Right now, on a subbie’s phone somewhere in your network, there’s a video of one of your customers standing in their kitchen. The switchboard might be in the background, or the metre, or the customer talking through what they were promised at the sale. It sits in the camera roll next to the subbie’s kids’ footy photos. It has probably already gone up to their personal cloud account, and quite possibly into a WhatsApp group with two other installers.

You didn’t ask for that video, you don’t control it, and you couldn’t find it if a customer complaint landed tomorrow. Yet if it leaks, ends up on social media, or gets recorded without proper consent, most customers and regulators will still see it as your problem.

That’s the gap this article covers. Most BYOD (bring your own device) policies were written for office workers checking email on their own phones. A solar install business needs something different.

Why the generic BYOD templates miss the point

Search for a BYOD policy and the top results read like IT security handbooks. SecureSlate (n.d.) frames the policy around requirements and audit evidence for compliance teams. Unió Digital (n.d.) offers a business template built around device security and acceptable use. eMonitor (n.d.) concentrates on monitoring employee-owned devices.

There’s nothing wrong with any of that if you run a 40-person office with an IT manager. But those guides assume three things that don’t hold in a solar business:

  1. The device user is an employee you can direct.
  2. The risk is company data leaking out, such as email and files.
  3. You can enforce controls like mobile device management (MDM) software on the phone.

On a solar job, the person holding the phone is often a subcontractor. The data isn’t a spreadsheet but an identifiable person filmed inside their own home. And good luck telling an independent sparky you’re installing remote-wipe software on the phone they bought, pay for, and run their own business from.

So the question isn’t really “how do we secure devices?” It’s how you get consent, footage handling and evidence right when you don’t own the phone or employ the person holding it.

Subbie or employee: it changes where the rules live

I’ve watched plenty of install businesses blur this line, and it bites in more ways than tax. The Fair Work Ombudsman (n.d.) and the Australian Taxation Office (n.d.) both describe the distinction in terms of control, who supplies tools and equipment, whether the worker can delegate, and who carries financial risk.

The phone counts as a tool. If your subbie is genuinely an independent contractor, you have limited say over how they run their own equipment. That means your recording rules can’t sit only in an employee handbook they never signed. They need to go into the subcontractor agreement as contractual obligations, with consequences attached.

A couple of practical points follow from that:

Be careful not to overcorrect either. If your recording policy starts dictating exactly how, when and with what a subbie does every part of the job, you’re adding to the control indicators that make an arrangement look like employment. Keep the rules focused on customer data and evidence, which are legitimately your concern, not on how they do their trade. If you’re tightening up subbie arrangements generally, I’ve covered the broader picture in managing solar subcontractors.

This is where most businesses are weakest, because nobody thinks of a quick switchboard video as “recording a customer”. But if the customer is in frame or talking, that’s what it is.

Australia doesn’t have a single national rule for recording private conversations. Listening and surveillance device laws are mostly state and territory based, and they differ on whether one party to a conversation can lawfully record it or whether everyone involved needs to consent (Sprintlaw, 2026). If your crews cross state lines, or you run in more than one state, you’re working under more than one set of rules.

The safe operating position is simple: get express consent from the customer before any recording that captures them, their voice, or the private areas of their home, and document that consent. Don’t rely on the more permissive state rules. One consent standard for the whole business is far easier to train and audit than a state-by-state rulebook your subbies will never read.

A workable on-site consent script is short:

“Before I start, I’ll take some photos and a short video of the switchboard, metre and install area for our compliance records and your warranty file. They’ll be stored with your job file in our system, not shared anywhere else. Are you happy for me to do that? If you’d rather not be in any of it, just let me know and I’ll keep you out of frame.”

Then record the consent. That could be a tick-box on the job sheet with a timestamp, a line in the customer’s digital sign-off, or the customer’s verbal yes captured at the start of the video itself. What matters is that six months later you can show consent was given, when it was given, and what it covered.

If a customer says no, the subbie shoots the equipment only, with no people and no audio. That still covers most compliance photography. I go deeper on the conversation side in call recording consent for solar sales, and the doorstep version is in body cameras for door-to-door solar reps.

Once footage exists, it’s personal information

Identifiable video of a customer in their home is personal information. Add an address on the job sheet in the background, a face, or a voice discussing finance, and you’re holding exactly the kind of data that causes real harm if it gets out.

Whether the Privacy Act formally applies to your business depends partly on your size and what you do. Many small businesses fall under an exemption, but there are exceptions, so check where you stand instead of assuming. If you are covered, the OAIC (n.d.-a) explains that an eligible data breach likely to cause serious harm has to be notified to affected individuals and to the OAIC.

Now consider what a breach looks like with BYOD. A subbie’s phone is stolen from the ute. A subbie leaves on bad terms with 18 months of your customers’ homes in their camera roll. Someone shares an install video in a Facebook installer group to show off a tidy board, with the customer’s face and street visible. Each of those is a real exposure, and none of them involve anyone hacking your systems.

Even if you’re technically exempt, the reputational damage is the same. Customers don’t check the Privacy Act thresholds before posting a one-star review.

Get the footage off personal phones, fast

This is the operational heart of the policy. The longer customer footage sits on a personal device, the more places it spreads. In my experience, policies that say “store footage securely” without a deadline and a destination simply don’t get followed.

