Possibly. The European Data Protection Board (EDPB) issued draft practical guidance on various types of data breaches to assist companies with identifying situations in which a data security incident may need to be reported to EU supervisory authorities (the government regulator for privacy in various EU member countries). In instances of a lost or stolen laptop, whether notification will be required depends on whether the data was encrypted or password-protected and on the sensitivity of the data contained on the device. The EDPB states that strong encryption would permit a controller to avoid notification, although the event should be internally documented pursuant to Article 34.

In contrast, notification to both the supervisory authority and the individuals would be required if large amounts of unencrypted personal information were contained on the lost or stolen device, even if the personal data itself was not sensitive.

The guidance is not clear about whether use of a strong password alone, but not encryption, would be sufficient to avoid notification. If the data protected by the password is highly sensitive, then a supervisory authority may find that notification is required, notwithstanding the use of a password.