When an employee leaves your business, it's important to make sure any company devices they had—like laptops, smartphones, or tablets—are returned and properly managed. These devices often contain sensitive business data, access to email accounts, customer information, or internal systems. If they remain with the former staff member, your business risks data breaches, loss of control over critical information, and potential downtime while you sort things out.
Why this matters for UK SMEs
Small and medium-sized businesses in the UK face specific risks if company devices aren't recovered or secured promptly. For example, if a device with unencrypted customer data falls into the wrong hands, you could be in breach of UK GDPR and the Data Protection Act 2018, attracting fines or reputational damage. Additionally, lost devices can be exploited by cyber criminals to access your network, leading to costly disruptions and loss of customer trust.
Consider a typical SME with around 50 staff. When a member of the sales team left unexpectedly, they took their company laptop without returning it. The IT team discovered the device hadn't been wiped or locked remotely, and it contained access credentials to the company's CRM and email system. The business had to act quickly to change passwords, revoke access, and remotely wipe the device once it was located. This caused several days of extra work, delayed sales follow-ups, and increased stress for the IT department.
Practical steps to manage device returns and security
- Maintain an up-to-date asset register: Keep a detailed list of all company devices assigned to staff, including serial numbers and assigned users.
- Have a clear offboarding process: Ensure HR and IT coordinate so device return is part of exit procedures.
- Use remote management tools: Implement Mobile Device Management (MDM) or endpoint management solutions that allow you to lock, locate, or wipe devices remotely if they go missing.
- Review and revoke access: Immediately disable user accounts, change shared passwords, and revoke VPN or cloud service access when someone leaves.
- Encrypt devices and data: Use full disk encryption to protect data in case devices are lost or stolen.
- Ask your IT provider: - How do they support secure device offboarding?
- What remote management capabilities do they provide?
- Can they help with audit trails and compliance reporting related to device management? - Regularly test your processes: Conduct internal audits or tabletop exercises to ensure device return and data security steps are followed.
Working with your IT support partner
A trusted IT support provider will help you establish policies and technical controls to reduce risks when staff leave. They can assist with setting up automated device management, ensuring backups are current, and guiding you through compliance requirements such as Cyber Essentials or ISO 27001 if relevant. Early involvement of your IT partner in HR offboarding workflows helps prevent surprises and minimises downtime.
In summary, promptly securing company devices after staff departures protects your business from data loss, cyber threats, and compliance issues. If you don't already have clear processes and technical tools in place, now is the time to review these with your IT support team or advisor to safeguard your operations and reputation.