Using a personal device for sensitive workplace records

Notes about a dispute with your employer are generally safer on a personal phone or computer, in an account you alone control, than on a work laptop, work phone, work email or company cloud drive. Employer systems are usually administered and may be monitored by the employer, and your access to them can end without warning.

The reverse also applies: do not copy confidential employer information, such as client files, internal reports or other employees' data, onto your personal devices to build your record. Keep your own notes and the documents addressed to you personally, and describe anything else in your own words with a note of where the original is kept.

The most common problem is not surveillance, it is lost access. When someone is suspended, put on leave or let go, accounts are often disabled the same day and devices are collected. A careful set of notes in a work notebook app or a folder on the company drive can disappear at exactly the moment you need it.

• Accounts can be locked or reset by IT at any time, including during an investigation.
• Company retention settings may delete chat messages or emails after a set period.
• Files on shared drives may be visible to colleagues or administrators through folder permissions you did not set.
• Work phones and laptops are usually returned, wiped or reimaged when you leave or change roles.
• Synced work accounts on your personal devices can be removed remotely, sometimes with their local data.

The same caution applies in the other direction. Signing in to your personal email, notes app or cloud storage on a work computer can leave saved passwords, cached files or browser history on a machine the employer administers. If you need to check your personal notes during the workday, do it on your own phone rather than in a work browser, and sign out of any personal account you opened on shared or company equipment.

Workplace monitoring rules differ across Canada and the United States and depend on the employer, the sector and where you work, so it is safest to assume that anything on an employer system could be seen by someone administering it. That can include email, workplace chat, files, browsing on company devices or networks, and activity in work apps.

The Office of the Privacy Commissioner of Canada describes monitoring as something employers may do for purposes such as tracking attendance or appropriate network use, and says employers should make employees aware of the purpose, nature, extent and reasons for it. It also says people have a right to privacy at work, even on their employer's premises. In the United States, rules come from a mix of federal and state law and vary widely. In both countries, your employer's acceptable use, IT or monitoring policy is usually the clearest description of what it says it does, and it is worth reading your own copy.

Moving your notes off work systems does not mean moving the company's information onto yours. Forwarding batches of work email to a personal address, photographing internal dashboards or downloading client lists can breach confidentiality agreements, workplace policies and privacy obligations owed to clients and coworkers. It can also shift attention away from what happened to you and onto what you took.

A rough line most people can work with:

• Usually reasonable to keep: your own notes, texts and messages sent to your personal phone or email, and documents given to you personally, such as an offer letter, pay statements, a performance review or a warning letter.
• Usually better left in place: client or customer information, internal reports and financials, other employees' personal details, source code, strategy documents and anything marked confidential.
• Unclear: messages in group chats or email threads that mention you but also include business information. Describe them in your notes and record where they are stored.

If you have a confidentiality agreement or are unsure whether something is yours to keep, ask a lawyer before copying it anywhere.

When a relevant document belongs on the employer's side, you can still record that it exists. An invented example of a records entry written on a personal device: 'R-012. Email, March 3, 10:14 a.m., from the regional manager to the whole sales team, subject Q2 targets. Shows my territory target raised from 40 to 55 accounts, while the email lists other territories as unchanged. Original: my work inbox, Q2 folder. Not copied because it contains client names. Linked to timeline entry for March 3.'

A reviewer can work with that. It tells them what the document is, what it appears to show and where it can be requested, without you holding company data.

Many people use a personal phone for work email or chat. Employers often require device management software or a separate work profile for this. Those tools typically give the employer some control over the work side of the phone, and in some setups more. Your employer's policy should explain what it can see and do. The privacy commissioner's guidance on mobile devices at work covers bring-your-own-device programs from the employer's side, which can help you understand the arrangement.

Keep your notes in an app outside the work profile, signed in with a personal account, and avoid saving screenshots of work chats into a work-managed photo or file location.

Notes about a dispute can include health information, family details and other people's names by role. Basic phone security goes a long way. The US Federal Trade Commission's consumer advice on protecting your phone covers several of these steps.

1. Set the phone to lock automatically and use a passcode of at least six digits. The FTC suggests six digits as a minimum.
2. Turn on automatic updates for the operating system and apps.
3. Use a personal email account for your notes app and cloud backup, not a work address.
4. Turn on two-factor authentication for that account.
5. Back up regularly to a cloud account or computer you control, so a lost phone does not mean a lost record.
6. Turn on the built-in feature to locate, lock or erase a lost phone.
7. Hide notification previews on the lock screen if colleagues or family often see your phone.

A personal device is not always a private one. A family tablet, a laptop signed in to a partner's account, or a cloud plan shared by the household can expose notes you meant to keep to yourself. That may be fine with you, or it may not, especially if the record mentions health or relationships.

• Check whether your photos sync to a shared family album, which would include screenshots of work messages.
• Check which accounts are signed in to the browser you use for notes, and whether its history syncs elsewhere.
• Use a separate user profile on a shared computer, with its own password.
• Be careful with shared printers and downloads folders when you print or export a packet.

Can I just email my notes to myself from my work account? That leaves a copy on the employer's mail system and may be visible to administrators. Writing the notes on your own device from the start avoids the problem.

Does using office Wi-Fi on my personal phone expose my notes? Network administrators may be able to see some information about traffic on a company network. If that concerns you, write and sync notes on your mobile data or home connection.

My only phone is a company phone. What can I do? Consider a low-cost personal device or a home computer for your notes, even a shared one with its own profile. A paper notebook kept at home also works.

Should I delete personal notes I already wrote on a work device? Deleting material from employer systems during a dispute can raise its own problems. Before deleting anything, rewrite or summarize what you need on your own device and ask a lawyer about the rest.

SteadyFile runs in the browser at app.steadyfile.com, so you can open a private workplace file on your personal phone or home computer without installing anything or touching a work device. It is free to start and needs no account. Entries capture what happened, when and who was present by role, and each document you list gets an ID in a records index, so you can describe something like R-012 above in your own words without uploading anything that belongs to your employer. With an account, SteadyFile records when each entry was created and keeps edit history visible. Your employer has no access to the file, and the exported packet can be saved to your own device when you are ready to share it with a lawyer or advisor.