Laptop encryption explained: BitLocker, FileVault and recovery keys

What encryption does and does not protect

Disk encryption protects data at rest: when the laptop is powered off, or locked after a restart, the drive is unreadable. Pull the drive out and plug it into another computer, and all you see is noise. That is exactly the situation when a laptop is left in a taxi or taken from a car, which is why encryption is the single most important setting for any portable device.

It does not protect data while the computer is unlocked and in use. If malware runs while someone is logged in, or a thief grabs a laptop open on a cafe table, the files are as readable as they would be without encryption. Encryption also does nothing for data in email or cloud storage; those are protected by passwords, MFA and the provider's own security.

BitLocker on Windows

BitLocker is included in Windows Pro, Enterprise and Education editions. Most business laptops ship with Windows Pro and a security chip called a TPM, which stores the encryption key and releases it only when the computer boots normally. On those machines BitLocker runs silently: users sign in as usual and do not notice any difference, and the performance cost on modern hardware is negligible.

Windows Home is the trap. Some consumer laptops come with Home, which offers only a simpler device encryption feature that depends on a Microsoft account and lacks central management. If staff buy their own laptops or you pick up a bargain from a retail shelf, check the edition and upgrade to Pro before putting it into business use.

FileVault on macOS

Every current Mac includes FileVault, and on Apple silicon and T2-equipped Macs the drive is hardware encrypted already; turning FileVault on ties that encryption to the user's password. It can be enabled in System Settings or, better, enforced through a device management system so it cannot be skipped during setup.

As with BitLocker, the important part is the recovery key. If FileVault is turned on by the user without management, the key may be stored in their personal iCloud account or written down nowhere at all. A management system can escrow the key so IT can unlock the Mac if the user forgets their password or leaves the business.

Recovery keys: the part people get wrong

Every encrypted drive has a recovery key, a long number that unlocks it when the normal sign-in fails. Hardware changes, firmware updates and forgotten passwords can all trigger a recovery prompt. Without the key, the data is gone for good, which is exactly what encryption is designed to do. So the key must be stored somewhere safe that the business controls.

For Windows devices joined to Entra ID, BitLocker keys can be backed up automatically to the device record, where an administrator can retrieve them. For Macs, a device management system stores FileVault keys in the same way. Do not rely on keys printed and taped to the laptop, saved in a personal Microsoft account, or emailed to the user.

Rolling it out across the office

Start by checking what you already have. A management console or a quick check on each computer shows which devices are encrypted and where their keys are stored. Many offices find a mix: some laptops encrypted with keys in personal accounts, some not encrypted at all, and desktops that were never considered.

Then set a policy through Intune or your management tool that requires encryption, backs up keys centrally and reports compliance. Devices encrypt in the background over a few hours. Include desktops too, especially in reception areas or shared spaces, because burglaries take whatever is easy to carry. Set a deadline after which unencrypted devices are blocked from company email and files through conditional access, so stragglers get sorted rather than forgotten.

Proving it for insurers and clients

Cyber insurance applications, client security questionnaires and some industry codes ask whether portable devices are encrypted. A compliance report from your management system answers that in a page and shows the date each device last reported in. Keep a copy with your other security records and refresh it each year. Encryption also simplifies decisions after a loss. When a laptop goes missing, the report shows it was encrypted and when it last checked in, which supports a conclusion that no personal information was accessible and helps with the Privacy Act assessment.