What should I do first if a staff member loses their business mobile?

Three things in the first hour: (1) use Find My iPhone / Find My Device to try locate and remote-lock, (2) call the provider to block the SIM immediately, (3) remote wipe Microsoft 365 or work data if the device was managed via Intune. Speed matters — the first hour prevents the most damage.

Is losing a work phone a UK GDPR breach?

Not automatically. An encrypted, PIN-protected device is usually not considered a notifiable breach. Unencrypted or passcode-less devices with significant personal data may be. Consult your DPO or ICO guidance — if you determine it's notifiable, you have 72 hours from awareness to report.

Can I stop a stolen business mobile being used on any UK network?

Yes — UK networks share IMEI blacklists. Reporting the IMEI to your provider effectively bricks the physical device on UK networks. IMEI is printed inside the SIM tray or on the original box.

Lost Your UK Business Mobile Phone? What To Do (2026 Step-by-Step)

Last updated: April 2026

If a staff member has just lost their UK business mobile — stolen, dropped, misplaced — fast action matters. Within hours, someone could be using the SIM to rack up charges, someone could access work emails, and GDPR/ICO implications start counting. Here's the step-by-step.

In the first hour

1. Use Find My Phone / Find My Device (first 10 minutes)

iPhone: icloud.com/find — try to locate or remote-lock Android: android.com/find — same

If the device responds, you may see its current location. Lock it immediately with a strong passcode. If possible, ring it to get attention in case it's nearby.

2. Call the mobile provider to block the SIM (next 10 minutes)

Your provider can block the SIM so no one can make calls, send texts or use data on it:

EE Business: 150 from an EE phone, or 0800 956 6000
Vodafone Business: 191 from a Vodafone, or 0808 004 4490
O2 Business: 202 from an O2, or 0800 977 7337
Three Business: 333, or 0333 338 1003
CTN: 01743 598025 (we contact the network on your behalf)

Ask specifically for: (a) SIM blocked immediately, (b) IMEI blacklist if possible (prevents the physical handset being used on any UK network), (c) usage suspended pending replacement.

3. If Microsoft 365 or work apps were signed in — remote wipe

If the user had Microsoft 365 email, Teams, SharePoint or OneDrive on the phone:

Log into Microsoft 365 Admin (admin.microsoft.com)
Go to Active Users → [user] → Devices
Select the lost device → Manage → Wipe device

This removes all company data (emails, Teams messages, SharePoint sync) without touching personal content. Only works if the device was enrolled in Intune / device management; if it wasn't, company data may still be recoverable from the device if it's found.

4. Change passwords

If the user's Microsoft 365 or other work account passwords were saved on the device, change them immediately from another device. At minimum: Microsoft 365, banking, payment services, CRM, any admin access.

In the first 24 hours

5. Report to police

For stolen (not lost) phones, report to police and get a crime reference number. Required for insurance claims. Not urgent but do within 24-48 hours.

Police non-emergency: 101. Online report for stolen business equipment often available via your local force's website.

6. Order replacement handset

Most business mobile providers can dispatch a replacement SIM same-day or next-day. Replacement handsets take longer — 3-5 working days typically. If the user needs a phone urgently, issue a spare from office stock (if you have one) or a temporary personal device with the new SIM.

7. Check for unusual activity

If any delay occurred between loss and SIM blocking, check for unusual activity:

Call logs — any calls made from the device that the user doesn't recognise
Data usage — spike indicating heavy use
Text messages — outgoing to unusual numbers (could be premium-rate scams)
Financial accounts — any unauthorised banking activity (the device may have had banking app / SMS 2FA)

Dispute any unauthorised charges with your provider promptly (within 14 days of invoice).

8. GDPR / ICO consideration

If the device contained personal data of individuals (customers, staff, contacts) and couldn't be remote-wiped, you may have a notifiable data breach.

Under UK GDPR, notifiable breaches (those likely to risk individuals' rights and freedoms) must be reported to the ICO within 72 hours of awareness. Factors to consider:

How much personal data was on the device?
Was it encrypted? (modern phones with passcode are encrypted at rest — typically not a notifiable breach if PIN/biometric was set and modern OS)
Who are the affected individuals?
What could misuse look like?

If in doubt, consult your DPO or the ICO's guidance. An encrypted, PIN-protected device is usually not considered a notifiable breach.

Prevention (before this happens again)

Microsoft 365 Business Premium with Intune

The gold-standard protection. Every device enrolled in Intune can be:

Required to have PIN/biometric (enforced — can't be bypassed)
Remote-wiped of company data specifically (not personal)
Locked remotely
Located via enterprise Find My
Quarantined from company email within hours

Bundled with CTN VoIP at 10% off Microsoft licences.

Mobile device insurance

Business handset insurance from a few UK specialists (or directly from manufacturer — AppleCare for Business, Samsung Care+). Covers accidental damage and theft. Typical cost £5-15/month per high-value handset. Rarely worth it for cheaper phones; usually worth it for flagship business phones.

Physical precautions

PIN or biometric enforced on every work device
Auto-lock set to maximum 1 minute
Bluetooth turned off when not in use (some scams rely on exploit bluetooth)
Cases and lanyards for staff who work in rough environments (construction, field service)

Written lost-phone policy

A short policy covering: who to contact, in what order; who authorises replacement; any contribution from staff member if loss was negligent; SIM/IMEI blocking authority. Prevents panic and slow response when the real moment arrives.

FAQs

Who pays for unauthorised charges on a lost business mobile?

Depends on timing. Charges before you blocked the SIM: disputable with the provider — many will write off reasonable amounts as goodwill, particularly for first-time incidents. Charges after blocking: shouldn't exist; dispute immediately if any appear.

Can I track a lost business mobile's location?

Yes if the device had Find My iPhone / Find My Device enabled before it was lost. Also if enrolled in Microsoft 365 Business Premium Intune (managed device location via Endpoint Manager). Most modern UK business mobiles are locatable.

Is losing a work phone a GDPR breach?

Not automatically. An encrypted, PIN-protected device is usually not considered a notifiable breach. An unencrypted device or one without passcode containing significant personal data may be. Consult your DPO or ICO guidance when uncertain.

Does business mobile insurance cover theft?

Varies by policy. Manufacturer warranties (AppleCare+, Samsung Care+) cover damage but not usually theft. Third-party business handset insurance policies can include theft cover. Read the policy specifically.

How long does it take to get a replacement business mobile?

Replacement SIM: same-day or next-day dispatch from most UK providers. Replacement handset: 3-5 working days typically. If you have office spare handsets, the SIM goes into a spare immediately.

Can I block a stolen phone's IMEI from all UK networks?

Yes. UK networks share IMEI blacklists — once reported stolen, the physical device is effectively bricked on UK networks. Report via your provider with the IMEI (often printed inside the SIM tray or on the original box).

Getting help

Call 01743 598025 if you're a CTN customer with an immediate lost/stolen situation. For quote or general inquiries request a quote.