RMO No. 24-2025: Implementation of Bring Your Own Device (BYOD)

Summary

RMO No. 24-2025 prescribes policies, guidelines and procedures on using personal devices at the BIR under a Bring Your Own Device (BYOD) strategy.

Key points

1. Who may use personal devices. Employees, consultants, contractors, service providers, partner government agencies and other third parties may do so. Third parties accessing the BIR network for one-day presentation purposes only are excepted.
2. Allowed devices. These are laptops, smartphones or tablets, desktop computers, and printers, the latter only if the allocation of printers by the Property Division is insufficient.
3. Rules to follow. BYOD users follow the Revised ICT Security Policy (RMO No. 15-2014), the Data Privacy Act of 2012 (RA No. 10173) and the Acceptable Use Policy. Employees and contractors must undergo Information Security Awareness and Data Privacy Act briefings and register devices before getting internet access.
4. Inspection. ISG personnel may inspect registered devices and conduct vulnerability assessment. Employees using smartphones or tablets on BIR WiFi do not undergo vulnerability assessment.
5. User responsibilities. Users keep the operating system and key applications updated and keep personal and BIR files encrypted and separate. They are fully liable for loss of BIR data on the device, and the BIR is not responsible for loss of the device.
6. Lost devices and disposal. Lost or stolen devices are reported to authorized BIR personnel within 24 hours. Work-related data must be removed before disposal or pullout of the device.

Who is affected

• Employees
• Consultants, contractors and service providers
• Partner government agencies and other third parties

Deadlines and effectivity

• Report lost or stolen device within 24 hours
• Issued May 7, 2025

Summary by Tax Resources PH. It is not a substitute for the full text of the issuance or professional advice.