A policy that nobody follows is just a document.  It might give you something to point to if things go wrong, but it won’t prevent the breach and it won’t impress a regulator who asks what you actually did. 

Because writing a policy that says “don’t use unauthorised apps” is easy. But getting people to stop is something else entirely. And that needs a combination of practical steps:

Give people a better option. The most effective solution is simple. If your team has access to Microsoft Teams, a business WhatsApp account via the API, or an enterprise AI tool, the temptation to use personal alternatives drops significantly. 

Make the training real. In support of your generic training, show your people what actually happens in YOUR business when things go wrong. The subject access request you can’t fulfil because the conversation was on someone’s personal phone. The data breach when a device is lost. The customer complaint you can’t investigate because the evidence is in a private chat. Make the training relevant and they’ll listen.

Build in consequences. Your acceptable use policy needs teeth. For employees? It becomes a disciplinary matter. For contractors, distributors, and installers, it goes in the contract – for example, approved communication channels specified in your data processing agreements.

Spot-check. Ask.  Just ask your people.  “How did you share that information with the customer?” If the answer is an unauthorised app, you know your policy isn’t working, and you have a trigger to act.