Guides → Practical guides

Getting laptops back from leavers and remote workers

25 September 2026 · 4 min read

The riskiest devices in most organisations aren't in the server room. They're in spare bedrooms and kitchen drawers, sitting with people who left months ago and are waiting for someone to ask for the laptop back.

Why the return gap is dangerous

When everyone worked in an office, a leaver handed in their laptop on their last day. With hybrid and remote working, that handover depends on a courier, a returns box and someone following it up. Each of those can fail quietly. A device that hasn't come back is still covered by your data protection obligations, and it's still on your asset register, or should be.

ISO 27001 addresses this directly in control 5.11, return of assets. Even without certification, it's the question an auditor or the ICO will ask after an incident: what happened to that person's laptop?

A leaver process that works

1. Trigger it from HR, not IT. The moment notice is given, HR should tell IT and include the leaving date. IT can't recover a device it doesn't know is leaving.
2. Pull the asset list for that person. Laptop, phone, tablet, monitor, any encrypted USB drives. Your asset register should answer this in seconds.
3. Agree how each item comes back, before the last day: handed in at the office, collected from home, or sent in a prepaid returns kit.
4. Disable access on the last day, whatever has happened to the hardware. Account access and device return are separate risks.
5. Check each item in against the list by serial number, and update the register.
6. Chase anything missing within days, not months. The longer it goes, the less likely the device is to come back.

Remote collections

For home workers, you can post out a returns box or send someone to collect. Whichever you use:

• Use tracked, signed-for services. A laptop in the post is a laptop in transit, and you want to know where it is.
• Don't ask the leaver to wipe the device. That's well meant, but it's unverifiable (see why deleting doesn't erase), and it destroys data you might need, for example in a dispute.
• Lock rather than wipe remotely while the device is in transit, if your MDM supports it. A remote wipe is sensible if a device is clearly lost. Otherwise, lock it and deal with the media properly once it's back.
• Bring accessories back too. Chargers and docks don't hold data, but they're assets, and they can be redeployed.

When a device never comes back

Some won't. When that happens:

• Mark the asset as Lost, and record the chasing you did.
• Lock or wipe it remotely through your management tools, if it's still enrolled.
• Revoke any certificates or credentials tied to the device.
• Assess whether it amounts to a personal data breach. Was the drive encrypted? What was on it? If there's a risk to people, it has to be reported to the ICO within 72 hours of you becoming aware of it.

Encryption makes a big difference to that assessment, which is one of the strongest arguments for encrypting every laptop from day one. See is encryption enough?

The contract side

Employment contracts and handbooks should say clearly that company equipment has to be returned when someone leaves. Some employers also reserve the right to deduct the cost of unreturned equipment from final pay. That's only lawful where the contract clearly allows it, so take HR or legal advice before relying on it.