The first hour: lock the device, end the sessions, change the passwords, in that order
Step one: lock it remotely and mark it as lost. Apple, Android and Windows devices all include a find-my-device feature. If it was enabled beforehand, sign in to the same account from another device or a browser to lock the missing one, display a contact message and see its last location. Lock first and hold off on erasing. Once erased, the device can no longer be located and evidence may be affected. If the data is highly sensitive and recovery looks unlikely, then erase; if the device is offline, the instruction takes effect the next time it connects.
Step two: force sign-out of every session. This is overlooked more often than the password change. With many services, a device that is already signed in stays signed in after the password is changed. Open the security settings of the company email, cloud storage, messaging apps, accounting software and social media back ends, find the list of signed-in devices or active sessions, and remove that device or sign out everywhere. Messaging apps often hold large volumes of customer conversations and files, so treat them the same way.
Step three: change passwords, starting with email. The mailbox is the recovery route for every other account. Then online banking and payment tools, then the rest. If the browser stored passwords, assume all of them are exposed and change each one. Check two-step verification too: if codes go to the missing phone, have the carrier block and replace the SIM immediately and move verification to a new device. One thing not to do: do not follow the location and try to retrieve the device yourself or confront anyone. That carries real personal risk in the Philippines. Hand the location to the police.
Telling the company: staff report the same day, and managers hold back the blame
An employee who loses a work device must tell the company the same day, even at midnight and even if it happened on personal time. A day's delay is a day's head start for whoever has it. The report should state what was lost, when and where, how it happened, whether the device was switched on and unlocked at the time, whether it had a login password and disk encryption, which company accounts were signed in, which files were stored on it, and what has been done so far.
For owners and managers, the priority is making it safe to tell the truth. If the company's habit is to fine people or dock pay for lost equipment, the rational response is to hide the loss until a customer receives an impostor email, by which time it is too late. Philippine labour law tightly restricts deductions from wages, and docking pay for a lost device is not something an employer can simply decide; handled badly it invites a labour complaint. Deal with the data first. Responsibility for the hardware can be addressed later under company policy and due process.
The company side has administrator actions the employee cannot perform. In the admin console for company mail and the office suite, end that user's sessions and reset the password. Revoke the device's access to cloud drives, shared folders and internal systems. If a device management tool is in place, push a lock or wipe from the console. Review the account for unusual sign-ins, downloads or forwarding. Record the time of each action. That timeline is the key evidence when you later assess whether data was accessed. If the employee handles payments or corresponds with customers frequently, warn the finance team to watch for impostor emails; the pattern is described in what to do when payments are diverted to a fake account.
The police report: why it matters, what to bring, what the record is for
Report a stolen or snatched device at the police station. The main purpose is not getting the machine back but obtaining an official record. That record has at least four uses. An insurer requires it for a claim. If the device held customer data, it supports your account of the incident to a regulator. If someone later does something with the device, it shows the device was out of your hands from a given time. And it is commonly requested when replacing identity documents, access cards or company papers lost with it. The process, and the difference between a blotter entry and a formal complaint, are in how to file a police report in the Philippines.
Prepare the make and model, the serial number, which can be found on the box, the purchase invoice or the device list in the account, and the IMEI for a phone. Bring proof of purchase, and for a company device the company's procurement record. Have the time, place and sequence of events ready, plus a location screenshot if you have one. With the police record a carrier can also be asked to block a lost handset. If the loss happened in a mall, a restaurant or a ride-hailing car, register it with the venue or platform as well and ask for the camera footage to be preserved, since recordings are kept for a limited time; for items left in a car see how to recover something left in a Grab or taxi.
If the device was taken by force rather than left behind or stolen unnoticed, personal safety comes first; the remaining steps are in what to do after a robbery in the Philippines. To repeat: even if the map shows the device in a nearby building, do not go and ask for it. Give the location to the police and let them decide what to do with it. The hardware can be handled through insurance, and the data risk is already being handled through the lock and the password resets.
Assessing the data risk: four questions that decide whether this is a data breach
A lost device is not automatically a data breach, but it needs a real assessment rather than a feeling that it is probably fine. Answer four questions. First, did the device have a login password or biometric lock, and was full-disk encryption switched on? A locked and encrypted device is very hard to read, and the risk drops sharply. An unlocked device, or one taken while switched on and signed in, must be treated as possibly accessed. Second, what personal data was on it: scanned passports and identity documents, contact details, contracts, employee records, financial files?
