The GDPR tells us to assume the worst. If a thief could access the data, we have to act as if they have.

This might mean reporting the incident as a data breach, as well as contacting people whose data was on the device.

Many of us lock our own devices with passwords or fingerprints. This is a good thing to do in everyday life.

Unfortunately, when it comes to protecting other people’s data, it’s often not enough.

We need to be confident a thief can’t hack their way in to a stolen device. In other words, we need to protect the information itself.