Lost work laptop: what should your small business do next?
Report a lost work laptop to your existing IT or security support through a trusted route straight away. Do not wait until you have searched everywhere or completed a checklist. Give the facts you know, say what is uncertain, and agree who will coordinate the response.
The immediate job is not just replacing a computer. It is understanding what information and accounts might be exposed, limiting that exposure, and helping the business keep working. This guide is for the owner or manager coordinating those decisions—not a substitute for incident support.
Report the loss without waiting for perfect information
Make it easy for the person involved to report quickly and without blame. A missing laptop is not automatically confirmed theft, and uncertainty is not a reason to delay telling IT.
Share these details where available:
When the loss was noticed, when and where the laptop was last seen, and who was using it.
The device name or asset number, if known. Do not delay the report to find it.
Whether it was in use, locked or shut down when last seen, if the person can remember.
The work accounts, downloaded files or other information that might be involved. Mark guesses as unconfirmed.
A safe way to contact the person while their usual computer is unavailable.
Follow your organisation's reporting arrangements. The NCSC's advice for device users is to report a lost or stolen device to IT promptly and not put yourself at risk. Do not confront someone or enter an unsafe place to retrieve it.
Give the response an owner—not three disconnected conversations
Name one person to keep the incident record and coordinate updates. They do not have to perform the technical work. Three responsibilities can run alongside each other:
The person involved supplies known facts and reports new information.
IT or security support checks the actual device protection, account access and available response options.
The business owner or designated lead coordinates the information-risk assessment, business continuity and any advice or notifications needed.
Do not wait for every technical action to finish before considering the risk to people whose information may be involved. Equally, do not treat a manager's assumption that “everything is in the cloud” as evidence that nothing was stored on the laptop.
Ask IT to confirm what is protected and what has happened
Your authorised support team should establish the relevant facts: whether encryption was active, whether the device was managed, which accounts or sessions could be accessible, and what actions are appropriate for this particular device and setup.
A password, an encryption policy or a Microsoft 365 licence is not, by itself, proof of the laptop's state when it disappeared. Keep unverified details open rather than marking them safe.
Leave potentially destructive actions, such as a remote wipe, to the authorised team. Ask them to record both the action requested and the result they can verify. Microsoft's Intune guidance explains that an offline device may leave a wipe pending; a pending status can also remain when completion was not reported back. “Wipe requested” is not the same as “wipe confirmed”—and “pending” alone does not prove failure.
Tracking, locking or wiping will depend on the device, configuration and available service. None should be assumed to work on every missing laptop.
Assess the information risk while the response continues
Ask the person responsible for data protection to assess what information may be involved, who could be affected and the likely consequences for them. In a small business, that may be the owner working with appropriate advice.
The ICO's personal data breach guide explains when a breach must be reported. Notify the ICO unless the personal data breach is unlikely to result in a risk to individuals’ rights and freedoms. Where notification is required, do so without undue delay and no later than 72 hours after becoming aware of the breach. A likely high risk to individuals brings a separate requirement to inform them without undue delay. Missing details can be supplied in phases.
Not every lost laptop requires notification. Record the assessment and reasons for the decision, including a decision not to notify, and revisit it if evidence changes. Do not wait for a wipe result or assume encryption settles every question. This is general guidance, not a determination about your incident.
A lost work laptop example: keep unknowns visible
Hypothetical example—not a Cache4 customer case. A colleague reports that their laptop is missing after a journey. They know when they last used it but cannot confirm whether a customer document was downloaded locally.
The manager records the time of the report and appoints a response owner. IT checks the device record and takes the access-protection actions it considers appropriate. The data-protection lead starts assessing the possible information exposure at the same time.
If a remote action shows “pending”, the record stays explicit: action requested; completion unverified; IT owns the next check. The downloaded-document question also stays open, with an owner to investigate it. This keeps the next decisions visible without treating an unverified action as a completed response.
Use a short record like this in a restricted location available to the people handling the incident:
Facts and times: noticed, last seen, reported; device identifier if known.
Unknowns: data, account access and protection still to be checked.
Action: what was requested, by whom and when.
Evidence: confirmed result and where that evidence is held; otherwise “unverified”.
Assessment: responsible person, decision and reasons.
Next step: owner, concrete action and agreed update time.
Do not put passwords, recovery keys or unnecessary personal information in this record. An update time is a coordination commitment, not proof that the incident will be resolved by then.
Restore working safely, then improve the preparation
Coordinate replacement access and recovery with the response team. Check which work is available from approved shared storage or backups, and what remains missing. Our guide to checking a backup restore explains why a successful job message is different from a usable, checked result.
If the laptop is found, tell IT before returning it to normal use; follow their checks, particularly if tampering is suspected. Finding the hardware does not automatically close the access or information questions.
After the immediate response, review the device inventory, verified encryption, account protection, recovery arrangements and staff reporting route. The Cyber Essentials checklist is a useful starting point for wider controls—not an incident-response service.
Plan better protection before the next incident
Cache4's managed cyber security covers agreed protection, monitoring, updates and backups. A discovery call can help you discuss your current arrangements and the gaps worth addressing.
For a device that is missing now, use your existing IT or security support route immediately. The discovery call below is for prevention planning, not emergency support.
Comments