Third, did the remote lock or wipe take effect before the device was opened? The console usually shows the status of the command and when the device was last online. Fourth, has any related account shown unusual activity since the loss: unfamiliar sign-ins, bulk downloads, forwarded mail? Write the answers and the basis for each into a short assessment, signed by the person in charge and kept on file.
If the conclusion is that the device was unencrypted or unlocked, held sensitive personal information of customers or staff, and access cannot be ruled out, this is likely a notifiable personal data breach under the Philippine Data Privacy Act. The National Privacy Commission and the affected individuals must then be informed within a short statutory window; the criteria and contents are set out in the customer data breach response guide. If the conclusion is that the risk is low, the written assessment is your proof that the company took the matter seriously. Either conclusion should be recorded. The worst position is having written nothing. Also check your customer contracts: some require notice of a data security incident even where the statutory threshold is not met.
Replacement and recovery: get the person working again, then deal with insurance and hardware
Once the risk is contained, the aim is to get the employee working again quickly. If company files normally live in cloud storage or on a server, signing in from a replacement device is enough. If they existed only on that laptop's local disk, the loss is real, and the files have to be pieced back together from email attachments, versions sent to customers and copies held by colleagues. The sentence heard most often after a theft is that everything was on that computer. Before the new device is used, set the login password, turn on full-disk encryption and enable find-my-device, and only then sign in to company accounts.
Replace whatever went with the device, item by item. The SIM through the carrier. Access cards, the company seal, a cheque book, a bank token or security key carried in the laptop bag: notify the building administration and the bank separately, and for a cheque book notify the bank at once. Personal identity documents follow their own replacement procedures. Banking and e-wallet verification tied to the phone must be re-registered to the new device with the bank.
On insurance, check whether the company insured its office equipment or whether the employee's travel or personal belongings policy applies, report within the time the policy sets, and supply the police record, proof of purchase and an incident statement. Do not assume a generous payout: many policies carry a per-item limit and a deductible for electronics, so read the wording. Finally, file a short incident record with the timeline, the actions taken, the data assessment and the replacements made. If a recovered or related computer later shows suspicious software or damaged files, see what to do when ransomware locks company files.
Make the next loss only a lost machine: five settings, and what Yixing can do
Devices are stolen and snatched in the Philippines often enough that every company should plan for it. Malls, cafes, ride-hailing cars and vehicles stuck in traffic have all been the scene. The realistic goal is not that nothing is ever lost, but that a loss costs only the hardware. Five settings achieve this. One: a login password or biometric lock on every work device together with full-disk encryption, the cheapest and most effective measure of all. Two: find-my-device enabled everywhere, under an account the company controls rather than the employee's private one. Three: company files kept in cloud storage or on a server, never with the only copy on a local disk. Four: company mail and the office suite managed from an admin console that can end sessions and reset passwords remotely. Five: sensitive material such as scanned customer identity documents filed to a controlled location after use, not left on personal devices.
Add two habits. Keep the laptop bag with you and never visible in a parked car, and close the lid and lock the screen when leaving a seat in a public place. State in the staff handbook that a lost device must be reported the same day and that reporting is never punished while concealment is. Where employees use private phones for company work, agree minimum security requirements. Everyday precautions are covered in habits that prevent phone snatching in the Philippines.
Yixing Travel Consultancy (SEC Registration No. CS202009551, Bureau of Immigration Accredited Agency No. CA-202624381-1) provides compliance retainer services to foreign-owned companies in the Philippines: drafting internal device and data policies, organising the incident record and the facts a data risk assessment needs, preparing documents where notification is required, and connecting you with licensed counsel. Where an employee's visa-related documents were lost with the device, we can also map the replacement route. We are not a cybersecurity firm and do not offer device tracking or forensics. For your specific case consult a licensed lawyer; this article is not legal advice.
Frequently Asked Questions
A laptop with company files was stolen. What is the first step?
Should we wipe the device remotely straight away?
The location shows the device nearby. Can I go and get it?
Is a police report really necessary for a stolen device?
Does this count as a data breach that must be notified?
An employee lost a company laptop. Can we deduct it from their salary?
We changed the passwords. Is that enough?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation