The short answer: Act immediately after a lost or stolen device is reported. Lock or wipe it if you can, then cut its access to email and client files. Reset the person’s Microsoft 365 sign-in and review multi-factor authentication. Check whether someone had encrypted the device. Then assess the 72-hour notification question with your data protection officer or legal advice. A managed IT provider can set this up in advance, so you are not starting from scratch.
This guide is for small and mid-sized advisory firms in Meath, Cavan, Westmeath, Louth and Dublin. It covers a lost or stolen device that may hold client data. It does not cover email payment fraud or document storage.
First steps after a lost or stolen device is reported
The Data Protection Commission says portable devices are “especially vulnerable to theft and accidental loss”. Equally, when a laptop or phone goes missing, minutes matter. Treat every report of a lost or stolen device as urgent. Meanwhile, get a short, written account of what happened. Note when staff last saw it, what it held and if it was locked.
Then work through this sequence:
- Lock or wipe the device remotely, if that function is already in place.
- Block the person’s sign-in and end any open Microsoft 365 sessions.
- Reset their password and check multi-factor authentication is still intact.
- Review mail forwarding, inbox rules and recent file sharing.
- Record what you did, and who decided the next step.
The Commission is clear on timing. When a device is lost, it says to act so that “the remote memory wipe facility is activated”. Staff should already know those steps.
Remote lock, wipe and encryption
A remote lock stops further use. A remote wipe tries to erase what is on the device. However, neither works unless you set this up in advance, and the device is still reachable. Do not assume a wipe has succeeded until someone has confirmed it.
Encryption is the control that most reduces the harm of a lost or stolen device. The Commission’s data security guidance is plain. Encryption is “an essential security measure where personal data is stored on a portable device”. It also says, where you must store personal data on such a device, “these devices should be encrypted”.
If nobody encrypted the device, the problem is much harder. Local files, downloaded reports and cached mail may then be readable. That is why encryption and remote management need to be standard, not a reaction after the fact.
Microsoft 365 access after a lost or stolen device
Even after a wipe, the account is still a risk if someone has the password. So, block the account, end active sessions and reset the password. Then review whether the person can still open SharePoint, OneDrive, Teams and email from another device.
Multi-factor sign-in should already be on. The NCSC’s guidance for small businesses is direct. It says to “Turn on multi-factor authentication” and enable it “on all systems and services”. After a loss, check that nobody has changed or removed MFA. Also review recent sign-in logs.
If the firm uses Microsoft 365 device management, ask your IT provider about a lock or wipe from there. Do not assume every licence includes it. Our guide to handling client ID documents securely covers a related point. Files should live in the firm’s tenant, not on an unmanaged laptop.
The 72-hour GDPR question for a lost or stolen device
A missing laptop or phone is not automatically a notifiable breach. A lost or stolen device is not automatically exempt either. The Data Protection Commission’s breach notification guidance sets the test. Report a personal data breach “where the breach presents a risk to the affected individuals”. The deadline is short. “Organisations must do this within 72 hours of becoming aware of the breach.”
Where a breach is likely to result in a high risk, people must also be told “without undue delay”. Encryption, a confirmed wipe and strong sign-in can be relevant mitigating factors. They do not, on their own, decide the outcome.
Therefore, treat this as a question to assess with your data protection officer or legal advice. For a lost or stolen device, consider what data it held and who might access it. Also weigh the controls that were in place. The Commission also covers the no-risk case. After a finding of “no risk to affected individuals”, “you need to keep an internal record”.
What to set up in advance
In practice, most of the hard work happens before anything goes missing. After all, a later incident is much easier when the basics are already in place. A managed IT provider typically prepares:
- Device encryption as standard on laptops and phones that hold client data.
- Remote lock and wipe, with a short staff procedure to follow.
- Multi-factor sign-in on Microsoft 365, with admin access tightly held.
- A contact path for helpdesk hours, and for after-hours emergencies.
- A written record of what to check, and who can decide on notification.
Our article on cybersecurity for financial advisers covers access control in more breadth. Backup also matters if the device was the only copy of a file. Microsoft 365 backup covers email, OneDrive and SharePoint. It does not automatically cover files left only on the laptop. In particular, after a lost or stolen device, those local-only files may be gone for good.
Hypothetical example
An adviser in Navan leaves a work laptop on a train. Staff lock and wipe it, reset the Microsoft 365 account and check the sign-in logs. Staff had encrypted the laptop. They then assess this lost or stolen device incident with their data protection adviser and keep a written record.
How Sweeney Computer Services can help
Oliver Sweeney founded the company in 1985. Today, we support more than 50 businesses and more than 10 schools from Hurdlestown, Kells, Co. Meath. We help financial services firms with encryption, device controls and Microsoft 365 access. This sits inside our Managed IT Support.
Silver includes Microsoft 365 backup. Within our managed packages, we can also back up servers and key devices, scoped in a written proposal. We restore-test backups every two weeks and share the records on request. Our helpdesk runs Monday to Friday, 9am to 5:30pm, with after-hours emergency support at extra cost. Our plans are Silver at €49, Gold at €69 and Diamond at €89 per user per month, excluding VAT. We bill Microsoft 365 licences separately. In addition, Gold includes email security, phishing awareness training and unlimited on-site call-outs.
A quick sense-check
Need a plan for a lost or stolen device?
Book a short call with Michael Sweeney to review lock, wipe and Microsoft 365 access.
