What Should a Business Do When a Work Phone or Laptop Is Lost or Stolen?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Act within the hour. Lock the device remotely, sign it out of your business accounts, change passwords for anything it could reach, and check whether it held customer data that could trigger a breach notice. Before anything is lost, turn on device locks, encryption, and remote find and erase, so these steps are possible.

What this means

A lost device plan has two halves.

Before it happens:

Every work device has a passcode, screen lock, and encryption. The Federal Trade Commission (FTC) tells businesses to require passwords on all laptops, tablets, and phones and to encrypt devices that hold sensitive data.
Find and erase is turned on. On Android this is Google’s Find Hub. On iPhone and iPad it’s Apple’s Find My.
Each device is listed in your access inventory (see 11.7.5 Access Inventory).
Staff know who to call the moment a device is missing.

When it happens:

Lock it and try to find it.
Cut off its access to business accounts.
Decide whether it’s a breach.

Google says Find Hub can locate a device, play a sound, mark it as lost so it locks, or erase it. Erasing deletes the data on the device, and afterward you can no longer locate it. Apple suggests marking a stolen iPhone as lost, reporting it to the police and your carrier, erasing it if you can’t get it back, and removing it from your Apple Account.

Made-up example: A technician at North Shore Electric leaves his work phone at a gas station. He calls the owner from a customer’s phone. The owner marks it as lost in Find Hub, signs it out of the Google account, and changes the scheduling app password. The phone turns up the next morning, and nothing was touched.

Why it matters

Phones stay signed in to email, texts, banking, and business apps.
Text message codes for multi-factor authentication go to the lost phone.
Unencrypted laptops can be read by anyone who removes the drive.
A lost device can be a reportable breach if it held unencrypted personal information (see 11.6.6 Breach Notification).

Who this applies to

Every business that uses phones, tablets, or laptops for work, including personal phones used for business email or apps.

How to do it

Set up now:

Turn on a passcode and auto-lock on every device.
Turn on device encryption.
Turn on Find Hub (Android) or Find My (Apple) for every work device.
List every device in your access inventory with its serial number.
Make sure backups are running (see 11.8 Business Backups).
Write a one page lost device checklist and share it with staff.

When a device is lost or stolen:

Report it right away to the owner or the person named in your plan.
Lock it using Find Hub or Find My, and try to locate it.
Sign it out of your Google account, email, and key business apps from another device.
Change passwords for accounts it could reach, starting with email and the password manager.
Update multi-factor authentication if codes were going to that phone (see 11.7.4 Account Recovery Methods).
Report theft to the police and your phone carrier.
Erase it if it won’t be recovered. Apple warns an erase can’t be undone, so try to recover it first.
Check for a breach. Decide with your attorney whether customer data on the device triggers a notice (see 11.9.4 Data Breach Response).
Log everything with times.

What proof to keep

The lost device checklist
An incident log with times and actions
Screenshots of the lock or erase confirmation
Police report number, if stolen
Notes on the breach decision and who made it

Common mistakes

Waiting a day hoping it turns up.
No passcode on a work phone.
Find and erase never turned on.
Forgetting that multi-factor codes go to that phone, then getting locked out.
Personal phones with business email and no plan for them.
Erasing before trying to locate it, which ends the ability to track it.

When to get help from a pro

Information technology (IT) specialist: to set up device management for several phones and laptops. Privacy attorney: if the device held unencrypted customer or employee data. Questions to ask:

Can we lock and erase all work devices from one place?
Does a lost encrypted laptop still need a breach notice in our state?
What should our rules be for personal phones used for work?

Bill’s note

[Bill: add a short note. For example, a business owner who lost the only phone with access to their Google Business Profile, or the setup you use on your SiteSmarty phone and laptop.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the lock, encryption, and find settings on SiteSmarty devices]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: Find Hub or Find My device list and the checklist]
[Result so far:]

Questions people ask

How do I remotely lock or erase a lost phone? On Android, use Google’s Find Hub. On iPhone, use Find My at iCloud.com/find. Both let you lock or erase the device if it’s turned on and connected.

Should I change passwords if my laptop is stolen? Yes, for any account it was signed in to or had saved, starting with email and the password manager.

Is a lost laptop a data breach? It can be, depending on what was on it, whether it was encrypted, and your state’s law. Talk to an attorney.

How do I protect devices before they’re lost? Use passcodes, encryption, auto-lock, and find and erase, and keep backups running.

Audit check

Question: Are all work devices locked, encrypted, findable, listed, and covered by a written lost device checklist?
Pass looks like: Every device has a passcode, encryption, and find and erase turned on, is in the access inventory, and staff know the checklist.
Fail looks like: Devices with no passcode, find features off, no device list, and no plan.
Evidence to collect: Device list, settings screenshots, the checklist, and any incident logs.

Where this fits

Do this first: 11.7.5 Access Inventory, 11.7.3 Multi-Factor Authentication, 11.8 Business Backups

Do this next: 11.9.2 Account Takeover

Sources

Google Android Help, "Find, secure, or erase a lost Android device" (checked October 17, 2026)
Apple Support, "If your iPhone or iPad was stolen" (checked October 17, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)
Federal Trade Commission, "Data Breach Response: A Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.