Lost or stolen phone or laptop: how to protect your data in the UK

Losing a phone or laptop is stressful, and not only because of the device itself. As nidirect puts it, you lose the numbers, messages and photos too. This article sets out what two UK sources say about preventing loss, reacting fast and limiting the damage: the National Cyber Security Centre (NCSC) and nidirect, a UK public information website.

Both sources are limited. The NCSC page was published in 2016 and is written for organisations that give devices to staff, so many of its steps involve an IT helpdesk. The nidirect page is about mobile phones only. We keep to what they say and flag where they are silent, for example on remote locking or wiping, which neither source describes.

Report it straight away

The NCSC is direct about timing. If a work device is lost or stolen, it says to contact your IT helpdesk immediately. You will not be in trouble, and it is better to report a loss as quickly as you can. The faster you get in contact, the more can be done to prevent information being accessed.

If your device is personal, there is no helpdesk, and the NCSC page does not say what to do. For a phone, nidirect gives concrete steps, covered next.

For a stolen phone: police and network provider

Nidirect's advice follows a pattern it calls Register, Report, Reunite. The "Report" step says:

• report the loss or theft to the police immediately; and
• contact your network provider and tell them the phone has been stolen. They can block both the handset and the SIM card so that they cannot be used any more.

Prepare before anything happens

Nidirect recommends some preparation, which makes the report easier.

• Write down the details of your handset. That means the make, model and unique identification number, called the IMEI number. Nidirect says this can be found behind the battery, or by dialling a code on the handset.
• Keep them separate from the phone. Store the details in a safe place, because you will need to give them to your service provider if the phone is lost or stolen.
• Register the handset. You can register it with The National Mobile Property Register, which nidirect says will help the police return your phone if it is stolen. You should also register the phone with your network provider.
• Use the built-in security features. Nidirect says every handset has them. If you do not know how, check the instruction manual. For example, you can set a PIN that has to be entered before a call, which stops anyone else using your phone and protects your personal details.

Nidirect adds that if the police recover a registered handset, it is much easier to reunite you with it, since they can match the serial number to your name and address.

Passwords after a loss

The NCSC gives three points that matter when a device goes missing.

• If you have any reason to suspect that someone else knows your password, it must be changed immediately, either on the device itself or by contacting the IT helpdesk.
• Never disclose your password to anyone, including IT support staff, your manager or a colleague, whether in person, by phone, by email or by text message.
• Never share the same password across different systems or devices. The most important thing, it says, is that a password is difficult for someone else to guess, even if they know you well.

The NCSC accepts that you may write a password down, but it must be stored securely and never with the device itself. Its example is sealing it in an envelope and locking it away. Under no circumstances should you carry that copy with your device.

Reduce the chance of loss or theft

Both sources include prevention tips.

From the NCSC, for any type of device:

• A device is valuable and attractive to thieves, so take sensible precautions, but do not put yourself at risk.
• Do not leave it unattended in an insecure location. Lock it away if possible or keep it on your person.
• Be aware of who can see your screen, and consider a screen privacy protector. Touch screens make it particularly easy for bystanders to see what you type, even passwords.
• Only recharge with trusted power adapters and cables, and do not connect the device to any computer without the helpdesk's approval.
• Do not change or get around the security settings your organisation has configured.

From nidirect, for phones:

• When you are not making a call, keep your phone hidden away in a front pocket or a bag. Do not attach it to your belt or around your neck.
• Do not leave it on a table, as anyone passing can lift it.
• In public, keep an eye on what is going on around you. Avoid using it in public at night, and if you must, find a well-lit area. Avoid taking it out at train stations and bus stops, which nidirect says thieves target.

When a device may have been tampered with

The NCSC also covers cases that are not a straightforward loss. If your device stops working normally, or its performance or battery life drops significantly, contact your IT helpdesk. Never give your device to someone else, such as a commercial repairer, to fix. If you think someone may have tampered with it, for instance by opening it or removing or replacing parts, stop using it immediately, turn it off and contact your IT helpdesk.

What the sources do not cover

Neither page says how to lock or wipe a device remotely, how to check for a data breach, or what your legal rights are if personal information was on the device. We have not added any of that.

Checking what is visible about you

Once the device is dealt with, you may want to see what is already public about you. Remove Me offers a free analysis with no account needed. It searches publicly visible web results, known public data breaches and a register of data brokers, then shows a report, unlocked with a 6-digit code sent by email. It cannot say whether a particular lost device has exposed your data, and it does not yet send erasure requests on your behalf.