A consultant has lost a laptop. What happens in the first hour?

Part of our complete guide to IT support for recruitment firms.

A laptop left on a train holds more than a laptop. It holds candidate CVs, salary expectations, client contacts and, very likely, a CRM that's still logged in. What you do in the first hour shapes whether this stays an expensive inconvenience or becomes something you have to report.

The first hour, in order

1. Get the facts and note the time. When was it last seen, where, was it locked, was the disk encrypted, and who else knew the password? Every answer feeds the decisions below.
2. Cut the sessions. Reset the consultant's password, sign them out everywhere, and revoke access to the CRM or ATS, email, job boards and LinkedIn Recruiter. Do this first, because a remote wipe only runs once the laptop next connects to the internet.
3. Lock or wipe the laptop remotely, if it's enrolled in device management. The ICO advises wiping a stolen laptop remotely where you have the systems to do it.
4. If it was stolen, report it to the police and keep the crime reference number. Your insurer is likely to ask for it.
5. Start a log. What happened, who's involved and what you've done about it, with times. The ICO advises keeping one even if you think the incident won't need reporting.

Does it have to go to the ICO?

Under UK GDPR you report a personal data breach to the ICO within 72 hours of becoming aware of it, unless it's unlikely to result in a risk to the people whose data is involved. The ICO says the clock starts when you discover the breach, not when it happened. You also have to document every breach, whether you report it or not.

Encryption is where most of the weight sits. The ICO publishes a case study of an employee who lost a briefcase containing a work laptop and paper files. He believed the laptop was encrypted. The organisation first decided not to report, then reported to the ICO and told the people affected once IT confirmed the laptop wasn't encrypted and the paper files weren't redacted. With an unencrypted laptop, there was no way to know whether the data had been accessed.

For a recruitment firm the lesson is simple. Believing a laptop is encrypted and knowing it is are different things.

Check these before it happens

• Every laptop has full disk encryption switched on, and someone has checked rather than assumed.
• Your IT provider can lock or wipe a laptop remotely, and has tested it on a spare device.
• You know which logins sit on each laptop, including job boards and LinkedIn Recruiter.
• Consultants know who to call, and know that reporting a loss quickly is never held against them. Every hour spent hoping it turns up is an hour someone else could be trying to get into it.