A laptop left on a train. A USB drive dropped in a car park. A tablet taken from an unlocked car. These are not hypothetical scenarios — they happen to Manchester businesses every week. And if those devices are not encrypted, every piece of business data they contain is instantly accessible to whoever picks them up.
Device encryption is the most straightforward line of defence against data loss from physical theft or loss. It costs very little to implement, is built into most operating systems, and is increasingly required by regulators and cyber insurers alike. Yet many businesses in Sale, Altrincham, Trafford and across Greater Manchester still have not turned it on.
What Is Device Encryption?
Device encryption converts the data stored on a device into unreadable code. Without the correct decryption key — usually tied to a PIN, password, or TPM chip — the data is meaningless, even if someone physically removes the hard drive and connects it to another machine.
It is not the same as a login password. A password controls who can access a running operating system; device encryption protects the data at a hardware level, regardless of what an attacker does to the device.
How Encryption Works in Practice
Modern device encryption uses AES-256 — the same standard used by governments and banks. When encryption is enabled, the entire drive is encrypted in the background. When an authorised user logs in, data is decrypted in real time. When the device is locked, stolen, or the drive is extracted, the data remains scrambled and useless.
BitLocker, FileVault, and Mobile Encryption
For Windows business devices, the built-in tool is BitLocker. For Apple Macs, it is FileVault. Modern iPhones and Android devices running current OS versions encrypt storage by default. USB drives can be encrypted using BitLocker To Go or third-party tools such as VeraCrypt.
The Real Risk of Unencrypted Devices
The Information Commissioner’s Office (ICO) treats unencrypted device loss as a serious data breach. Under UK GDPR, businesses have a 72-hour window to report breaches involving personal data — and if they cannot demonstrate that a lost device was encrypted, enforcement action becomes significantly more likely.
Recent ICO fines have involved unencrypted laptops and USB drives across multiple sectors, including healthcare, legal, and financial services. These are not large enterprise failures — they are small businesses and local organisations that simply had not enabled a feature already installed on their machines.
What the ICO Says About Device Loss
The ICO guidance is clear: encryption is an “appropriate technical measure” under UK GDPR Article 32. Businesses that can demonstrate full device encryption at the point of loss are far less likely to face enforcement action. Those that cannot are treated as having failed to protect personal data, regardless of how the loss occurred.
The Cost of a Data Breach
Beyond the ICO, the business impact is significant. A breach involving customer or employee records can trigger regulatory investigation, reputational damage, and contractual penalties. For a Manchester business already under margin pressure, that is not always a recoverable situation. The reputational damage alone can outlast any fine.
Which Devices Need Encrypting?
The answer is straightforward: any device that holds business data and could leave the building. In practice, that includes more devices than most businesses realise.
Laptops and Desktops
Laptops are the most obvious risk — they travel constantly. But desktop machines are not immune. A desktop stolen during an office break-in, or a hard drive removed by a disgruntled leaver, is as much a breach risk as a lost laptop. Enable BitLocker or FileVault on every machine, without exception.
Mobile Phones and Tablets
Modern iOS and Android devices encrypt storage by default, but only when a strong PIN or passcode is set. Devices using weak or no PINs offer limited protection even with encryption enabled. Enforce strong PINs and biometric unlock through a Mobile Device Management (MDM) policy for any device that accesses company email or data.
USB Drives and Removable Media
USB drives are one of the highest-risk categories. They are small, easy to lose, and frequently used to transfer sensitive data. BitLocker To Go encrypts USB drives so they require a password on any machine they are plugged into. If your business uses USB drives for anything, this is non-negotiable.
Servers and NAS Devices
On-premises servers and Network Attached Storage (NAS) devices also need encryption at rest, particularly if they hold personal data. This is especially relevant for businesses in regulated sectors — legal, financial, healthcare — where data residency and security requirements are more stringent.
BitLocker for Windows Business Devices
BitLocker is available on Windows 10 Pro, Windows 11 Pro, and all Enterprise editions — versions most business devices already run. It is not available on Windows Home editions, which is one reason businesses should avoid consumer-grade hardware for work purposes.
Enabling BitLocker Correctly
Enabling BitLocker is straightforward, but doing it correctly matters. TPM (Trusted Platform Module) chips — standard on most modern business laptops — bind the encryption key to the hardware, so the drive cannot be decrypted even if moved to another machine. TPM 2.0 is required for Windows 11 compatibility, making it another reason to keep hardware current and on a planned refresh cycle.
Managing Recovery Keys
Recovery keys allow access to an encrypted drive if the main authentication fails — after too many wrong password attempts, for example. Storing recovery keys correctly is critical. They should be backed up to Azure Active Directory (Microsoft Entra ID) for business devices, not left on a sticky note or stored on the same device they protect. PC Express IT configures this as part of every device rollout for Manchester businesses.
