Your Office Is in Your Pocket — Until It Isn't: A Calm Lost-Device Checklist for UK Sole Traders

It happens in the gap between one thing and the next. You reach for your phone on the train, in a café, or on the passenger seat of the van, and it is not there. Your stomach drops. That is normal. The next 20 minutes matter, but not because you need to panic. You need a sequence.

Start with the clock, not the blame

Lost devices are common. Most are not catastrophes. The aim is to reduce the chance that someone gets into client data, and to show you acted promptly if anything does go wrong. You are a sole trader, not an IT department. A calm checklist beats a frantic scroll through your memory.

The first 20 minutes: lock, cut, change

1. Try to find it. Use Find My on an Apple device or Find Hub / Find My Device on Android from another phone or laptop. Play a sound. Check the last location. If it is nearby, brilliant. If not, move on quickly.
2. Lock it remotely. Put a message on the screen with a contact number. If the device is likely gone and holds client data, a remote wipe is reasonable. Remember that a wipe removes your data but does not cancel the SIM.
3. Ring your mobile network. Ask them to suspend the SIM so nobody can run up charges or receive your two-factor texts. Ask about SIM-swap protection while you are on the call.
4. Change passwords from a device you trust. Email first — it is the master key to almost everything else. Then bank, accounting software, cloud storage, website admin and social accounts.
5. Sort your two-factor authentication. If codes go to the missing phone, use backup codes or move 2FA to another device. Update your recovery email and phone number.

Steps one to four are the 20-minute version. Step five can follow once the immediate rush has passed.

The GDPR question: do you need to tell the ICO?

Possibly. Not automatically. Under UK GDPR, a lost device can be a personal data breach if it could lead to personal data being accessed, lost or disclosed. You then need to assess the risk. If the loss is likely to result in a risk to people's rights and freedoms, you should report it to the ICO within 72 hours of becoming aware. If the risk is high, you also need to tell the affected clients without undue delay.

A passcode and encryption reduce the risk, but do not assume they remove it entirely. A lost phone with only your own photos is a different situation from a laptop holding payroll details, client notes and invoice history. Keep a short written record either way: what happened, when, what was on the device, and what you did. The ICO website has a breach reporting tool, and its helpline is there for the unsure.

Who to tell, and how to say it

Tell your bank if banking apps were on the device. Tell your accountant if payroll, VAT or invoice records were on it. Tell your insurer if your policy covers cyber or business equipment. If the device was stolen, report it to the police and get a crime reference number — your insurer may ask for it. Action Fraud is the route if fraud has already happened.

If clients are affected, keep the message plain and honest. Something like: 'I am writing to let you know that a device holding some client contact details was lost on [date]. I have changed passwords, remotely locked or wiped the device, and reported it where required. I do not currently believe your financial details were accessed, but I wanted you to know.' Adjust that to the facts. Do not over-promise.

Keep trading while you sort it

You can run a business from a borrowed laptop for a day. Use webmail rather than a mail app. Forward calls to a temporary number or a VoIP line if your network can do it. Log in to cloud accounting from a trusted device. Pull recent invoices from your email or bank. Tell your key clients that replies may be slower today. Avoid doing your banking on a public computer if you can help it, and log out of everything when you are finished.

The one-page plan to save before it happens

Write this now, while your device is still in your hand. Keep it as a note in the cloud and print one copy for a drawer. A plan that lives only on the missing phone is not much use.

• Device list: phone, laptop, tablet — make and model.
• Screen lock and encryption turned on.
• Find My or Find Hub enabled.
• SIM PIN set.
• Password manager in use, with a recovery route you can reach without the device.
• Two-factor backup codes printed or stored somewhere separate.
• Key contacts: mobile network, bank, accountant, insurer, ICO.
• A short data map: what client data lives where.
• Your backup routine, and when you last tested it.
• A breach log template: date, what happened, risk assessment, actions, who was told.

A quieter kind of insurance

Prevention is not about building a fortress. It is about making a bad morning survivable. Use a passcode, keep your software updated, back up the things you could not recreate, and avoid storing the only copy of anything on a phone. Then, if the device does vanish, you have a sequence to follow and a record to show. That is what calm looks like in practice.