A lost or stolen laptop is a security incident first and a hardware problem second. In the first hour you should lock the device remotely, reset the user’s passwords, sign them out of Microsoft 365 everywhere, and record what was on it. Whether you then need to tell the Information Commissioner’s Office depends on what the laptop could reach and whether it was encrypted.
Farnborough is a commuter town. Laptops leave offices on Farnborough Business Park and Cody Technology Park every evening, go home along the A331 or up the M3 from junction 4, and travel to London from Farnborough Main. Most of the lost laptops we hear about were left on a train, in a taxi or in a cafe, not stolen from a desk. The response is the same either way.
What should you do in the first hour after a laptop is lost or stolen?
Work through the list below in order, and do it before anyone goes looking for the laptop. Finding it later is a bonus. Assuming it is gone is the safe starting point.
- Tell your IT support straight away, with the user’s name, the device, and when and where it was last seen. If INDIGO IT looks after your IT support in Farnborough, this is a call to the Support Team, not an email that waits until morning.
- Lock or wipe the device remotely. A laptop enrolled in Microsoft Intune can be locked, signed out or wiped from the admin console, even if it is switched off: the command runs the moment it next connects to the internet.
- Reset the user’s Microsoft 365 password and revoke their active sessions. A thief with the laptop open has whatever the user was signed in to. Revoking sessions closes those doors, and the password reset stops them reopening.
- Check for other saved logins. Browsers, password managers left unlocked, VPN clients and remote desktop shortcuts all count. Reset anything the device could reach without a second factor.
- Write down what was on it. Client files, payroll, HR records, anything with personal data. You will need this list for the ICO decision below, and you will need it within hours, not days.
- Report the theft to the police and get a crime reference number if it was stolen. Your insurer will ask for it, and so might a client whose data was involved.
Do you have to report a lost laptop to the ICO?
Only if the loss is likely to put people’s rights and freedoms at risk, and then within 72 hours of becoming aware of it. That is the ICO’s own test under UK GDPR (ICO, Personal data breaches: a guide). A laptop that was fully encrypted, locked with a strong password and wiped remotely is usually a loss you record internally but do not report. A laptop that was unencrypted, or left signed in with client records on the desktop, usually is reportable.
Keep a short incident log as you go: the time you were told, who did what, and when. If the ICO or a client asks later, that log is what shows you acted properly rather than hoped for the best.
Two points catch businesses out. The 72 hours runs from when you became aware the laptop was gone, not from when you finished investigating. And “we don’t know what was on it” is not a reason to delay. Write down what you do know, make the decision, and record why you made it. The ICO is far harder on silence than on an honest early report.
The settings that turn a stolen laptop into a non-event
The first hour goes smoothly when the groundwork was done months earlier. The NCSC’s device security guidance (2026) sets out the standard, and for a small Farnborough office it comes down to five things.
- Full-disk encryption, which is BitLocker on Windows, switched on and the recovery key stored centrally, not on a sticky note. Without it, a thief can read the disk by moving it to another machine.
- Device management through Microsoft Intune or an equivalent, so lock and wipe are a button, not a wish.
- Multi-factor authentication on every Microsoft 365 account, so a saved password on its own gets nobody in.
- Files in OneDrive and SharePoint rather than on the desktop. The laptop is then a window onto your data, not the only copy of it.
- A written list of who has which device. If you cannot say what serial number was in which bag, you cannot say what has gone.
Do those five and a lost laptop costs you a replacement machine and an awkward conversation. Skip them and the same laptop can cost you a client, an ICO investigation and a very long week.
Why local support matters when a device goes missing
Speed is the whole game, and distance affects speed. INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, is around four miles from Farnborough via the A331 or A325. A replacement laptop can be set up from the Intune image, so the user is working again the same day, while the Support Team deals with the lock, the resets and the record you may need for the ICO.
If you are not sure your Farnborough business would pass the first-hour test, that is worth knowing before the test happens. Speak to Matt about a short review of your device setup, or start with our free Microsoft 365 security checklist and tick off encryption, Intune and multi-factor authentication yourself.
Frequently asked questions
What should I do first if a work laptop is stolen?
Tell your IT support immediately, then lock or wipe the device remotely, reset the user’s passwords and revoke their Microsoft 365 sessions. Assume the laptop is gone and treat it as a security incident. Record what data it held while the details are fresh.
Do I need to report a lost laptop to the ICO?
You must report a personal data breach to the ICO within 72 hours if it is likely to put people’s rights and freedoms at risk. An encrypted, locked and remotely wiped laptop usually does not meet that test. An unencrypted laptop holding client or staff records usually does.
Can a stolen laptop be wiped if it is switched off?
Yes. If the laptop is enrolled in Microsoft Intune, the wipe command waits in the console and runs as soon as the device next connects to the internet. Until then, full-disk encryption keeps the data unreadable, which is why both controls matter.
Is BitLocker enough to protect a lost laptop?
BitLocker encryption stops anyone reading the disk, which protects the files. It does not sign the user out of Microsoft 365 or protect saved browser logins, so you still need to reset passwords and revoke sessions. INDIGO IT recommends encryption, Intune and multi-factor authentication together.
