways.org.uk or wrg.org.uk accounts.
• Use official apps only (e.g., email such as Outlook, document storage such as OneDrive, messaging approved by IWA such as WhatsApp).
• Turn on two-factor authentication for any IWA-related accounts, if available.

Wi-Fi Safety

• Avoid using public Wi-Fi for sensitive tasks.
• Use mobile data or a trusted, password-protected network.

Handling Personal Data

When using your own device, treat personal data with extra care.

You must:

• Store only the information you genuinely need for your volunteer role.
• Delete personal data once it is no longer required.
• Report any data loss (lost phone, accidental sharing, etc.) immediately to the IWA Data Protection Officer [email protected].
• Keep charity data separate from your personal apps/accounts.
• Securely shred any printed personal data – or send it to IWA’s office for shredding.

You must NOT:

• Screenshot, copy, or forward personal data unnecessarily.
• Share personal data (names, numbers, photos, case details) outside approved channels.
• Back up IWA data to personal cloud accounts unless authorised.

Using Messaging Apps (e.g., WhatsApp)

Where IWA allows use of WhatsApp or similar apps:

• Only join groups with consent.
• Keep conversations professional and relevant.
• Do not store or forward sensitive information.
• Delete chats immediately if asked or as soon as they are no longer needed.

Taking Photos or Videos

When using your own phone for photography:

• Always obtain permission before photographing volunteers, clients, or children.
• Only store images temporarily—upload them to the charity’s system and delete them from your device.
• Never post charity photos on your personal social media unless authorised.

Lost, Stolen, or Compromised Device

If your device is lost, stolen, hacked, or accessed by someone else:

1. Tell IWA’s Data Protection Officer [email protected] immediately.
2. They will advise you on next steps (e.g., resetting passwords, revoking access).
3. Act fast – this helps reduce potential risk.

Leaving the Charity or Changing Roles

If you stop volunteering or no longer need the data:

• Delete all charity documents, photos, messages, and contact information from your device.
• Return any physical materials, printed documents or files.
• Remove access to charity accounts or apps.

Disposing of your device (including USB sticks and external drives)

If you plan to dispose of your device, either:

• Remove the hard drive and physically render it unusable, or
• Use appropriate software to wipe (overwrite) every sector of the drive, or
• Send the device to IWA’s office for secure disposal.

This is not just for IWA’s benefit, but for yours too if you have used the device for personal banking or any other purposes where you have disclosed or saved your own personal data.

When BYOD Is Not Allowed

Some tasks must not be done on personal devices, such as:

• Handling safeguarding or confidential casework
• Accessing sensitive personal data unless authorised
• Managing financial or donor records outside approved systems

If you’re unsure, ask before proceeding.

When in Doubt

A simple rule:

If you wouldn’t store this information about yourself on someone else’s phone, don’t store it on yours without permission and safeguards.

If you ever feel unsure, speak to your supervisor, IT lead, or data protection officer.

Last Updated: December 2025