A lost laptop response plan for a small business

A missing laptop creates several different problems. Someone may read files stored on it, use an active account session or disrupt the business by taking the only copy of important records. A response that asks only whether the device had a login password misses much of the situation.

Start with the device and the information it could reach. A laptop used for customer support might contain downloaded identity documents, browser sessions and a synchronised folder even if the main database sits in a cloud service. The inventory should guide the response, rather than an assumption that all data stayed elsewhere.

As of 22 October 2026, the main DPDP duties are scheduled for 13 May 2027 under the commencement notification. The steps below are a recommended response approach; current CERT-In and other obligations require their own applicability assessment.

Establish the facts without waiting for certainty

Record when the device was last seen, when the loss became known, the user, the device identifier and the places it may have been left. Ask whether it was powered on, unlocked or connected to work accounts when last used. Treat uncertain answers as uncertain.

Identify the business systems, local files and removable media involved. Check whether the employee recently exported a customer list or downloaded documents for offline work. A standard device specification does not reveal every file a particular person saved yesterday.

Assign someone to coordinate technical action and someone to maintain the chronology. In a small business, these may be the founder and the IT supplier, but the business still needs an internal owner for decisions.

Examine controls as evidence, not reassurance

Determine whether storage encryption was enabled and appropriately managed, whether the device was locked and what account protections were active. Evidence from the management system is more useful than a general policy saying all devices should be encrypted.

The future Rule 6 safeguards include appropriate protection, access controls, monitoring and continuity measures. Encryption is relevant to the assessment, but it is not a universal conclusion that no personal data breach or notification question can arise. Active sessions, exposed credentials and available evidence still matter.

The Act’s breach definition includes confidentiality, integrity and availability. Losing the sole usable copy of personal data may therefore raise a different concern from disclosure, even where no outsider is known to have read the device.

Coordinate containment and recovery

Use authorised administrative routes to restrict relevant sessions and accounts, change exposed credentials where appropriate and assess remote lock or wipe options if available. Document what each action is intended to achieve and what evidence it may affect.

Remote actions depend on the actual system and device state. Do not tell management that a device has been wiped merely because a command was queued. Record whether the command was confirmed, remains pending or cannot be executed.

A hypothetical estate agency loses a laptop containing a local property-enquiry spreadsheet. Its IT provider disables the agent’s cloud sessions, but the spreadsheet remains a separate concern because it may be stored locally. The response must track both routes rather than declaring the incident closed after the account change.

Assess reporting and affected people

The CERT-In Directions impose six-hour reporting for specified cyber incidents affecting covered entities, measured from noticing or being brought to notice. A lost device is not a reason to assume every possible reporting route automatically applies, nor a reason to ignore an incident that falls within a reportable category. Assess the facts promptly and seek appropriate expertise where needed.

For future DPDP readiness, Rule 7 provides information requirements for personal data breaches, including initial communications without delay and a separate detailed Board update. Do not import a blanket exemption simply because encryption was mentioned in the device policy.

If people need protective information, base it on the actual data and consequences. Avoid telling customers that payment details were unaffected until the relevant systems and files have been checked.

Close the operational gaps revealed

After the immediate response, review why the laptop contained the information, whether local copies were necessary and whether recovery arrangements worked. Restore business access through a controlled process and verify that replacement equipment receives the intended safeguards.

Keep the incident chronology, control evidence, decisions and unresolved limitations. The useful outcome is a clearer understanding of what the missing device could expose and what the organisation has done about it. A recovered laptop or a submitted wipe command may be good news, but neither alone answers every question about the data.