Spell it out:

You can’t easily audit a contractor’s personal phone, so the contract carries the weight here. Make the obligation clear, make the consequence clear, and make it easy to comply. If uploading takes four taps, it gets done. If it means emailing 30 videos to the office every Friday, it won’t.

Evidence only helps if it holds up

Now the upside. Good footage and photos are among the best protection a solar business has when a dispute arrives. A customer claims the install damaged their roof. A complaint says the system was never commissioned properly. An auditor wants proof of what was installed and how.

The Clean Energy Council (n.d.) has published guidance on installation documentation, and photo evidence is a routine part of showing compliant work. For disputes more broadly, LegalVision (n.d.) points out that whether a recording helps you depends heavily on how it was made, including whether it was lawfully obtained.

That’s the catch. Evidence that sat on a subbie’s phone for months, was forwarded through three chats and has no reliable timestamp or link to a job is weak evidence. Footage recorded without consent can be worse than none, because it turns your defence into a second problem.

For footage to actually protect you, you need:

  1. Documented consent from before recording.
  2. Reliable timestamps that weren’t edited or stripped by a messaging app’s compression.
  3. A clear link to the job: address, date, installer and system.
  4. Chain of custody: captured, uploaded, stored, and only accessed by the people who should see it.

That’s the same discipline I’ve always pushed when building audit-ready processes. The work isn’t capturing evidence; phones make that easy. The work is making sure it ends up somewhere you can find, trust and defend. If defects and rework are where most of your disputes come from, managing solar defect rectification goes through how to keep that trail clean.

What a workable policy should include

Keep it short enough for a subbie to read in five minutes. Put the obligations in the subcontractor agreement, and the practical steps in a one-page site guide. Cover:

None of this needs a lawyer to draft from scratch, though it’s worth having one review the contract clauses for the states you work in. What it does need is someone in the business owning it, and checking it’s actually happening on site.

Where I’m going with this

This exact mess is part of why I’m building CurrentFlow. The idea is that job photos and video will attach straight to the job record in a business-controlled system, captured on site, timestamped, and linked to the customer and install, instead of living in a subbie’s camera roll. It’s designed to turn a written BYOD policy into a workflow crews follow without thinking about it. It’s pre-launch, so if that’s a problem you’re living with, join the waitlist and tell me how you handle it today.

In the meantime, write the policy, put it in the subbie agreement, and pick one place for footage to live. That alone puts you ahead of most of the industry.

References

Australian Taxation Office. (n.d.). Difference between employees and independent contractors. https://www.ato.gov.au/businesses-and-organisations/hiring-and-paying-your-workers/employee-or-independent-contractor/difference-between-employees-and-independent-contractors

Clean Energy Council. (n.d.). Advice on documentation [PDF]. https://assets.cleanenergycouncil.org.au/documents/accreditation/CEC-Advice-on-Documentation-V1.pdf

eMonitor. (n.d.). BYOD monitoring policy guide and template. https://www.employee-monitoring.net/resources/byod-monitoring-policy-guide

Fair Work Ombudsman. (n.d.). Independent contractors. https://www.fairwork.gov.au/find-help-for/independent-contractors

LegalVision. (n.d.). Can I use a call recording in a legal dispute? https://legalvision.com.au/recording-dispute/

Office of the Australian Information Commissioner. (n.d.-a). Notifiable data breaches. https://www.oaic.gov.au/privacy/notifiable-data-breaches

Office of the Australian Information Commissioner. (n.d.-b). Workplace monitoring and surveillance. https://www.oaic.gov.au/privacy/your-privacy-rights/surveillance-and-monitoring/workplace-monitoring-and-surveillance

SecureSlate. (n.d.). BYOD policy: Template, requirements, and audit evidence for 2026. https://getsecureslate.com/blog/byod-policy

Sprintlaw. (2026). Business call recording laws in Australia. https://sprintlaw.com.au/articles/business-call-recording-laws/

Unió Digital. (n.d.). BYOD policy for business: Free template. https://unio.digital/blog/byod-policy-for-business

FAQ

Can a solar subcontractor film a customer on their personal phone?

They can, as long as it’s done properly. Get the customer’s express consent before recording anything that captures them, their voice or private areas of the home, document that consent, and move the footage into a business-controlled system quickly. Recording laws vary by state, so a single “always get consent” standard is the safest way to run a crew.

Should BYOD rules for subbies go in a policy or in the contract?

The contract. You have limited control over an independent contractor’s equipment, so recording, upload and deletion obligations should be written into the subcontractor agreement they sign before starting work. A one-page site guide can then explain the practical steps.

How quickly should job footage be removed from a personal phone?

Set a firm deadline: same day, or within 24 hours of leaving site. Upload to the job record, confirm it landed, then delete it from the camera roll and the recently deleted folder. No personal cloud backups and no messaging apps.

Is install footage useful evidence in a customer dispute?

It can be very useful, but only if it holds up. That means documented consent, reliable timestamps, a clear link to the specific job and a clean chain of custody. Footage that’s been forwarded through group chats or recorded without consent is much weaker, and may create a new problem for you.

Do I need to install MDM software on subcontractors’ phones?

Usually not, and most subbies would refuse anyway. For a solar business, the bigger wins are a clear contract, a consent process and a single business-controlled place for footage. MDM makes more sense for company-owned devices issued to employees.