TL;DR:

  • A lost or stolen work laptop is a personal data breach under GDPR if it contained personal data — and almost every work laptop does. You have 72 hours from becoming aware of the breach to report it to the ICO if it meets the risk threshold
  • Encryption is the single most important protection: an encrypted laptop with a strong password that is lost or stolen is generally not a reportable breach, because the data cannot be accessed without the key
  • Remote wipe is the immediate priority once a device is reported missing — most Microsoft 365 and Google Workspace accounts can do this without additional software

The First 30 Minutes

When a staff member reports a laptop missing, the clock starts. Here’s what to do in order:

1. Establish the facts immediately. Ask: when was it last seen, where, could it still be there (left on a train that hasn’t reached lost property, in a meeting room), and was the screen locked or the laptop shut when it was last seen? If there is any reasonable chance it was left somewhere accessible, call ahead before escalating to a full incident response. Many “stolen” laptops turn up in meeting rooms.

2. Attempt remote location. If the device runs Windows with Find My Device enabled, check via account.microsoft.com. For Apple Macs, check iCloud’s Find My. For enrolled mobile devices or laptops under MDM (Microsoft Intune, Jamf, Mosyle), check the MDM console for last location and connectivity status. This helps confirm the device is actually missing and provides a last-known location.

3. Trigger remote wipe. If you cannot locate the device and it is confirmed missing, initiate a remote wipe as soon as possible. A remote wipe sends a command that will execute the next time the device connects to the internet.

For Microsoft 365-enrolled devices via Intune:

  • Microsoft 365 Admin Centre → Devices → Select device → Wipe

For Apple devices via iCloud:

  • iCloud.com → Find My → Select device → Erase Device

For Google Workspace:

  • Admin Console → Devices → Select device → Wipe device

The remote wipe may not execute immediately if the device is offline. It will complete once the device connects to Wi-Fi or mobile data.

4. Change passwords immediately — from a different device. The missing laptop may have saved credentials in the browser or in cached app sessions. Change the password for:

  • Microsoft 365 or Google Workspace (the user’s primary work account)
  • Email
  • VPN credentials
  • Any other work SaaS tools the user accesses — check your list of apps in your identity provider if you use one (Microsoft Entra, Okta, Google)

Changing the Microsoft 365 or Google Workspace password typically invalidates cached sessions on the lost device, even before the wipe executes.

5. Revoke active sessions. In Microsoft 365 Admin Centre: Users → Select user → Manage Microsoft 365 licence → Revoke all sessions. In Google Admin Console: Users → Select user → Reset sign-in cookies. This immediately signs the account out of all sessions, including any on the missing laptop.

Assessing the Breach

Under UK GDPR, losing a laptop is a personal data breach if the device contained personal data. Almost all work laptops do — email, documents, spreadsheets with customer or employee information, cached browser data. The question is whether you need to report it to the ICO (Information Commissioner’s Office).

The ICO’s reporting threshold is whether the breach “is likely to result in a risk to the rights and freedoms of natural persons.” You must report within 72 hours of becoming aware of the breach if:

  • The data contained sensitive categories (health, financial, HR information)
  • The volume of data was significant
  • The device was not encrypted

If the laptop was encrypted with a strong password: An encrypted device cannot be accessed without the encryption key. If your Windows laptops use BitLocker with a strong user password (not the default TPM-only configuration, which decrypts automatically on boot), or your Macs use FileVault, the risk from a stolen encrypted device is very low. The ICO guidance is that encrypted devices are unlikely to meet the reporting threshold, though you should still document the incident.

If the laptop was not encrypted: The data on the device is potentially accessible. Depending on what was stored, this may be a reportable breach. If customer personal data, employee data, financial records, or health information were on the device, you should report to the ICO.

How to report: Report online at ico.org.uk/report-a-breach. You’ll need: when the breach occurred, when you became aware of it, a description of the data types and estimated number of individuals affected, likely consequences, and measures taken. The ICO response time varies; for lower-risk incidents they may simply acknowledge receipt.

Reporting to the Police

Report the theft to Action Fraud (0300 123 2040 or actionfraud.police.uk) and obtain a crime reference number. You will need this for your insurance claim. If there is any possibility of CCTV footage at the location of the theft, report to your local police station directly so they can request it before it is overwritten.

For higher-value losses or where there is specific intelligence about who may have taken the device, contact your local police non-emergency line.

Insurance

If you have business insurance with IT equipment cover or a standalone cyber insurance policy, notify your insurer promptly. Business contents policies often cover theft of IT equipment, subject to exclusions — check whether there are requirements for evidence of forced entry (for office break-ins) or whether portable equipment cover is included. The crime reference number from Action Fraud is typically required to make a claim.

If your cyber insurance policy covers data breach response (many SMB cyber policies do), notify your insurer of the potential breach at the same time — they may have a breach response hotline and can help with the ICO notification process.

What to Have in Place Before This Happens

The difference between a lost laptop being a minor incident and a major one is almost entirely determined by whether you had the right protections in place beforehand.

Encryption (essential):

  • Windows 10/11 Pro and Enterprise include BitLocker. Enable it via Control Panel → BitLocker Drive Encryption. Save the recovery key to your Microsoft account or print it — if staff lock themselves out this is the only recovery route
  • Windows Home does not include BitLocker. If any staff have Windows Home laptops, consider upgrading to Pro (£30–£50 per licence) or migrating to an alternative like VeraCrypt
  • macOS FileVault is built in and can be enabled in System Settings → Privacy & Security → FileVault. Recovery key should be stored with your Apple Business Manager or an escrowed key

Screen lock (essential): All laptops should lock automatically after a maximum of 5 minutes of inactivity. This ensures that a device lost while the user has stepped away briefly is protected from immediate access without requiring encryption to protect it. Set this via Group Policy (Windows) or system preferences (Mac).

Remote management (recommended): If you use Microsoft 365 Business Premium or above, Microsoft Intune device management is included. Enrolling laptops in Intune enables remote wipe, remote lock, compliance enforcement (requiring encryption), and location tracking. For smaller teams using Macs, Apple Business Manager with Jamf (or the cheaper Mosyle Business) provides similar capabilities.

Inventory (basic but critical): Maintain a simple spreadsheet of every work device: who has it, the serial number, the model, and whether it is encrypted. Without this, you cannot complete an ICO breach report accurately and you won’t know what you’re dealing with when the first call comes in.

A simple policy: Make sure all staff know: report a missing work device immediately, don’t wait to see if it turns up. The 72-hour ICO clock starts when the business becomes aware, not when the device was lost. Delayed reporting can turn a manageable incident into a compliance problem.

What About Lost USB Drives and Phones?

The same principles apply. Unencrypted USB drives are particularly high-risk because they often contain whatever was most recently worked on, are physically small and easily lost, and have no remote wipe capability. Use encrypted USB drives (Kingston IronKey, Apricorn, or similar) for any work data, or configure group policy to block USB storage entirely if staff do not need it.

Work phones enrolled in your MDM system can typically be wiped via the same admin console as laptops. If a member of staff’s personal phone is used for work email (BYOD), revoke the work account access from the admin console rather than wiping the whole device — most MDM systems support selective wipe of just the work container.

References