It would depend on whether the personal information stored on the cellphone or laptop, for example, belongs to your data subjects or just the employee.

If it belongs to your data subjects, and you as a responsible party believe that this results in a data breach of the data subject’s personal information, you are obliged to notify the data subject and the Information Regulator. As an example, a breach would occur where personal information is not encrypted, and is accessible to an unauthorised person.

If the electronic device does not contain personal information of your data subjects, you would not need to notify the Information Regulator.