Last reviewed: November 2026
No Credit Card Required
Printed from checkflow.io/templates/cybersecurity/lost-or-stolen-device-response-checklist
This free lost or stolen device response checklist is for IT, security and privacy teams responding to one reported lost or stolen laptop, phone or tablet used for work, whether the organisation owns it or it is the user’s own device. One run starts from the date and time the loss was reported. It takes the last-seen details, finds the asset record, locks the device, revokes the user’s sessions and resets their password and sign-in methods, blocks the device, checks its location and sends a remote wipe, all within hours. It confirms the encryption status and what data the device held, and the DPO or privacy lead records a breach decision within two days, with notes on UK GDPR, HIPAA and US state rules and a hand-off to the Data Breach Response checklist where the breach must, or may need to, be reported. A theft is reported to the police, a lost device is checked with lost property, the user gets a replacement and the insurance claim is made. After a recovery window the device is checked or written off, a lessons-learned review is held, and a named person signs off before the asset register entry is closed with the incident reference.
This checklist runs the response to one reported lost or stolen laptop, phone or tablet used for work: the lock, the cut-off of access, the wipe, the encryption and data checks, a recorded breach decision, the police report or lost-property check, the replacement and insurance claim, and the close-out of the asset record. Its first tasks fall due within hours of the report.
Where personal data is at risk and the breach must, or may need to, be reported, the Data Breach Response Checklist takes over the notifications, and this checklist carries on with the device. An attack or incident wider than one device runs in the Cybersecurity Incident Response Checklist. The register itself is kept with the IT Asset Management Checklist, and the remote lock and wipe are set up with the Mobile Device Management (MDM) Enrollment Checklist. A device that a leaver has not given back belongs in the Employee Offboarding Checklist and the IT Offboarding Checklist, and the rules users follow when working away from the office are in the Remote Work Security Checklist.
Covers: the report, lock, sessions and sign-in methods, location, wipe, encryption, the data on the device, the breach decision, the police or lost property, the replacement, the insurance claim, the recovery window, lessons learned and the close-out.
Planned around: the date and time the loss was reported.
Output: a device that can no longer reach your systems, a recorded decision, and a closed asset record.
Covers: the risk to individuals, notifying regulators, partners and the people affected, and the breach register.
Planned around: the notification deadlines that apply.
Output: every notification made on time. This checklist hands it a breach that must, or may need to, be reported.
Covers: the asset register, assignments, moves and returns, licences, renewals and the quarterly audit.
Planned around: a regular cycle.
Output: an accurate register. This checklist closes one device’s entry in it with the incident reference.
Eight phases take one device from the report to the closed asset record, about four weeks later. The first task records when the loss was reported: the lock, the access steps and the wipe fall due within hours of it, counted in calendar hours so they fall at weekends too, the breach decision within two days, and the rest in working days. The answers on the first task add a SIM task for a phone or tablet, a police report for a theft, a lost-property check for a lost device, and the replacement and insurance claim or a personal device’s next steps. The close-out sign-off in Phase 8 is assigned to one person, and nothing after it can be completed until they do.
Owned by the IT lead. Enter the date and time the loss was reported on the first task: the first tasks fall due within hours of it, the breach decision within two days and the close-out about four weeks later. Say what the device is, whether it was lost or stolen and who owns it, and the tasks for that case appear.
Due in the first hours after the report, counted in calendar hours, so they fall at weekends too. Lock the device, end the user’s sessions, reset their password and sign-in methods, and stop the device getting new access.
Check where the device last reported from, decide whether to wipe it now, send the wipe and record its status, and report a theft to the police the same day. A lost device gets a lost-property check instead.
The breach decision rests on two facts: whether the data on the device was protected by encryption whose key was not with it, and what personal data the device held or could reach. Find both within the first day.
The DPO or privacy lead decides, within two days of the report, whether this is a personal data breach and whether it must be reported. One that must, or may need to, be reported goes to the Data Breach Response checklist, which takes over the notifications. Every decision is recorded.
Get the user working again on a replacement, and start the insurance claim for a device the organisation owns. The user’s own device gets agreed next steps instead.
This template allows 14 working days, about three weeks, for the device to turn up. Then record whether it was found: a found device is checked before it is used again, and a missing one is written off. The insurer’s outcome follows for a device the organisation owns.
Review what happened, then the close-out sign-off: only the person named on the first task can complete it, and nothing after it can be completed until they do. The asset register entry and the incident record are closed after it.
The breach decision in Phase 5 shows a short note for each rule ticked in Phase 4. Where a breach must, or may need to, be reported, the Data Breach Response checklist takes over the notifications.
| Rule | Who is told | When | Where encryption matters | Source |
|---|---|---|---|---|
| UK GDPR: the regulator | The Information Commission (still known as the ICO), unless the breach is unlikely to result in a risk to people’s rights and freedoms. | Without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach; a later notice gives reasons for the delay. | Article 33 has no encryption exception; encryption is part of judging the risk. | Article 33 |
| UK GDPR: the people affected | Each person affected, where the breach is likely to result in a high risk to their rights and freedoms. | Without undue delay. | Not required where measures such as encryption made the data unintelligible to anyone not authorised to access it. | Article 34, including 34(3)(a) |
| UK GDPR: the record | No one: the controller documents it. | For every personal data breach, reported or not. | Recorded either way. | Article 33(5) |
| HIPAA: the people affected | Each person whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used or disclosed. | Without unreasonable delay and no later than 60 calendar days after discovery. | Information encrypted as HHS’s guidance specifies, with the key not breached, is not unsecured, so the notification rules do not apply to it. | 45 CFR 164.402 and 164.404; HHS guidance |
| HIPAA: HHS | The Secretary of HHS. | At the same time as the people affected for 500 or more; within 60 days after the end of the calendar year for fewer. | As above. | 45 CFR 164.408 |
| HIPAA: the media | Prominent media serving the state or jurisdiction. | Where more than 500 residents of a state or jurisdiction are affected, within the same 60 days. | As above. | 45 CFR 164.406 |
| HIPAA: a business associate | The covered entity. | Without unreasonable delay and no later than 60 calendar days after discovery. | As above. | 45 CFR 164.410 |
| US state laws | As each state’s law says. | As each state’s law says. | Each state decides for itself. | The law of each state where affected people live |
The police report task appears when the device was stolen, or when that is not known yet.
