Remote working: 5 key data protection risks for employers

Remote working has become more prominent in modern business. While flexible working arrangements can improve productivity and employee wellbeing, they also create new data protection risks. Regardless of the physical location in which work is done, compliance with UK GDPR does not change. Organisations must ensure that appropriate security measures, policies and training are in place to protect data wherever work is carried out.

This article explores 5 key data protection risks of remote working and introduces steps employers can take to mitigate these risks.

1. Personal devices

One of the most significant challenges arises when employees use their personal laptops, tablets or smartphones for work purposes.

Personal devices may not have the same level of security controls as corporate-issued equipment and are often shared with family members or other individuals.

Although providing work devices may involve greater upfront cost, it is generally regarded as the most secure option because organisations can maintain greater control over device security and monitoring.

However, if employees use personal devices, organisations should consider implementing multi-factor authentication (MFA) and restricting the transfer of company data to personal storage locations or external devices.

Article 32 of the GDPR explicitly mentions “encryption” when discussing appropriate technical and organisational security measures. Encryption represents a useful method to keep data safe- even if stolen or exposed, encrypted data would be illegible and useless. Encryption can and should be implemented in devices and software when working remotely.

2. Unsecured Wi-Fi networks

Remote workers frequently access systems through home Wi-Fi networks, and in some cases via public, unsecured, internet connections in cafés, on public transport etc…

An unsecured network is a network that does not require a username or password to join and has no built-in security protections. Though secured, personal internet connections are likely safer than unsecured, public connections, there are security risks to data in both cases. This is because these connections are not protected with the same measures that a company would implement in its offices.

To mitigate these risks, organisations should require the use of Virtual Private Networks (VPNs) where appropriate. A VPN prevents web browsers and unwanted visitors to access your data.

3. Confidentiality in the home environment

Employees may unconsciously conduct sensitive conversations around family members or display sensitive information to others in their household, when working remotely.

Employers should encourage employees to work in designated private areas where possible, lock devices when unattended and be mindful of discussing confidential matters in shared spaces or public locations.

These practical measures can significantly reduce the risk of personal or sensitive information being inadvertently disclosed.

4. Handling physical documents outside the office

Despite increased digitisation, some organisations still use paper records. Unlike offices, employees working from home do not usually have access to secure confidential waste facilities.

If physical documents are needed, employers should establish clear procedures for transporting, storing and disposing of physical documents.

5. Inadequate policies and training

Human error continues to be a leading cause of personal data breaches, particularly where employees are adapting to new technologies and ways of working.

Organisations should ensure they have in place a remote working policy that addresses data handling expectations when working remotely.

Regular training is equally important. Employees should understand both their legal obligations and the practical steps they must take to protect information.

Practical steps for employers

To strengthen data protection compliance in a remote working environment, employers should consider:

• Providing company-issued devices where possible
• Implementing MFA and encryption
• Establishing and regularly reviewing remote working policies
• Providing regular cybersecurity and data protection training
• Ensuring employees understand how to report potential data breaches promptly.

How can we help?

Whether you are implementing a hybrid working model, updating your remote working policy or responding to a data breach, our specialist data protection lawyers can provide practical advice tailored to your business. Contact our data protection team to find out how we can help.