Skip to content
AssetVow

Problem study · for IT and leadership

A lost laptop under the DPDP Act: what IT needs ready before it happens

An employee leaves a laptop in an auto, or it is stolen from a car in traffic. The question used to be how to replace it. Now it is also what personal data was on it, whether it was encrypted, and what you can prove about how it was protected.

Updated 4 November 2026 · Built from the public sources listed at the end

₹250 cr

Maximum penalty for security failures under the DPDP Act, as summarised for the 2025 Rules.

Source

14 Nov 2025

The DPDP Rules 2025 were notified (some sources say 13 Nov).

Source

18 months

Phased compliance window for most of the Rules after publication.

Source

Why a lost laptop matters more now

Laptops in Indian companies carry customer lists, salary sheets, Aadhaar and PAN copies from onboarding, and exported reports. The Digital Personal Data Protection Act and the DPDP Rules 2025 expect organisations handling personal data to take reasonable security safeguards, and to deal with breaches properly. Summaries of the Rules put the penalty for security failures at up to ₹250 crore, and most obligations take effect 18 months after the Rules were published.

This is general information, not legal advice. Ask your lawyer which obligations apply to you and when.

The questions you will be asked

On the day a laptop goes missing, leadership, your lawyer and possibly the police will ask:

  • Which laptop exactly: model, serial number, asset tag?
  • Who had it, since when, and did they sign for it and the asset policy?
  • Was the disk encrypted, and is the device managed so it can be locked or wiped?
  • When was it reported, and what was done, in what order?
  • Was the police complaint filed, and what is the FIR number?

What to have ready before it happens

Most of the answers have to exist before the loss. After it, it is too late to create them.

  • Turn on disk encryption (BitLocker or FileVault) and keep laptops enrolled in Intune or another MDM.
  • Keep a register of every laptop with its holder, serial number and signed hand-over.
  • Give employees one simple way to report a lost or stolen device, from their phone, immediately.
  • Record the FIR number, the steps taken, and the write-off decision against the asset.
  • Wipe returned laptops before they are given to someone else, and record that it was done.

The usual way, and with AssetVow

  • Which device, whoseUsually: Search the Excel sheet and the chatWith AssetVow: Asset record with holder, serial and signed hand-over
  • Reporting the lossUsually: A call to whoever picks upWith AssetVow: Employee reports Lost or Stolen on My assets; IT is told at once
  • TheftUsually: FIR copy in someone’s emailWith AssetVow: FIR number recorded when IT confirms the loss
  • Managed or notUsually: Unknown until someone checksWith AssetVow: Intune devices matched to the register by serial number
  • ReuseUsually: Re-issued as it isWith AssetVow: Returned laptops held until the wipe checklist is done

What AssetVow does not do here

  • AssetVow does not encrypt, lock or wipe devices; that is done in Intune or your MDM.
  • AssetVow does not decide whether a loss is a reportable breach or notify anyone on your behalf.

Lost and stolen devices, handled properly

Employees report a lost or stolen device from their phone; IT confirms the loss, records the FIR number, and the write-off goes to the owner for approval.

See how it works

Related

Sources

Read on 4 November 2026. Laws and rules change; check the current text or ask your lawyer before acting.

  1. Legal 500 (Dhir & Dhir Associates): From draft to reality, key changes in India’s DPDP Rules 2025

FAQ

Common questions

Is a lost laptop a data breach under the DPDP Act?+

It can be, if it held personal data that could be accessed. Whether it must be reported depends on the facts and on which provisions are in force; ask your lawyer. Encryption and a quick response make a large difference.

What should an employee do when a company laptop is stolen?+

Tell IT immediately, file a police complaint and share the FIR number, and change passwords for anything they were signed in to. IT should lock or wipe the device from the MDM.

What records help after a laptop is lost?+

The asset record with the holder, serial number and signed hand-over; whether it was encrypted and managed; when it was reported and what was done; and the write-off approval.

Know exactly which laptop, whose, and what was done

Keep every device with a named holder and a signed hand-over, and handle losses with a record. Free for 30 days.

Start 30-day free trial Try the live demo