| Where | How to report a theft | Source |
|---|---|---|
| UK | To the force where it happened, online where that force allows it (police.uk shows how) or by calling 101; 999 if the theft is happening now or someone is in danger. | police.uk, Contact us |
| England, Wales and Northern Ireland | Fraud or a cyber attack that follows, such as someone using the device’s accounts: Report Fraud, which replaced Action Fraud. A business, charity or organisation under a cyber attack calls 0300 123 2040 straight away. | reportfraud.police.uk |
| Scotland | Report Fraud says to report via 101. | reportfraud.police.uk |
| US | The local law enforcement agency where the theft happened, online or on its non-emergency line; 911 in an emergency. | USA.gov, How to report a crime |
Where this comes from. Articles 33 and 34 of the UK GDPR on legislation.gov.uk, read on 4 November 2026: since 30 September 2026 they name the Information Commission, which replaced the Information Commissioner under the Data (Use and Access) Act 2025, while the ICO’s personal data breach guide still uses the ICO’s name and lists lost or stolen devices holding personal data as one kind of breach. The HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414, read on Cornell LII) and HHS’s guidance on securing health information (last reviewed July 2013). police.uk, Report Fraud and USA.gov for reporting a theft. This checklist does not give legal advice; take advice on your own case.
The lock, the session and password resets, the device block and the wipe fall due within hours of the report, counted in calendar hours, so a loss on a Friday evening is not left until Monday. Every task is assigned from the people named on the first task, so each step has an owner from the start.
The encryption status, whether the key was with the device and what data it held come first, then the DPO or privacy lead records a decision with reasons within two days. Notes show the UK GDPR, HIPAA or US state rules you tick. A breach that must, or may need to, be reported goes to the Data Breach Response checklist, and every decision goes in the log.
A phone or tablet gets the SIM task, a theft gets the police report, a lost device gets the lost-property check, and the user’s own device gets a note on wiping only the work data. A found device is checked before reuse, a missing one is written off, and the close-out sign-off comes before the asset record is closed. Track every open case in the Reports Grid.
CheckFlow does not lock, locate or wipe devices, contact the police or decide whether a breach must be reported: those stay with your IT team, your device management tools and your DPO. CheckFlow makes sure every step is done in order, by the right person, with the record kept.
Run the notifications with the Data Breach Response Checklist, wider incidents with the Cybersecurity Incident Response Checklist, and the register with the IT Asset Management Checklist.
Data Breach Response Checklist
IT Asset Management Checklist
Mobile Device Management (MDM) Enrollment Checklist
Remote Work Security Checklist
Cybersecurity Incident Response Checklist
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
The report and last-seen details, the asset record, a remote lock, revoked sessions and a password and sign-in method reset, the device blocked, the location and a remote wipe, the encryption status and the data on the device, a recorded breach decision, a police report or lost-property check, the replacement and insurance claim, and the close-out of the asset record. This template covers those steps for one device, with the first tasks due within hours of the report.
It can be. The ICO’s guide lists computing devices containing personal data being lost or stolen as one kind of personal data breach. Whether it must be reported depends on the risk to the people whose data was on it, and encryption whose key was not with the device is part of that judgement. A device that held no personal data and could reach none is not a personal data breach, but this template still records the incident.
Not if the breach is unlikely to result in a risk to people’s rights and freedoms (UK GDPR Article 33). Article 34(3)(a) says telling the people affected is not required where encryption made the data unintelligible to anyone not authorised to access it. Encryption only helps if the key, PIN or password was not with the device or known. Every personal data breach must still be documented, reported or not (Article 33(5)).
HHS’s guidance says health information is secured where it is encrypted as the guidance specifies and the key that could decrypt it has not been breached. The notification rules apply only to unsecured information, so a properly encrypted phone whose key was safe does not trigger them. If the information was not secured, a breach is presumed unless a four-factor risk assessment shows a low probability that it was compromised (45 CFR 164.402).
This template’s default is to wipe at once, within hours of the report, unless there is a clear reason to wait, such as a phone left in a known, safe place that will be collected within hours. A hold needs a time it ends, and the reason is recorded either way. For the user’s own phone, wipe only the work profile or work account, as your bring your own device policy and the user’s agreement allow.
police.uk says a theft can be reported to the local force online, where that force allows it, or by calling 101, and to call 999 if the theft is happening now or someone is in danger. Keep the crime reference for the insurer and the incident record. If the laptop is then used for fraud or a cyber attack, report that to Report Fraud, which replaced Action Fraud for England, Wales and Northern Ireland; in Scotland, Report Fraud says to report via 101.
In this template the DPO or privacy lead named on the first task makes the breach decision, and only they can complete it. They decide within two days of the report, using the encryption status, whether the key was with the device, what data it held and any sign of use. A breach that must, or may need to, be reported goes to the Data Breach Response checklist, and every decision is recorded in the log.
Record it on the recovery task in Phase 7, which this template sets 14 working days after the report; complete it earlier if the device turns up. A found device is treated as untrusted: the serial number is matched to the register, its condition and any sign of tampering are recorded, and it is wiped and rebuilt before it goes back into use. The breach decision and its record stay, with the recovery added.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
