Maybe it's because I've had a reasonable amount of exposure to the security measures taken by large companies (and the associated unpleasant legal measures that can be taken) but I follow these rules:

- No corporate data on personal devices (not even email)

- I expect to be given a work smartphone

- I use my own phone and iPad for personal stuff

- Assume that anything you do through a device attached in any way (even a VPN) to a corporate network may have everything you do monitored

Of course, these rules apply mostly when you are working for a large company, but even when you are in a startup you occasionally may have to work at a client site - and often these are large corporates.