What to do if a work laptop is lost or stolen

Before anything else, find out whether the disk was encrypted with BitLocker (Windows) or FileVault (Mac) and whether it was on at the time of loss. If the laptop is managed by Microsoft Intune or another device management tool, the device record usually shows encryption status and the last check-in time. Screenshot that record now; it's the evidence you'll rely on later.

Then ask the user some plain questions: was it shut down, asleep or signed in when it went missing? Was the password written down with it? Was a USB drive or paper file in the same bag? A powered-off, fully encrypted laptop with a strong sign-in is a very different situation from an unlocked one left in a café.

If the device is enrolled in Intune, admins can send remote actions such as Wipe (factory reset) or Retire (removes company data and management while leaving personal content). The command only runs when the laptop next connects to the internet, so it is a safety net, not a guarantee.

Don't wipe automatically in every case. If the laptop may be recovered by police, or if it is central to an investigation (for example, you suspect an insider took it), wiping destroys evidence. In most ordinary theft cases with sensitive data on board, a wipe is the right call. Make the decision deliberately and write down why.

• Revoke the user's Microsoft 365 or Google Workspace sessions so a signed-in browser or Outlook on the laptop stops working.
• Reset the user's password, and any passwords saved in the laptop's browser or password manager if it wasn't locked.
• Disable the device in Microsoft Entra ID so it can't satisfy device-based Conditional Access.
• Rotate VPN certificates, Wi-Fi keys or SSH keys stored on the device.
• Check for sign-ins from the device after the time of loss; that's your best evidence of whether someone used it.

Report a theft to the local police and keep the occurrence number. Give them the serial number and asset tag. If you have insurance that covers equipment or cyber events, notify the insurer and ask what it needs.

Under PIPEDA, a breach of security safeguards includes the loss of personal information. You must report to the Office of the Privacy Commissioner of Canada and notify affected individuals where it is reasonable to believe the breach creates a real risk of significant harm, based on the sensitivity of the information and the probability it will be misused. Strong encryption with the key not compromised is a key factor in that assessment.

Whatever you conclude, the Breach of Security Safeguards Regulations (SOR/2018-64) require you to keep a record of every breach of security safeguards for 24 months. The record should show what was on the device, the encryption evidence and how you reached your conclusion. Health information custodians in Ontario, public bodies, and organizations covered by Quebec, Alberta or BC law may have additional duties.

• Enforce disk encryption through device management and alert on any device that isn't compliant.
• Keep recovery keys escrowed centrally, not on sticky notes.
• Store work files in OneDrive or SharePoint rather than only on the local disk.
• Require a short screen-lock timeout and sign-in on wake.
• Keep a current asset list with serial numbers and assigned users.