What an MDM can and cannot do - Primo Documentation

Device management (MDM) covers the state of a device, not the activity of the person using it. This guide sets out exactly where that line falls: what the agent reports continuously, what the product never collects, what an administrator can trigger deliberately, and the legal framework around each. In several countries, deploying an MDM on employee devices also requires involving employee representatives beforehand — a works council consultation in France, a works agreement in Germany. The tables below are written to be copied into that file. For the message sent to employees once that step is settled, see Communication resources; for what employees do on their side, see the Employee guide & FAQ.

What changes with device management

Each security objective appears twice below: as it stands today, and as it stands once device management is in place.

Objective	Today	With device management
Encrypt the fleet	FileVault is enabled device by device, with no visibility on the rest	Encryption is enforced and its status reported. The recovery key is escrowed by the company. See Disk encryption
Keep devices up to date	Each employee updates when they think of it, and known flaws stay open for months	A minimum OS version is required, and the gap is visible and correctable. See Enforce a minimum OS version
Cover the fleet with antivirus	The agent is installed manually, with no view of which devices lack it	The antivirus is deployed by the MDM and coverage is read on a single page. See Endpoint protection
Spot a vulnerability before it is exploited	No inventory of the software installed across the fleet	Installed applications and their known vulnerabilities are reported
Frame sensitive software	Nothing prevents the installation of unauthorized software	Application blocking on macOS, in Monitor mode first, then Lockdown. See App blocking
Answer an audit or a customer	Security evidence is rebuilt by hand before each deadline	Controls run continuously and evidence comes out of the platform. See Compliance overview

These controls cover the state of the device — is it encrypted, up to date, protected. They do not cover the activity of the employee using it.

What the agent reports

The agent reports device metadata continuously and automatically. Nothing in this list requires an administrator to act.

Data	Frequency	What it is for
Model, serial number, OS and version	Continuous	Know which devices are managed and up to date
Disk encryption status	Continuous	Verify that nothing is readable if a device is stolen
Disk recovery key	Continuous	Escrowed automatically. The company can reopen a company device
Device security settings	Continuous	Screen lock delay, firewall, password policy
Disk, memory and processor usage	Continuous	Diagnose a slow device or a saturated disk
IP address	Continuous	Identify the device on the company network
Installed applications	Continuous	Names and versions only, never their content
Software vulnerabilities	Continuous	Fix a flaw before it is exploited

What the tool never collects

Each of these is absent from the product, not simply disabled.

Data	Status	Detail
Keystrokes	Never	No keylogger exists in the product
Browsing history	Never	Not reported by the agent. See the script execution row below
Email and messaging content	Never	The MDM is not connected to messaging systems
Webcam and microphone	Never	No image or sound capture
Personal passwords	Never	No access to password managers
File content	Never	The presence and name of a file can be known, never what it contains

What an administrator can trigger

These actions are deliberate, taken one device at a time, and recorded in the audit log with the administrator, the action and its result.

Action	Detail
Remote control and screen sharing	For troubleshooting. On macOS, the employee grants screen sharing permission on first use, and that approval cannot be pushed by MDM. See Remote access
Script execution on the device	On macOS, Windows and Linux. A script can technically read the disk, as on any administration tool. Every execution is traced: who, what, which result. See Script library
Locating an iPhone or iPad	Only in Lost Mode, after a loss or theft is declared. No continuous geolocation, and no equivalent on Mac. See Locking devices
Remote lock or wipe	For a lost or stolen device, and for departures. See Wiping devices

A remote wipe is irreversible. Data on the device cannot be recovered afterwards.

The legal framework

A technical capability is not an authorization. Three requirements hold across every country below: a declared purpose with a lawful basis, information given to employees before the deployment starts, and proportionality between the control and the aim. What differs is who must be involved before deployment, and on what terms.

France
Germany
Spain
United Kingdom
United States

What the law says	What it requires here
Works council consultation — French Labour Code, art. L2312-38	The CSE is informed and consulted prior to the implementation of means enabling the monitoring of employee activity
Prior information of employees — French Labour Code, art. L1222-4	No information concerning an employee personally may be collected by a device that has not been brought to their knowledge beforehand. Hence the communication sent before deployment
Proportionality — French Labour Code, art. L1121-1	A restriction must be justified by the nature of the task and proportionate to the aim pursued. Controlling the security state of a device, yes. Monitoring the activity of the person using it, no
Minimization and transparency — GDPR art. 5 and 13	Only the data necessary for the declared purpose, with a defined retention period and an entry in the record of processing activities
Files identified as personal — French Supreme Court case law	Files created on a company device are presumed professional. Those the employee has identified as personal, for example in a folder named “Personal”, may only be opened in their presence or with them duly summoned

Resource — Note for a CSE consultation (PDF, in French). A two-page note covering the objectives of the deployment, what the agent reports, what it never collects, what an administrator can trigger and the legal framework, ready to hand out at the session.

