Apple device security under Swiss and EU data protection law
An MDM can turn on FileVault, require a passcode and record the state of your Macs, iPhones and iPads. Those settings and records help with data protection. Which legal duties you have, though, depends on the personal data you process and the risks that come with it.
In short
- Work out which laws apply to you and what your risks are before you choose MDM settings.
- Keep dated evidence of your settings and write down every exception.
- Know which breach-reporting threshold applies to you before a device goes missing.
Find out which rules apply
The Swiss Federal Act on Data Protection (FADP, often called nDSG) sets the duties for processing personal data. Whether the GDPR applies as well is a separate question. Article 3 of the GDPR answers it, based on where you're established and what kind of processing you do. Having a customer in the EU doesn't settle it on its own.
Industry rules and your contracts can add duties of their own, so check those separately. ISO 27001 is a standard for running an information security management system. Getting certified against it and complying with the law are two different assessments.
Choose controls based on your risks
Swiss law and Article 32 of the GDPR both require appropriate technical and organisational measures. What counts as appropriate depends on the risk, which is why you start there. Encryption is an important measure. Even so, neither law gives you an MDM checklist that guarantees compliance once every item is ticked.
On Macs, look first at FileVault and at who can get to the recovery keys. An encrypted disk protects the data only as long as the key is kept safe. Then check who has admin rights on each Mac and whether the software it runs is still supported. On iPhone and iPad, look at the passcode rules, which apps are managed and how work data can be moved out of them. Connections to company data should be encrypted. Whether you also need a VPN depends on how people get to that data.
Keep evidence you can use
Write down each policy, who owns it and which devices it covers. Keep dated evidence of encryption, updates and any exceptions you've agreed to. Check when each device last reported to the MDM. The MDM only knows how a device looked the last time it checked in, so an old record can't prove how it looks today.
Decide who may see logs and recovery keys, and how long you keep them. MDM reports can contain staff names or other identifiers, so they need protecting as well.
BYOD and shared devices
If people use their own iPhone or Mac for work, explain beforehand which controls they agree to and which work data IT can remove. It's their private device, so they should know where the company's reach ends. Before rollout, test the enrolment method you plan to use and how the apps behave with it. On shared devices, make sure the next person can't open the previous person's session.
Your ownership policy should say who supports which devices and what happens to them when someone leaves. The technical separation between work and personal data has to match the apps people use and where their data goes.
Plan for a lost device
When a device goes missing, assess it quickly. Find out which data was on it, whether FileVault or a passcode was protecting it and whether anyone could still get in. Encryption, and whether the key could have been exposed, both weigh into that assessment.
Swiss law and the GDPR use different risk thresholds for reporting a breach. Under the GDPR, you generally have 72 hours from becoming aware of a breach to notify the supervisory authority, unless the breach is unlikely to result in a risk to the people concerned. Article 24 of the FADP requires you to notify the FDPIC as soon as possible when a breach is likely to result in a high risk. So the same lost laptop can need a report under one law and none under the other. Write down the decision and the reasons for it together with whoever is responsible for privacy or legal questions. If anyone asks later, that record shows why you did or didn't report.
We can go through your MDM settings and the evidence you keep, together with whoever handles privacy or legal questions on your side.
Get new articles by email
Related articles
A practical security baseline for Apple devices
A security baseline starts with the data and the accounts you need to protect. It holds up only when you've checked each control on the devices themselves and know what to do when one fails.
BYOD or company-owned Apple devices
Who owns the device decides how much IT can control on it and what your employees can expect from you. Choose the model from what each role does on the device and which data ends up there.
Endpoint protection for a managed Mac fleet
Your MDM controls how your Macs are set up. Noticing an attack on one of them is a separate job, and someone has to own it and act when an alert comes in.
Managing Apple devices in healthcare
An iPad or iPhone used in patient care has to fit the way nurses and doctors work, and it has to keep patient information away from anyone who shouldn't see it. You only know it does both once you've tested sign-in, handover, Wi-Fi and what happens when a device fails, together with the staff who use it.
