When a company phone goes missing, the order matters: lock and locate the device first, then have the SIM card blocked, protect the accounts, document the loss and, within 72 hours, check whether a data breach has to be reported. With MDM, for example through a device-as-a-service provider like Everphone, you can do all of this remotely.
The hardware is the smaller problem when a phone is lost. An unlocked device with email access, a calendar and an authenticator app is an open door into your company.
This article is therefore a checklist for IT and a guide for employees who are looking for their work phone right now. Who is liable is covered in our article on the stolen company phone.
What employees do in the first minutes
Report the loss to IT immediately, not after you have searched. Every hour you spend looking for the device on your own counts against the deadline your employer has to meet. That is the most important sentence for everyone who does not manage MDM.
Tell IT three things: when you last had the device, where it might be, and whether it was locked with a PIN or biometrics. IT needs nothing more for the first steps.
You often cannot tell whether the phone was stolen or simply left behind on a train. Treat both the same at first: as a loss with possible third-party access.
Locking and locating the device remotely
IT's first step is lost mode in the MDM, not wiping. It locks the device, shows a message with a callback number on the lock screen and lets you see the location. Honest finders can now contact your IT team.
On iPhones and iPads, the managed "Lost" mode only works if the device is supervised and enrolled through (automated) device enrollment in your device management. Apple then shows the last known location, even if location services are switched off.
On Android Enterprise, the command is START_LOST_MODE. It locks the device and blocks all apps. This requires fully managed devices running Android 11 or later, or a work profile on company-owned devices running Android 13 or later.
One catch applies to both platforms: the device has to be online to receive the command. Apple keeps resending the command until the device connects.
A phone in airplane mode, or with a dead battery in a bag, is therefore only secured once it next connects.
Lost company phone: when wiping beats waiting
Wipe immediately if the device was clearly stolen or holds sensitive data. Wait only if it was very likely just left somewhere and lost mode is already active.
The reason: a wipe command removes all data from the device, but it also ends any chance of locating it. Apple allows a confirmed wipe, and a device found later can be enrolled again.
Set the deadline in advance, not under stress. An example: Lena from sales leaves her phone on the train on Friday evening. IT activates lost mode, and a call to the lost property office on Monday brings nothing. If your policy says "wipe after 24 hours without a find", nobody has to argue about it.
Encryption and a strong device passcode are the second line of defence. They also decide later whether you have to report a data breach.
Blocking the SIM card and protecting accounts
Have the SIM card blocked before someone makes calls at the company's expense or intercepts SMS codes. In Germany, you can do this through the blocking hotline 116 116 or directly with the provider that holds the contract. What matters is the contract partner, not the network operator: if the contract runs through a reseller, you call the reseller's customer service.
You need the mobile number. The device's IMEI, which you can look up by dialling *#06#, goes into the police report if the phone was stolen. Better still: IT already has it in the inventory.
After that, it is about the accounts that were signed in on the phone:
- End sessions for email, chat and cloud apps.
- Change passwords, above all the one for the main account.
- Remove the device's authenticator and second factors in the identity provider.
- Check access logs for the last few hours.
Many people forget step 3. As long as the old authenticator is still registered, a new password only helps halfway.
Data breach? The 72-hour deadline under GDPR
A lost company phone is usually a personal data breach, because the definition expressly includes loss (Art. 4 No. 12 GDPR). It only has to be reported, though, if it is likely to pose a risk to the people affected.
The deadline under Art. 33 GDPR is "without undue delay and, where feasible, not later than 72 hours" after you became aware of the incident. It starts when you learn of it, not when your investigation ends. If you report later, you have to justify the delay.
You have to document every loss, even if you do not report it. Note the time, the device, the data involved, the measures taken and why you assess the risk as low.
You inform the people affected under Art. 34 GDPR only if the risk is likely to be high. The obligation lapses if measures such as encryption make the data practically inaccessible to unauthorised persons. A phone with active encryption and a six-digit code is therefore a different case from one without a lock.
Involve your data protection officer before you decide. This article is not legal advice. More on the topic in the article Is device as a service GDPR-compliant?.
Checklist: who does what, and by when
| When | Action | Responsible |
|---|---|---|
| Immediately | Report the loss, note time and place | Employee |
| First hour | Activate lost mode, check location | IT |
| First hour | Have the SIM blocked | IT or employee |
| First hours | End sessions, change passwords, remove second factor | IT |
| Day 1 | If stolen, file a police report and give the IMEI | Employee |
| Agreed deadline | Wipe the device if it has not been found | IT |
| Within 72 hours | Assess the risk, report to the supervisory authority if needed | Data protection |
| Afterwards | Provide a replacement device, document the incident | IT |
What a rental model changes when a device is lost
The steps above are the same for every device. The differences lie in management and replacement.
With device as a service, MDM, rollout and device replacement are part of the service. Whether a lost Everphone device is put into lost mode by your IT team or by Everphone depends on how deeply the managed service for MDM is integrated.
A device can be reported as "Lost/Stolen" in the portal or via the API. If the lost-device flag is active for your organisation, that also triggers a replacement device.
In case of loss, the device's current value according to the residual value table applies. So you are not charged the new price. After a loss, users can order a new device from Everphone through the portal.
What to sort out before the next loss
At some point, every company loses a phone. The difference lies in the preparation.
Enforce a device passcode and active encryption on every device. Keep an inventory with IMEI and mobile number. Write the wipe deadline into the usage agreement. And decide who takes the call when a phone goes missing at 10 p.m.
Frequently asked questions
Do I have to report a lost work phone to the police?
If it was stolen, yes; if it was simply left behind, not necessarily. A report with the IMEI helps in both cases because it documents the incident. It replaces neither the internal report nor the assessment of a data breach.
Is a lost company phone always a reportable data breach?
It is usually a personal data breach, but not always a reportable one. You have to report it if it is likely to pose a risk to the people affected. You have to document the incident in every case.
Can I wipe a switched-off phone through MDM?
The command only arrives once the device is back online. With Apple, the MDM keeps resending it until a connection exists. Until then, only the device passcode and encryption protect the data.
Should I block the SIM card even if the device is locked through MDM?
Yes. The MDM lock protects the data on the device, but not the mobile contract. With the SIM card, someone can still make calls and receive SMS codes.