Still Watching You After You've Left: The Truth About Employer MDM Software on UK Workers' iPhones

Imagine handing in your resignation, working your notice period, and walking out the door — only to discover, weeks later, that your former employer can still see every app on your phone, remotely wipe your personal photos, and restrict which websites you can visit. Not a dystopian thought experiment. For a growing number of UK workers, it's Tuesday.

Mobile Device Management software — MDM, in the trade — is the invisible layer of corporate control installed on company-issued iPhones. In the right hands, it's a legitimate security tool. In the wrong ones, it's a digital leash that doesn't automatically snap when employment ends.

What MDM Actually Does to Your iPhone

MDM profiles are installed by IT departments to manage fleets of company devices. On an iPhone, an active MDM profile can — depending on configuration — do the following:

• Enforce passcode policies and complexity requirements
• Block access to specific apps, websites, or the App Store entirely
• Monitor installed applications and device usage data
• Remotely lock or wipe the device
• Prevent the user from removing the MDM profile themselves
• Track device location (though this requires explicit configuration)

For a company issuing hundreds of handsets to field sales staff or healthcare workers, this makes sense. Devices hold sensitive data. Data needs protecting. Fair enough.

The problem starts when the line between the company's device and the employee's life becomes blurred — and when MDM profiles outlive the employment relationship that justified them.

The Company Phone That Followed One Worker Home

We spoke to a former logistics coordinator from Manchester who asked to be identified only as Priya. When she left her employer last year after four years of service, she was told she could keep the iPhone she'd been using — a common arrangement, particularly for longer-serving employees.

"They said it was mine to keep as part of my leaving package," she told us. "But three months later I noticed I still couldn't download certain apps, and when I tried to access my personal Gmail it was being filtered. I went to a phone repair shop and they showed me an active MDM profile still on the device. My old employer could, in theory, wipe everything on it at any moment."

Priya's situation isn't unusual. When companies gift or sell devices to departing employees without properly offboarding them from their MDM system, those employees carry a live corporate leash without knowing it.

What the Law Actually Says

This is where it gets genuinely complicated, and where many UK employees don't realise they have significant legal ground to stand on.

We spoke to an employment lawyer based in Bristol who specialises in technology and workplace rights. "Once a device is transferred to an employee — whether gifted, sold, or retained as part of a settlement — the employer's legal basis for maintaining control over it becomes extremely thin," she explained. "Under UK GDPR and the Data Protection Act 2018, any processing of personal data — including monitoring device activity — requires a lawful basis. After employment ends and the device is no longer theirs, that basis essentially evaporates."

She was careful to note the distinction: if the device remains company property and the employee is simply using it after leaving, the situation is murkier. But if ownership has transferred, an employer maintaining active MDM control faces potential liability under data protection law.

"There's also a potential angle under the Computer Misuse Act 1990," she added. "Remotely accessing or modifying a device you no longer own, without the owner's consent, is not a comfortable legal position to be in."

The Supervised Device Problem

There's a particular subset of MDM deployment that causes the most grief: Apple's Supervised mode, combined with Apple Business Manager (ABM) or Apple School Manager enrollment.

When a device is enrolled in ABM as a supervised device, the MDM profile can be made non-removable by the user — even after a factory reset. The device is linked at a hardware level to the organisation's Apple Business Manager account. This is sometimes called a "device enrollment" as opposed to "user enrollment," and it means that even wiping the phone clean won't remove the corporate lock.

In practice, this means an employee who keeps a supervised device after leaving their job may find it permanently restricted unless their former IT department actively removes it from their ABM account. Some employers do this automatically. Many don't — whether through negligence, administrative backlog, or, in some reported cases, deliberate obstruction.

Which Sectors Are the Worst Offenders?

Without naming specific companies (our legal team would like us to keep our teeth, thank you), certain sectors consistently generate the most complaints around post-employment MDM issues:

Financial services tends to use the most aggressive MDM configurations, often citing FCA compliance requirements. The irony is that the same regulatory framework that justifies tight control also requires proper data handling — including appropriate offboarding.

Healthcare — particularly private providers — issues large numbers of managed devices to clinical staff, and MDM removal processes are frequently under-resourced.

Retail and logistics, particularly large national chains, often issue devices en masse with standardised MDM profiles and no consistent decommissioning process for leavers.

Education — schools and universities using Apple School Manager — can leave supervised profiles on devices that were gifted or sold to departing staff at the end of term.

How to Check If Your iPhone Has an Active MDM Profile

This is straightforward. Go to Settings > General > VPN & Device Management. If you see a profile listed there — particularly one you didn't install yourself — your device is under MDM control.

If the profile has a "Remove Management" button, you can remove it yourself (though your employer's IT policy may flag this as a compliance breach if you're still employed). If there's no removal option, the device is likely in Supervised mode.

What to Do If You're Stuck

If you're still employed: Raise the issue with your IT department or HR. Ask specifically what data the MDM profile collects and request a copy of the company's device management policy — you're entitled to this under GDPR.

If you've left and kept the device: Write formally to your former employer's IT or legal team, stating that you own the device and requesting immediate removal from their MDM system. Reference UK GDPR and the Data Protection Act 2018. Keep a copy.

If they refuse or don't respond: File a complaint with the Information Commissioner's Office (ICO). The ICO has enforcement powers and takes data control complaints seriously, particularly post-employment.

If the device is ABM-supervised: You may need to contact Apple directly with proof of device ownership and explain the situation. Apple can, in some circumstances, assist with removing devices from ABM enrollment — but this typically requires cooperation from the enrolling organisation.

As a last resort: A complete restore via DFU mode (Device Firmware Update) will remove standard MDM profiles. It won't remove ABM supervision. If you go down this route, back up everything first and understand that it won't work for supervised devices.

The Takeaway

MDM software is a legitimate tool that serves a genuine purpose. The problem isn't the technology — it's the absence of clear offboarding processes and, in some cases, a cavalier attitude toward employees' post-employment rights.

If you're about to leave a job where you've been using a company iPhone, ask explicitly whether the MDM profile will be removed before you walk out the door. Get the answer in writing. And if the device is being transferred to you permanently, make sure that transfer is documented — because without it, you could be carrying someone else's control over your own phone for months without knowing it.