Encrypting laptops and USB drives: a basic GDPR expectation

Losing an unencrypted laptop or USB stick with personal data on it is treated very differently to losing an encrypted one — GDPR expects "appropriate technical measures," and full-disk encryption such as BitLocker or FileVault is a baseline, low-cost one. USB drives specifically are easy to lose, so hardware-encrypted drives or banning unencrypted USB storage entirely is worth considering.

Coach's tip: an encrypted lost laptop is usually a "no real risk to individuals" story; an unencrypted one can become a reportable breach — the cost difference is enormous for a one-off setting.