A lost laptop isn't a five-thousand-zloty problem for a new device. It's a problem of notifying the data protection authority within 72 hours, panicked clients and the cost of breach notifications. Disk encryption is the single thing that turns that incident into a routine hardware replacement form.
We're treating this as a topic of its own because disk encryption is a strange feature: built into Windows for a decade, free, one click — and yet turned off in most Polish SMEs. The reason is always the same. "We don't need it, we have a Windows password." That isn't the same thing.
Why the Windows password isn't enough
A Windows password only protects the login screen. The moment someone pulls the drive out of a laptop and plugs it into another machine as an external disk, Windows doesn't boot at all — there's no password to bypass. The attacker sees the user's files, the company's files, browser cookies, stored passwords. The whole content. With no hacker tools — a screwdriver and a 30-zloty USB-SATA adapter are enough.
This isn't a hypothetical scenario. A laptop disappeared from the boot of a car during a sales rep's visit to a client. An employee left the machine in a hotel room and went for breakfast. A backpack with the gear stayed on the train. All three stories happened to our clients in the last two years. Each one ended with the same question: "is the disk encrypted?".
If the answer is "yes" — you log that the data was unreadable, zero out the user's accounts in cloud services, order a new laptop. End of story. If the answer is "no" — you have 72 hours to notify the data protection authority, possibly inform the people whose data was on that disk, and explain why a laptop with client data wasn't encrypted in the first place.
BitLocker — what it actually is
BitLocker is the disk encryption built into Windows 10/11 Pro (and Enterprise). It encrypts the entire system volume, runs in the background, is practically invisible to the user — the laptop boots normally, the user logs in with a password, works as usual. The difference shows up only when the drive is pulled out: outside the original hardware and without the recovery key the files are useless.
For an SME that's a sufficient shield. We're not defending against state intelligence here, only against a laptop thief and the "I left it in a taxi" scenario. BitLocker handles those scenarios at 100%.
Important: BitLocker is only available in Windows Pro/Enterprise. If someone in the company bought a laptop with Windows Home, you can't turn encryption on — you need to upgrade the license to Pro (one-off, around 600 PLN per seat) or swap the hardware on the next refresh cycle. There's no good reason to buy laptops for the business with the Home edition.
Recovery keys — where things usually break
Every encrypted disk has a 48-digit recovery key. You type it in when something goes wrong: the TPM fails, the motherboard was replaced, the user mistyped the password too many times. Without the key the disk is locked forever — including for you.
This is the place where we see the most chaos. The IT person turns BitLocker on "quickly", saves the recovery key on the desktop of the same laptop (which then gets encrypted along with everything else) or mails it to themselves on an account no one else has access to. Six months later the IT person leaves the company, and a year after that a user hits the "Recovery Key required" screen and suddenly nothing can be done.
The only sensible places for recovery keys:
- Microsoft Entra ID (formerly Azure AD) — if you have Microsoft 365 Business Premium, BitLocker keys land in the admin panel automatically. This is the default if the company already uses M365.
- Active Directory — same idea if you have an on-prem domain controller.
- Intune — if you have MDM, keys are visible in the panel alongside the rest of the device inventory.
- Company password manager (Bitwarden, 1Password Business) — one entry per laptop, access restricted to two or three people.
What absolutely doesn't qualify as a key store: a personal mailbox, a USB stick in a drawer, an Excel sheet on a network share. The recovery key needs to be where you'll find it in three years, when you've forgotten it even exists.
Mac and Linux — briefly
Mac has FileVault — the BitLocker equivalent, switched on in "Settings → Privacy & Security → FileVault". Same rule: save the key, keep it off that laptop. In practice the FileVault problem is smaller because Apple has been fairly insistent about asking the user to turn encryption on during the first boot for years — in most SMEs Macs are already encrypted, almost by accident.
Linux — LUKS, configured during install. If you have developers on Linux and the install was done without LUKS, the only way to turn encryption on is a reinstall. That's a good argument for setting the standard for new installs once and sticking to it.
Pitfalls to watch for
Three things most often break an SME encryption project.
Old hardware with no TPM. TPM is a small chip on the motherboard where BitLocker keeps its keys. Laptops older than ~2018 may not have one. You can turn BitLocker on without TPM (with a boot password), but in practice it's easier to just replace gear that's already near end of life.
Sleep mode instead of hibernate. BitLocker only fully protects the disk after the machine is powered off. A laptop closed with the lid but in sleep mode still has the encryption keys in memory. For firms working with sensitive data (law offices, accounting offices, healthcare) it's worth enforcing a hibernate or shutdown policy at night.
No protocol for hardware loss. An encrypted disk is only half the work. The other half is a concrete procedure: who calls IT, who blocks accounts in Microsoft 365 and the CRM, who ships out a new device, where this gets documented. Without that even with BitLocker the incident will be chaotic.
A concrete example
At one of our clients — an 18-person law firm from the Tri-City area — a partner's laptop disappeared from the boot of a car during a client visit on the coast. The disk held draft contracts, client correspondence, two years of email. Before BitLocker had been deployed, a loss like that would have meant a notification to the data protection authority, individual notifications to dozens of clients and the risk of losing trust in an industry where trust is the only real asset.
The disk had been encrypted for eight months. Recovery keys were in Microsoft Entra ID. The partner's M365 account was blocked within 15 minutes. A new laptop went out by courier the next day, the data came back from OneDrive in three hours. There was no notification to the data protection authority, because the data was unreadable to a third party — enough to argue the breach didn't materialise. The whole "incident" cost the firm 6 thousand zloty for a new laptop and half a day of IT work. Without encryption it would have cost at least ten times more and a few weeks of nerves.
What to do now
Five things worth checking in this order:
- How many laptops you have in the company and which of them have BitLocker enabled (on Windows, check it with
manage-bde -statusfrom an admin command line). - Where the recovery keys are — and whether you'll find them a year from now if the current IT person disappears.
- Whether new hardware is bought with Windows Pro from the start.
- What the procedure looks like for a lost or stolen laptop — and whether anyone has ever written it down.
- Whether your security policy mentions encryption (you'll need that for client questionnaires, GDPR audits, cyber insurance).
If any of those answers aren't crisp, that's a sign worth closing this topic before the first laptop disappears. We help set it up once, so you don't have to revisit it for years.
A Windows password protects the login screen. Disk encryption protects the data. Those are two different things and only one of them counts to the regulator.