What the law says	What it requires here
Co-determination — Works Constitution Act (BetrVG), § 87(1) no. 6	Where a works council exists, it co-decides on the introduction and use of technical devices capable of monitoring employee behavior or performance. Co-determination, not consultation: without its agreement — in practice a works agreement (Betriebsvereinbarung) — the tool cannot be deployed
Works council information — BetrVG, § 80(2)	The works council receives the documentation it needs to assess what the tool collects and what it can trigger
Employee data processing — Federal Data Protection Act (BDSG), § 26, and GDPR art. 88	Processing must be necessary for the employment relationship. A works agreement can itself carry the legal basis, within the limits set by the GDPR
Proportionality — Federal Labour Court case law	Continuous or covert monitoring is rarely proportionate, and evidence collected outside these limits can be excluded in proceedings
Private use of the device	Where private use of a company device is permitted, access to what it contains faces additional restrictions. Set the rule on private use explicitly in the works agreement
Impact assessment — GDPR art. 35	A DPIA is expected where the deployment is likely to result in a high risk to employees

What the law says	What it requires here
Employer control powers — Workers’ Statute, art. 20.3	The employer may adopt the measures it deems appropriate to verify compliance with work duties, with due regard for the employee’s dignity
Criteria for the use of digital devices — LOPDGDD, art. 87	Employees have a right to privacy in the use of devices provided by the employer. The employer sets the criteria of use, and workers’ representatives take part in drafting them
Geolocation — LOPDGDD, art. 90	Employees and their representatives must be informed expressly, clearly and unequivocally about the existence and the characteristics of any geolocation device
Prior report of the works committee — Workers’ Statute, art. 64.5	The works committee issues a prior report on the implementation or revision of work organization and control systems
Minimization and transparency — GDPR art. 5 and 13	Only the data necessary for the declared purpose, with a defined retention period and an entry in the record of processing activities

What the law says	What it requires here
Lawful basis and transparency — UK GDPR art. 6 and 13, Data Protection Act 2018	A declared purpose and a lawful basis, with employees told what is collected and why before deployment
Impact assessment — UK GDPR art. 35	A DPIA where monitoring is likely to result in a high risk. Art. 35(9) invites seeking the views of workers or their representatives
Monitoring workers — ICO employment practices guidance	Monitoring must be necessary and proportionate to the stated purpose, and the least intrusive means available
Interception of communications — Investigatory Powers Act 2016 and the 2018 business practice regulations	Frames any interception of the content of communications. The controls in this guide do not collect message content
Expectation of privacy — Human Rights Act 1998, art. 8 ECHR	Employees keep a reasonable expectation of privacy at work, including on company devices
Employee representatives	No statutory works council consultation applies. Where a union is recognized, a collective agreement may still require consultation

What the law says	What it requires here
Company-owned devices	Monitoring devices owned by the company is generally lawful, and notice is what makes it defensible
Interception of communications — Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq.	Frames the interception of communications in transit, with consent and provider exceptions. The controls in this guide do not collect message content
Written monitoring notice by state — e.g. New York Civil Rights Law § 52-c, Connecticut Gen. Stat. § 31-48d, Delaware Code tit. 19 § 705	Written notice of electronic monitoring to employees, at hire or before monitoring starts, depending on the state
California employee data — CCPA as amended by the CPRA	A notice at collection listing the categories collected, the purposes and the retention periods, plus handling of employee rights requests
Unionized workforces — National Labor Relations Act, § 8(a)(5)	Introducing new monitoring may be a mandatory subject of bargaining
Federal works council	None exists. Employee representatives are involved only where a union contract requires it

The tool decides nothing. The capabilities listed above exist on every MDM on the market. What a company allows itself to do with them belongs to the framework above and to its own IT charter.

The IT charter, country by country

Every country in this list expects a written document naming the authorized uses of a company device, the controls applied to it, the cases in which IT intervenes, and how long data is kept. Only its name, its legal weight and the way it is adopted change.

Country	Instrument	How it is adopted
France	IT charter (charte informatique), annexed to the internal rules (règlement intérieur)	CSE consultation, filing with the labour court registry, transmission to the labour inspectorate
Germany	Works agreement (Betriebsvereinbarung), or an IT usage policy where no works council exists	Negotiated and signed with the works council, binding on both sides
Spain	Criteria for the use of digital devices (LOPDGDD, art. 87)	Drafted with the participation of workers’ representatives, then communicated to employees
United Kingdom	Acceptable use policy in the staff handbook	Issued by the employer, backed by a DPIA and a privacy notice. Consultation only where a collective agreement requires it
United States	Acceptable use and electronic monitoring policy	Acknowledged in writing at hire, with state-specific notice where required and bargaining where the workforce is unionized

This guide is an information summary, not legal advice. Requirements differ by country, and in the United States by state. Your legal team or local counsel remains the only authority on how your processing activities are qualified and on how your IT charter is drafted.

​What changes with device management

​What the agent reports

​What the tool never collects

​What an administrator can trigger

​The legal framework

​The IT charter, country by country

​Related articles

What changes with device management

What the agent reports

What the tool never collects

What an administrator can trigger

The legal framework

The IT charter, country by country

Related articles