I am sure it can be even worse than what you describe. I, however, do not aspire to taste it. The question is not what "inconvenience looks like", but rather,

I am sure it can be even worse than what you describe. I, however, do not aspire to taste it. The question is not what "inconvenience looks like", but rather, what is "enough security with the least inconvenience?" The alternative is in the answer to that question: if your "measure" is likely to be "bypassed", it is worse than not having it in the first place (because bypassing usually puts sensitive data on even worse medium like flash devices, public cloud, external servers etc). If your security policy was simply "Do not keep sensitive work data on unencrypted storage" and had informed your employees they are legally liable to adhere to this, they would either choose to not use personal devices or understand the risks if they do. So like always, getting to that point requires "simply" being reasonable and smart ("common sense" which is, unfortunately, "not that common").