In this guide · 7 sections
Short answer
First sign the user out of every account and reset their password, then lock or wipe the laptop remotely if it is managed. File a police report for theft. Then assess whether personal data was exposed: an encrypted laptop is far less likely to be a notifiable breach than an unencrypted one.
Laptop stolen: what to do in the first hour
Work through these steps in order. Note the time of each one; you will need a timeline for the police report and any PDPA assessment.
Get the facts from the user
When and where it went missing, whether it was locked or asleep, which accounts were signed in, and whether it held local copies of customer files.
Revoke sessions and reset the password
In Microsoft 365, open the user in the Entra admin centre and select Revoke sessions, as described in Microsoft's revoke access guide. In Google Workspace, sign the user out from the Admin console. Then reset the password and check MFA methods.
Remove saved access on other services
Sign out of the password manager, accounting software, CRM, banking portals and any admin consoles the user had. Revoke any app passwords or remote-access tools.
Lock or wipe the device remotely
If the laptop is managed, use your device management console (details below). Decide between lock and wipe based on whether recovery is realistic and whether the disk is encrypted.
Report it
File a police report for theft (see below) and tell your insurer. For loss without crime, the police have a separate lost property report.
Start a breach record
Write down what personal data could be on the device or reachable from it. This is the start of your PDPA assessment.
Remote lock, locate or wipe a lost laptop
Remote actions only work if the laptop was enrolled in device management before it went missing, and they take effect when the device next connects to the internet.
| Action | What it does | When to use it |
|---|---|---|
| Locate | Shows approximate location on a map, where supported | Early, if recovery is realistic |
| Remote lock | Locks the device and resets its passcode (supported platforms) | While you decide; the device may turn up |
| Retire | Removes company data and settings, leaves personal data | Personal (BYOD) devices |
| Wipe | Restores the device to factory settings, removing all data | Stolen company devices, or no realistic recovery |
| BitLocker key rotation | Changes the recovery key | After a key may have been exposed |
The Intune device actions page lists what is available per platform. In Google Workspace, the Admin console can wipe corporate data from a device, either the work account only or the whole device, depending on platform and management level. For a personal Windows device signed in with a Microsoft account, Microsoft's Find my device may help locate and lock it.
If the device was never enrolled, you cannot wipe it remotely. Account revocation and password resets are then your main protection, which is why step 2 above matters so much.
Filing a police report for a stolen laptop
The Singapore Police Force accepts reports online through its Lodge Police Report e-service. If the laptop was lost rather than stolen, the SPF has a separate lost property report for items not lost through crime.
- Have the make, model and serial number ready (from your asset list, invoice or device management console).
- Note the time and place it was last seen, and anything distinctive about the bag or device.
- Keep the report number for your insurer and your breach record.
- The PDPC's breach guide also suggests alerting the police when criminal activity such as theft is suspected.
Is a lost laptop a data breach under the PDPA?
Losing a device that holds personal data, or that gives access to it, is a potential data breach. Under the PDPC's Guide on Managing and Notifying Data Breaches, once you have credible grounds to believe a breach has occurred, you must take reasonable and expeditious steps to assess whether it is notifiable, within 30 calendar days. The guide lists 'remotely disabling a lost notebook' as an example of containment.
A breach is notifiable if it is likely to result in significant harm to individuals, or affects 500 or more people. If it is notifiable, you must notify the PDPC within 3 calendar days of making that assessment. During assessment, the guide asks organisations to consider the efficacy of any technological protection, such as encryption, on the data involved.
Encryption also matters for telling customers. Under section 26D(5) of the PDPA, you do not have to notify an affected individual if, before the breach, you had implemented a technological measure that makes significant harm to that individual unlikely. That exception covers notifying individuals; it does not remove the duty to assess, or to notify the PDPC where the breach is notifiable.
Our PDPA data breach notification guide walks through the assessment and the notification forms in detail. This is general information, not legal advice.
Replacing the device and preventing the next one
Once the immediate risk is handled, get the user working again and close the gaps that made the loss risky.
Lost-laptop prevention checklist
If staff use personal laptops or phones for work, the same protections apply through a BYOD policy; see our BYOD and MDM guide. If the loss involved signs of account misuse, such as strange sent emails, follow our business email hacked guide as well.
Do it yourself or get help?
If you already have device management, the response is mostly a checklist you can run yourself in under an hour. The hard part is when devices were never enrolled or encrypted; then the work is preventing the next incident.
IT Sorted's Device Encryption & Management (S$490) sets up Intune or Google endpoint management in your account, enrols up to 10 devices, turns on encryption with recovery keys you hold, and tests a remote wipe. The Incident & Ransomware Response Plan (S$390) includes a lost-device playbook, a contact sheet, and the PDPC notification steps with the 3-day timeline.
Frequently asked questions
Revoke the user's signed-in sessions and reset their password for email and other company accounts, before trying to find the device. Then lock or wipe the laptop remotely if it is managed, file a police report, and start recording what personal data could be affected for your PDPA assessment.
Only if the breach is notifiable: likely to cause significant harm to individuals, or affecting 500 or more people. You must assess this promptly, within 30 calendar days, and if it is notifiable, tell the PDPC within 3 calendar days of that decision. Encryption on the device is an important factor in the assessment.
Not automatically. You still need to assess and record the incident. Strong encryption with a good sign-in makes significant harm much less likely, and under the PDPA you need not notify affected individuals if a technological measure in place beforehand makes significant harm unlikely. The PDPC notification duty is assessed separately.
Generally no. Remote wipe needs the device to be enrolled in a management tool such as Microsoft Intune or Google endpoint management before it goes missing, and the command runs when the device next connects online. For unmanaged devices, revoking sessions and changing passwords is your main protection.
For a company laptop that was stolen, wiping is usually the safer choice, because recovery is unlikely and the data matters more than the hardware. If it was simply misplaced and may turn up, a remote lock buys time. Always revoke account access first either way.