Lost or stolen laptop: what an SME should do in the first hour

Why the first hour matters

A laptop that has just gone missing is often still signed in to Microsoft 365. Email, Teams, OneDrive and SharePoint then open without a new sign-in, and a browser may hold saved passwords for other systems. A finder or thief who opens the device before you act sees what the employee saw.

Time also matters because the GDPR (General Data Protection Regulation) sets a deadline: a data breach that poses a risk to the people concerned must be reported to the Dutch Data Protection Authority within 72 hours. Whether a lost laptop is a reportable breach depends mostly on whether the data on it was encrypted. You want to establish that quickly, not after a weekend of searching.

The steps in order

As soon as an employee reports that the laptop is gone, work through this list:

• change the password: set a new password for the employee’s Microsoft 365 account;
• revoke sign-ins: revoke all active sessions in Microsoft Entra ID, so apps on the device ask for a new sign-in;
• lock or wipe the device: if the laptop is managed through Intune, lock it remotely or wipe it; then disable the device in Microsoft Entra ID, so it no longer counts as a trusted device;
• check encryption: look in the admin portal to see whether BitLocker was active and whether the recovery key is stored safely in the tenant;
• assess the breach: establish which data was on it and whether it was encrypted, and record your decision about reporting, even if you do not report;
• file a police report: in case of theft the employee reports it to the police; you often need that report for insurance too.

For a few days afterwards, keep an eye on the account’s risky sign-ins. A sign-in attempt from an unknown location shortly after the loss is a signal to look further.

What to arrange in advance

The steps above only work if the groundwork is already there. A laptop that is not in Intune cannot be wiped remotely. A drive without BitLocker protects nothing. And without a fixed reporting point, you only hear about it when the employee comes into the office the next morning.

So make sure every business laptop is managed, that encryption is checked through device compliance and that files live in OneDrive or SharePoint rather than only on the laptop. Then a lost laptop is mostly a matter of handing out a new device, not of lost work.

What to sort out this month

Keep the first step small enough to actually carry out:

• agree on one reporting point for lost or stolen devices, also outside office hours, and tell the team;
• check that all business laptops are in Intune and that BitLocker is on everywhere;
• write the steps above on one page, with who carries out which step;
• record how you assess a possible data breach and where you keep that decision;
• practise it once with a test device: lock it, revoke sessions and hand out a replacement laptop.

What not to do on day one: wipe a laptop immediately before you know whether work was stored on it that exists nowhere else. Lock it first, check what is in OneDrive, then wipe.

How Floor ICT sets this up — and what you decide

Floor ICT makes sure business laptops are managed and encrypted, agrees the steps for loss or theft with you and carries them out as soon as you report a loss: revoking sessions, locking or wiping the device and preparing a replacement laptop. Reports go through the same contact person as the rest of your IT, just like joiners and leavers.

You decide whether a loss is reported as a data breach, whether a laptop is wiped straight away or stays locked first, and what employees should do when they lose a device themselves. We provide the facts about encryption and access; the decision stays with you.