It is a right in EU to have some level of personal activity on work-supplied devices. This does not come from the GDPR but some other legislation. We had a call with HR about that only recently when some leader again suggested "just block xyz on work devices".

And if you don't want to use BYOD we are required to supply a phone if we require employees to use one (which we do, for MFA).