Device Encryption for Remote and Hybrid Workers
The shift to hybrid working has dramatically increased the risk surface for device loss. Devices travelling between Sale, Manchester, and home offices are at far greater risk than devices that never leave a secure office. If your team works remotely — even occasionally — device encryption is not optional.
Combine device encryption with a robust cyber security policy for remote workers: screen lock after inactivity, strong passwords, no personal use on work devices, and VPN or ZTNA for network access. These controls work together; device encryption alone is not a complete strategy.
Mobile Device Management and Encryption Policy
Manually enabling encryption on every device is error-prone at scale. For businesses with five or more devices — and especially those with remote workers or personal devices accessing company data — a managed IT support approach using Mobile Device Management is far more reliable.
MDM platforms such as Microsoft Intune can enforce device encryption across all enrolled devices, report compliance centrally, and remotely wipe a device if it is lost or stolen. This gives businesses across Sale and Greater Manchester real-time visibility of which devices are encrypted — and the ability to act immediately when one goes missing.
For businesses with an existing IT support contract, adding MDM-enforced device encryption is typically a straightforward extension. For those managing IT in-house, it is often the first managed service that pays for itself quickly.
Common Mistakes Businesses Make with Device Encryption
Encryption failures are rarely about the technology. They are about process and oversight.
- Assuming it is on by default. BitLocker is not always enabled out of the box, even on Pro editions. Verify — do not assume.
- Losing recovery keys. If recovery keys are lost and authentication fails, data is permanently unrecoverable. Store keys in Azure AD or a managed key vault.
- Ignoring USB drives. USB encryption is frequently overlooked even when laptops are fully protected.
- Skipping mobile devices. Phones and tablets used for work email and files need enforced passcodes and MDM enrolment.
- No audit trail. Without central reporting, you cannot prove to the ICO that a lost device was encrypted — even if it was. Documentation matters as much as implementation.
How PC Express IT Helps Manchester Businesses with Device Encryption
PC Express IT, based in Sale, manages device encryption deployment and ongoing compliance for businesses across Manchester, Altrincham, Trafford, Salford, and Stockport. Our approach covers the full lifecycle: an initial audit of your device estate, BitLocker and FileVault deployment with TPM configuration, recovery key management through Azure AD, MDM enrolment for mobile devices, and regular compliance reporting so you always know where you stand.
If you are unsure whether your business devices are encrypted, or have never had a formal device security review, start with a conversation. Get in touch via our contact page or speak to our team in Sale directly. A device encryption audit is one of the quickest wins available to a Manchester business — and one of the most commonly overlooked.
For businesses in highly regulated sectors, device encryption pairs directly with our cyber security and IT helpdesk services to provide comprehensive data protection coverage.
Frequently Asked Questions: Device Encryption
What is device encryption and why does my business need it?
Device encryption converts data on a device into unreadable code that can only be accessed with the correct key or password. If a business laptop, phone, or USB drive is lost or stolen, encryption ensures the data cannot be read by whoever finds it. For UK businesses, encryption is also an expected technical measure under UK GDPR.
Is BitLocker included with Windows 10 and Windows 11?
BitLocker is included with Windows 10 Pro, Windows 11 Pro, and Enterprise editions. It is not available on Windows Home editions. Most business-grade laptops and desktops run Pro or Enterprise, so BitLocker is typically already available — it just needs enabling and configuring correctly with proper recovery key management.
What happens if I lose the BitLocker recovery key?
If the recovery key is lost and the main authentication fails — for example, after too many wrong password attempts — the data on the drive is permanently unrecoverable. This is why recovery keys must be stored securely in Azure Active Directory (Microsoft Entra ID) or a managed key vault, never on the device itself.
Do iPhones and Android phones need device encryption?
Modern iPhones and Android phones encrypt storage by default, but this only works properly when a strong PIN or passcode is set. Businesses should enforce passcode policies through Mobile Device Management (MDM) software. Without a passcode enforced at policy level, device encryption offers limited practical protection.
Does device encryption slow down my computer?
On modern hardware with a TPM chip, the performance impact of device encryption is negligible — typically under two per cent. Older hardware without hardware-accelerated encryption may see a more noticeable impact, but this is rarely a concern with devices less than five years old.
Do I need to report a lost encrypted device to the ICO?
If a lost device was encrypted and held personal data, the risk to individuals is generally considered low and reporting may not be required — though you should always assess the specific circumstances. If the device was unencrypted, a reportable breach under UK GDPR is far more likely. Documenting your encryption status before any incident is essential.
How does PC Express IT help Manchester businesses with device encryption?
PC Express IT, based in Sale, deploys and manages device encryption for businesses across Manchester, Altrincham, Trafford, and Salford. Our managed IT support covers BitLocker and FileVault deployment, TPM configuration, recovery key management through Azure AD, MDM enrolment, and compliance reporting — so you always know the encryption status of your entire device fleet.
