Working From Home and GDPR: Security Duties for Employers

Update: October 2026

An employer is responsible for the personal data its staff handle, whether they work in an office, at home or on the move. The GDPR does not relax its security rules for remote work, and regulators expect the same standard of protection on a kitchen table as on a company network.

This guide covers the legal duty, the most relevant threats, what the ICO‘s working-from-home checklist requires, and the risk that led to a recent fine: staff using their own devices.

Key Takeaways

• Articles 5(1)(f) and 32 of the GDPR require security that matches the risk, and the employer carries that duty for staff working at home. Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to put people at risk.

• The ENISA Threat Landscape 2026 names phishing as the leading social engineering technique (77.8% of those cases), and the ICO’s checklist asks employers for multi-factor authentication, locked-down cloud storage, hardened remote access and controls on email forwarding.

• Personal devices carry the highest risk. In December 2025, the ICO fined LastPass UK Ltd £1.2 million after an attacker reached a senior employee’s personal computer and linked personal and business accounts, opening the way to customer data.

Employers Stay Responsible for Personal Data Wherever Staff Work

The controller decides why and how personal data is processed, and the controller remains accountable when an employee handles that data outside company premises. Article 5(1)(f) requires personal data to be processed in a way that protects it against unauthorised access, loss and damage. Article 32 turns that into a duty to put appropriate technical and organisational measures in place, taking into account the risks of the processing.

A home network, a shared family laptop, a printer and a personal phone all change those risks. The employer decides what staff may do with company data, on which devices and through which tools, and must be able to show those decisions were reasoned.

In the UK, the same duties sit in the UK GDPR, and the ICO publishes the guidance most organisations follow.

Article 32 Sets the Standard for Remote Security

Article 32 does not list required products. It asks for measures appropriate to the risk and gives examples: pseudonymisation and encryption of personal data; keeping systems confidential, intact, and available; restoring access after an incident; and a process to test and evaluate the measures regularly.

For remote work, the question is what a reasonable employer would put in place given the data involved. A team handling marketing email addresses faces a different level of risk from a team handling health records, and the measures can differ. Document the decision and the reasons.

Phishing Is the Threat to Plan For

The ENISA Threat Landscape 2026, published in September 2026, analysed 8,257 incidents recorded between 1 January and 31 December 2025. ENISA reports that, among social engineering techniques, phishing remains the most common intrusion vector at 77.8%, followed by malicious spam at 13%. That share refers to social engineering cases, and the report does not present it as a share of all incidents.

ENISA also points to the wider availability of phishing kits and phishing-as-a-service platforms, and to the ClickFix technique, which persuades a victim to run malicious code while trying to fix a problem on screen.

Staff at home have fewer informal checks than in an office. A colleague at the next desk cannot confirm that a request looks odd. Training that shows staff real examples, a simple way to report suspicious messages, and controls that reduce the damage when someone clicks all belong in the plan.

The ICO Checklist Sets Out Practical Controls

The ICO’s working-from-home checklist for employers asks employers to confirm a short list of basics. They should have clear policies for staff who work remotely, covering how they access, handle, and dispose of personal data. Remote access software should be up to date, and staff should be reminded to use unique, complex passwords—Configure multi-factor authentication wherever available.

For cloud storage, the checklist says storage should not be public or open without authentication, that full access should go only to key staff, and that default administrator accounts should not be used for daily work. For remote desktop, it asks for account lockouts after failed log-ins, generic names for privileged accounts, and remote access only for the staff who need it. For email, it asks employers to apply the NCSC phishing guidance, to block or detect forwarding rules that send mail to external addresses, and to tell staff to keep personal data in corporate email and away from their own email or messaging accounts.

The ICO says these checks are not a complete security solution. It also says the guidance is under review because of the Data (Use and Access) Act, so it is worth checking the page for updates.

