Personal Files on a Work Mac With IT Access. What Is Actually Private?

The situation

Your employer gave you a Mac. You also have personal photos and documents on it, maybe a scan of an ID or a medical letter. You wonder who can see them.

Two different questions hide in that one. The first is what your employer can reach. The second is what a colleague, a thief or a repair shop can reach. A lock on your files answers the second one well and the first one badly.

This page is about protecting your own personal files and understanding what management means. It does not help you remove, bypass or switch off your employer's profiles, monitoring or security tools. Those belong to your workplace, and you should leave them alone.

Find out whether your Mac is managed

1. Open Device Management

   Choose Apple menu > System Settings, click General in the sidebar, then click Device Management. You may need to scroll down. Apple says this is where you install, view or remove configuration profiles.

2. Read the profile list

   Double-click a profile to see its details. Apple describes profiles as files that standardize settings, such as a Mail account, Wi-Fi and VPN settings, for a school or workplace network.

3. Notice what you cannot remove

   Apple says some profiles can only be removed by an administrator, and that removing one deletes all of its settings and information. If you cannot remove one, ask the person who provided it. Do not remove one from a work Mac without asking.

4. Ask in writing

   Ask IT what is monitored on this Mac, what is backed up and who can read it. A written answer settles more than a guess.

What Apple says management can do and see

• Apple says device management lets an organization send configurations, profiles and commands, update software and settings, monitor compliance with its policies, and remotely lock or wipe devices.
• Apple lists what a service can query on a Mac, such as serial number, hardware model, free storage, battery level, supervised status and a list of logged-in users. That page lists no file contents, mail or browsing history. It lists location only for supervised iPhone and iPad devices in Managed Lost Mode.
• Apple says a supervised Mac shows "This Mac is supervised and managed by" and the organization name in the Device Management pane.
• Apple says a business or school can set a recovery key to unlock a Mac's disk, and its deployment guide describes a service that receives an escrowed recovery key and can hide it from you. The recovery key guide has the details.
• An empty Device Management list does not prove a Mac is unmonitored. Apple's pages describe its own management framework, not other software an employer may install. Your policy is the real answer.
• Turning on FileVault protects a lost or stolen Mac. It does not hide files from people who hold a recovery key or from software that runs while you are logged in.

The safer setup

1. Keep personal files on a personal device. This is the only dependable fix. A work Mac belongs to someone else.
2. Do not move your personal photo library onto the work Mac. If you must view something personal, treat it as visible to your employer.
3. Read the acceptable-use policy. It says what the company may monitor and whether extra encryption tools are allowed.
4. Never copy company data into a personal vault. That can break policy and the law, and it is not what this guide is for.
5. Before you return the Mac, ask IT what to do. Erasing personal data is your job; erasing company data is theirs. Selling or repairing your Mac covers a personal Mac.

Where a vault fits

Hidden Folder is designed for a Mac that is yours. Its threat model lists malware or a keylogger on an unlocked Mac as out of scope, which is the same limit as above. On a work Mac it would help only against casual access, such as a colleague at your open laptop. Some employers restrict extra encryption software on managed devices, so check your policy before you install anything.