Guide

Lost or stolen work laptop? Why encryption decides what happens next

Laptops get left on trains, taken from cars and forgotten in cafés. Whether that's an inconvenience or a reportable data breach comes down mostly to one setting. Here is what to do if a laptop goes missing, and how to check your devices today.

By Sara Martin, Operations & Marketing Director
· 3 min read

If a lost or stolen work laptop was encrypted, and the password wasn't with it, the data on it can't be read, so it's usually an inconvenience rather than a data breach. If it wasn't encrypted, whoever has it can read the files, emails and saved passwords on it, and you may need to report it to the ICO within 72 hours. Windows (BitLocker) and Macs (FileVault) have encryption built in. The problem is usually that nobody has checked it's switched on.

Why encryption decides what happens next

The ICO's own examples of personal data breaches include an employee who lost a briefcase containing a laptop and paper files about a court case. The business didn't report it at first, believing the laptop was encrypted. When IT found it wasn't, the business had to report it to the ICO and tell the people affected. In the ICO's words: "As the laptop was unencrypted, there was no way for the controller to know whether the data had been accessed."

That's the point. With an encrypted laptop, you can show the data was unreadable. Without encryption, you can't prove nobody looked, so you have to assume they might have.

Taking the drive out and plugging it into another computer gets around a Windows or Mac password in minutes. Encryption is what stops that.

What to do if a work laptop goes missing

Work through these in the first hour:

  1. Report it straight away, to whoever looks after your IT. The sooner it's known, the less time anyone has with it.
  2. Change the user's password and sign them out everywhere, especially Microsoft 365 or Google Workspace. Saved passwords and signed-in browsers are often a bigger risk than the files.
  3. Lock or wipe it remotely if it's managed by a device management tool. It only happens when the laptop next connects to the internet.
  4. Check whether it was encrypted. If you manage encryption centrally, the console shows it. If you have to guess, assume it wasn't.
  5. Work out what was on it. Client files, personal data, anything saved locally rather than in the cloud.
  6. Record it in your breach log, whatever you decide about reporting. Our guide, Do we need to report a cyber attack?, explains when you must tell the ICO and the people affected.
  7. If it was stolen, report it to the police and get a crime reference number. Your insurer will ask for it.

How to check your laptops today

On Windows: open Settings, search for "BitLocker" and choose Manage BitLocker. The drive should show "BitLocker on". On some laptops it appears instead under Settings, Privacy and security, Device encryption.

On a Mac: open System Settings, Privacy and Security, then FileVault. It should say FileVault is turned on.

While you're there, check two other things:

  • Where the recovery key is kept. Windows often saves it to whichever Microsoft account set the laptop up, which may be someone's personal account. If that person leaves, or forgets which account it was, you can be locked out of your own laptop.
  • The sign-in password and screen lock. Encryption protects a laptop that's switched off or locked. A laptop stolen while signed in, or with a password stuck to it, isn't protected. Set screens to lock after a few minutes.

Doing it across the business

Checking one laptop is easy. Knowing that every laptop is encrypted, including the one bought last week, is harder. Managing it centrally means:

  • Encryption is applied by policy, so new laptops are covered without anyone remembering.
  • Recovery keys are kept by the business, not in personal accounts, so a locked-out user can be helped back in.
  • You can prove which devices are encrypted, which cyber insurers, clients and auditors increasingly ask.

Phones and tablets need the same thinking: a passcode, and a way to wipe company data remotely. Mobile device management does that, including on staff-owned phones.

Where we can help

Our disk encryption service switches on and manages the BitLocker and FileVault already built into your laptops, keeps the recovery keys safe in one console and shows you which devices are protected. It's £2 per user per month, excluding VAT, alongside our device protection. If a laptop has already gone missing, talk to us and we'll help you work through it.

Questions

Only if it held personal data and the loss is likely to put people at risk. If the laptop was encrypted and the password wasn't with it, the data can't be read, so it's usually not reportable, but record it in your breach log either way. If it wasn't encrypted, you probably can't rule out a risk, so you'll need to consider reporting within 72 hours.
Full BitLocker is included in Windows 10 and 11 Pro, Enterprise and Education. Windows Home has a simpler version called device encryption on supported hardware. Business laptops should be on Pro or higher anyway.
Not noticeably on a modern laptop. Once the drive is encrypted, people sign in and work as normal.
Yes, if it was set up for it in advance through a device management tool, and only once it connects to the internet. A thief may never let it connect, which is why encryption, which works offline, matters more.
Where to go next

< Back to Guides

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

Talk to us
or
See every security area

Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us

Get Protected Ask a question