Personal Devices Carry the Highest Risk

The ICO’s December 2025 fine on LastPass UK Ltd shows how a personal device can be the entry point. The ICO fined the company £1.2 million after a 2022 breach that affected up to 1.6 million UK users.

According to the ICO, a hacker first compromised an employee’s corporate laptop and stole encrypted company credentials. The hacker then targeted a senior employee who had access to the decryption keys, reaching that person’s personal device through a known vulnerability in a third-party streaming service. A keylogger captured the employee’s master password, and the hacker bypassed multi-factor authentication using a trusted device cookie. The employee’s personal and business vaults were linked through a single master password, giving the hacker the access and decryption keys needed to extract the company’s backup database.

The ICO found no evidence that customer passwords were decrypted, because the service stores them locally on customers’ devices. It also said access to systems should be restricted to reduce risk, and it asked all UK businesses to review their own systems and procedures.

Three points follow for any employer that lets staff use personal equipment. Keep personal and work accounts separate. Limit access to the most sensitive systems to managed devices, and include a written policy that states what staff may and may not do on their own equipment. The ICO’s bring-your-own-device guidance sets out the options and is also marked as under review.

Policy and Training Need to Cover Staff at Home

A remote-working policy should say which devices and networks staff may use, how company data is stored and shared, what must never go to personal email or messaging accounts, how to report a lost device or a suspected breach, and who to contact. It should be short enough that staff read it.

Training should happen when staff join and again at regular intervals, and it should use the situations remote workers meet: a fake login page, a request that appears to come from a manager, a lost phone on a train. A policy that staff have not read or cannot follow will not help in an investigation.

Breaches at Home Follow the Same Reporting Rules

Under Article 33, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. Under Article 34, organisations must tell people directly when the risk to them is high.

A lost laptop, a misdirected email and a compromised home account all count. The 72 hours start when the organisation becomes aware, so staff need to know to report an incident immediately and to whom. Record every breach, including those not reported to the authority.

Monitoring Staff at Home Needs a Data Protection Impact Assessment

Employers sometimes respond to remote work by monitoring staff more closely. The ICO’s guidance on monitoring workers says data protection law allows monitoring when done in a compliant way, and that workers’ privacy expectations are higher at home. The ICO expects organisations to assess remote-worker monitoring in a data protection impact assessment, and it warns against monitoring “just in case”.

The same logic applies to security tools that record screens, keystrokes or location. Each needs a purpose, a lawful basis, an explanation to staff, and a check that a less intrusive option won’t do the job.

GDPRLocal helps organisations review remote-working policies and risk assessments, and prepare for breach response. See our GDPR consultant services and our guide to GDPR and cyber security.

Conclusion

Remote work does not change the employer’s security duty. The employer must decide which devices and tools staff may use, put risk-appropriate controls in place, train staff on the threats they will face, and be ready to report a breach within 72 hours.

The LastPass fine shows where the weak point is. A senior employee’s personal computer was the entry point to a company’s most sensitive systems, and the ICO treated that as an employer failure. An organisation with a written remote-working policy, multi-factor authentication, separate personal and work accounts, and a tested reporting route can show a regulator it took the duty seriously.

Frequently Asked Questions

Employers Are Responsible for Data Security When Staff Work From Home

The controller remains accountable under Articles 5(1)(f) and 32 GDPR for personal data staff handle wherever they work. The employer decides which devices, networks, and tools staff may use, and must match its measures to the risk.

Staff Can Use Personal Devices for Work if the Risks Are Managed

Neither the GDPR nor the ICO bans personal devices. The ICO fined LastPass UK Ltd £1.2 million partly because a senior employee used a personal computer to access sensitive systems. Employers should keep personal and work accounts separate, restrict access to sensitive systems to managed devices where possible, and set a written policy.

A Breach at an Employee’s Home Must Be Reported Within 72 Hours

When a breach is likely to put people at risk, Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. The incident’s location doesn’t change the deadline, so staff need a clear way to report problems immediately.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.