The first hour
Speed matters more than perfection. As soon as someone realises a laptop is missing, they should tell IT or the business owner, even if they think it might turn up. Waiting until the next morning gives a thief or finder time to try to get in, and the longer a device stays signed in to Microsoft 365, the more chance there is of someone reading email or synced files.
If the laptop is managed through Intune or a similar tool, IT can issue a remote lock or wipe. These commands run the next time the device connects to the internet. At the same time, reset the user's password, sign them out of all sessions in Microsoft 365 and revoke any device tokens, so a stolen machine cannot keep using saved credentials.
Was it encrypted?
This is the question that decides how serious the loss is. With BitLocker on Windows or FileVault on a Mac turned on, the data on the disk is unreadable without the user's sign-in or the recovery key. A thief can reinstall the operating system and sell the hardware, but cannot read what was on it. Check the management console for the device's encryption status and the date it was last seen.
If the laptop was not encrypted, assume anything stored locally could be read. That includes documents in the Downloads folder, email cached by Outlook, browser saved passwords and synced copies of OneDrive or SharePoint libraries. Make a list of what was likely on it, because you will need that for the privacy assessment.
Privacy obligations
Under the Privacy Act 2020, a privacy breach that is likely to cause serious harm must be notified to the Privacy Commissioner and to affected people as soon as practicable. An encrypted laptop with a strong password usually does not meet that threshold, because the information is not accessible. An unencrypted laptop holding client records, health information, IRD numbers or identity documents may well do.
Work through it honestly: what information was on the device, how sensitive it is, who it relates to and how likely misuse is. The Commissioner's office has an online tool and guidance to help. Record your reasoning either way; if you decide not to notify, you should be able to explain why.
Police and insurance
If the laptop was stolen, report it to Police online or at a station and keep the file number. Your insurer will want it for a hardware claim, and it is useful if the device later turns up. Include the serial number, which should be in your asset register or on the original invoice. If the laptop was simply lost, check with the venue, taxi company or airline before assuming theft. Business contents insurance usually covers the hardware. A cyber policy may cover the cost of a privacy assessment, legal advice and notifications if data was exposed. Tell both insurers early, because late notification can complicate a claim.
Getting the person working again
With cloud-based files and email, a replacement laptop can be ready quickly. If devices are enrolled with Windows Autopilot or Apple Business Manager, a new machine can be shipped straight to the user and configures itself when they sign in, pulling down apps and settings automatically. Without that, a technician sets it up by hand, which takes longer but still works. Before handing over the replacement, check whether anything was stored only on the lost laptop. Files saved to the desktop or a local folder outside OneDrive are gone unless there was a separate backup, which is a good argument for redirecting those folders to OneDrive on every machine.
Preventing a worse outcome next time
Most of the risk from a lost laptop is removed in advance by three settings: full disk encryption on every device with recovery keys stored centrally, device management that allows remote lock and wipe, and known folders redirected to OneDrive so nothing important lives only on the machine. Add an asset register with serial numbers and a short written procedure so staff know exactly who to tell.
It also helps to remind people of simple habits: never leave a laptop visible in a parked car, lock the screen when stepping away, and do not write the password on a note in the laptop bag. These sound obvious, yet they come up in loss reports again and again. A short reminder at a team meeting once or twice a year costs nothing.
In short
- Report a missing laptop immediately, even if it might turn up
- Remotely lock or wipe it, reset the password and revoke sessions
- Encryption status decides whether it is a hardware loss or a data breach
- Assess Privacy Act notification and record your reasoning
- Prepare in advance: encryption, device management and OneDrive folder redirection