Workplace Messaging and Device Monitoring

If an employee posts from an official company account, a role-based brand account, or an approved social-selling profile used to conduct company business, the employer should define posting rules, retention, approval workflows, message supervision, and account recovery access. That account is part of the business.

Personal social media is different. Employers can investigate specific misconduct, protect trade secrets, and enforce lawful conduct policies, but many states limit requests that force employees or applicants to disclose private credentials, log in while a manager watches, add a supervisor as a contact, or change privacy settings.

Instant messages and SMS often feel informal, but regulators and courts can treat them as business records when employees use them to approve work, advise customers, negotiate terms, handle complaints, or discuss regulated activity. Financial firms have paid large penalties for failing to preserve business communications sent through unapproved personal texting and chat apps.

A workable policy names the approved tools, bans or tightly controls off-channel business messaging, explains what is archived, describes legal holds, and tells employees what to do when a customer sends business content through a personal or unapproved channel.

• For employers: make the approved channel easy enough that employees don't move work to personal texts.
• For employees: keep business communications inside the channels your employer has authorized and retained.

Bullying, harassment, threats, retaliation, discriminatory comments, pressure to violate policy, and other non-financial misconduct often happen through the same tools employees use to work: chat, SMS, meeting messages, comments, and social DMs connected to company accounts. When an allegation is serious, contemporaneous message history can show what was said, who saw it, whether it was repeated, and whether context changes the interpretation.

This is especially important in regulated environments. The UK FCA's PS25/23 guidance comes into force on September 1, 2026 alongside COCON 1.1.7FR, and it is aimed at helping affected firms apply conduct rules to non-financial misconduct consistently. The lesson applies beyond the UK: if a business may need to make a fair conduct finding, notify a regulator, discipline an employee, or answer a future reference request, it needs reliable work-channel evidence, not memory.

On an employer-owned phone or employer-supplied cellular plan, the business usually has a stronger interest in managing the device, enforcing security settings, retaining business communications, reviewing usage records, and wiping company data. That does not mean every personal photo, private message, health app, or family location event should be collected.

For BYOD, the employer's reach should be narrower and clearer. The cleanest model uses mobile app management, work profiles, managed apps, or other containerized controls that separate company email, chat, files, and contacts from the employee's personal side of the device.

Monitoring policies often overlook the wage side of messaging. If hourly or nonexempt employees respond to business SMS, chat, email, or social DMs after their shift, the company should have a timekeeping rule, manager escalation path, and clear boundaries for when after-hours work is allowed.

For employees, the safest habit is to follow the company's reporting process whenever work is performed outside scheduled time. For employers, the safest design is to either prevent after-hours work or record it accurately and pay for it when required.