Högskolan i Skövde

This thesis investigates the intersection of Bring Your Own Device (BYOD) policies and General Data Protection Regulation (GDPR) compliance within small and medium-sized enterprises (SMEs). As SMEs increasingly adopt BYOD practices to enhance operational flexibility and productivity, they face significant challenges in aligning these practices with GDPR’s stringent data protection requirements. This study addresses the research question: How can SMEs implement GDPR-compliant BYOD policies that can achieve productivity and security? Employing a dual-method qualitative approach systematic literature review (SLR) and document analysis (DA) the research synthesizes theoretical insights and real-world policy practices to construct a practical framework for SMEs.

The findings reveal that while BYOD adoption offers measurable benefits such as cost efficiency and operational responsiveness, it exposes organizations to heightened risks related to personal data processing, device security, and compliance enforcement. Key gaps identified include insufficient technical safeguards, ambiguous liability for data breaches, and inconsistent enforcement mechanisms in existing policies. The proposed framework incorporates best practices in data protection, organizational policy design, and technical safeguards, offering SMEs a pathway to align digital flexibility with legal and ethical responsibility.

Ethical and societal implications are explored, emphasizing the need for transparency, fairness, and inclusiveness in BYOD governance. The study contributes a tailored, evidence-based solution that responds to the constraints and priori-ties unique to SMEs, supporting secure digital transformation. Future research directions include longitudinal implementation studies and exploration of emerging technologies like AI-driven compliance monitoring. This work lays the groundwork for interdisciplinary research combining legal, organizational, and technological perspectives to advance GDPR-aligned BYOD adoption in SME contexts.