A lost or stolen phone is stressful at the best of times. When it is a work phone with access to email, files and customer data, it can quickly become a serious data protection incident. The difference between a minor inconvenience and a reportable breach usually comes down to how prepared you were. Here is the action plan.

The immediate steps

If a work phone goes missing, act fast:

  1. Lock or wipe it remotely. If you have Mobile Device Management (MDM), you can lock the device or erase company data instantly from a dashboard. This is the single most important control.
  2. Change critical passwords. Reset passwords for accounts the device could access - starting with email and any single sign-on.
  3. Revoke the device's access. In Microsoft 365 or your identity system, sign the device out of all sessions and remove its access.
  4. Report it. Notify your provider to suspend the SIM (preventing call/data fraud) and report theft to the police if relevant.
  5. Assess the data exposure. Work out what data was reachable. This determines whether you have a reportable incident.

When is it a reportable data breach?

Under UK GDPR, if personal data was accessible on the device and it cannot be confirmed safe, you may have to notify the ICO within 72 hours. This is exactly why remote wipe capability is so valuable - if you can prove the data was erased before anyone accessed it, you dramatically reduce the risk and the reporting burden.

Why preparation beats panic

Without preparation, your response is frantic and uncertain. With the right setup, it is calm and quick:

  • Encryption means data is unreadable without the passcode
  • A strong passcode or biometric lock buys you time
  • MDM lets you wipe remotely in seconds
  • A documented process means everyone knows what to do

These are the same fundamentals we cover in our mobile security best practices.

Prevention checklist

  • Enforce device locks and encryption on every work phone
  • Deploy MDM across the fleet, including BYOD devices
  • Keep an up-to-date inventory of who has which device
  • Train staff to report a loss immediately, not the next morning

Be ready before it happens

The best time to prepare for a lost phone is long before one goes missing. Our Mobile Products service puts the security and management in place so a lost handset stays a minor event. Request a callback to protect your business.

Frequently asked questions

What should I do if a work phone is lost or stolen?

Act fast: remotely lock or wipe the device, change critical passwords, revoke its access, report it to your provider and the police, and assess what data was exposed.

Is a lost work phone a data breach?

It can be. If personal data was accessible and you cannot confirm it is safe, you may have to report it to the ICO, which is why remote wipe is so valuable.

How can I prepare for lost or stolen phones?

Enforce device locks and encryption, deploy MDM for remote wipe, keep a device inventory and train staff to report losses immediately.