my laptop with customer data has been stolen what should I do now

A stolen laptop with customer data is usually a personal data breach

A stolen business laptop with customer data typically counts as a breach of the security of personal data, as defined in Article 4 of the GDPR. Data leaves the organisation's control, and that is exactly what the definition addresses — it does not matter whether the laptop was stolen from a car, a bag, or an office. What exactly was on that laptop, and whether that information was encrypted or otherwise protected, also determines how serious this is, but the theft itself is the starting point of the assessment. A more detailed explanation of what does and does not fall under that definition is available on the knowledge base page on what a personal data breach actually is.

From the moment of discovery, two things happen at the same time: establishing the facts (which data, of whom, how many individuals, and whether encryption was in place) and the question of whether notification is required — to the supervisory authority and possibly to the individuals themselves. Both questions depend on the risk that the stolen data poses to people, and that risk is precisely why an empty or well-encrypted laptop is assessed differently from a laptop full of unencrypted customer files. How that assessment works for notification to the supervisory authority is set out on the page on when a personal data breach must be reported to the Dutch Data Protection Authority, and the question of whether the individuals themselves should also receive a notification is on the page on informing individuals of a personal data breach.

Where this is based: Article 4, Article 32 and Article 33 GDPR

The definition of a breach is set out in Article 4 of the GDPR, the obligation to protect data appropriately — including the risk of loss of equipment — in Article 32, and the notification obligation to the supervisory authority in Article 33. These three Articles apply directly throughout the EU, so the assessment of whether a stolen laptop constitutes a notifiable personal data breach follows the same rules everywhere. What does differ by country is the supervisory authority where a notification must be sent: in the Netherlands this is the Dutch Data Protection Authority, in other Member States the national supervisory authority of that country. The EDPB guidelines provide additional clarification on how these Articles are applied in practice, and the Dutch Data Protection Authority provides on its own page on personal data breaches a Dutch explanation of the same rules.