Keeping company and client data secure when working remotely

Key rules

• Responsibility: Your employer, not you, is responsible for the personal data you process for work, but you must follow its security rules.
• Lost device: Report a lost laptop or suspected breach to your employer immediately; you do not notify the AEPD yourself.
• Public wifi: Avoid public or insecure wifi, or use only the VPN your employer provides.
• Work location: Check which countries your employer allows before working from abroad.

Who is responsible for the data

Your employer is responsible for the personal data you handle for work. You are not. You act under the employer's authority, so your job is to follow its security instructions, keep data confidential, use only approved devices and tools, and report incidents.

The employer must put proper technical and organisational protections in place. The AEPD is the authority that supervises data protection in Spain. Spanish law also gives you digital rights, including the right to disconnect and a degree of privacy on employer devices.

Habits to follow wherever you work

These are the AEPD's main recommendations for remote staff:

• Use strong passwords and multi-factor authentication.
• Keep your software updated.
• Connect through a VPN or other secure access set up by your employer.
• Encrypt your devices and storage, and back up data as your employer instructs.
• Lock your screen whenever you step away.
• Keep work and personal use separate, and do not let family members use your work device.
• Be wary of phishing emails and links.

At home, in coworking and in cafes

At home, secure your router and keep your work area private, so others cannot see your screen or papers.

In coworking spaces and cafes, avoid public or insecure wifi. If you must use it, only do so through the VPN your employer provides. Do not leave your laptop unattended, and take care that no one can read your screen.

If you lose a device or suspect a breach

Tell your employer immediately. Usually that means IT, the security team or the data protection officer. Follow the internal procedure, give them the facts and help contain the problem.

Speed matters because of the 72 hours rule: if personal data is breached, the company must notify the data authority within 72 hours of becoming aware of it, so report a lost laptop to your employer immediately. Your employer decides whether it must notify the AEPD and whether affected people must be told. You do not report to the AEPD yourself.

Failing to report, or ignoring security rules, can lead to disciplinary action.

Common employer restrictions

Many employers ban public wifi unless you use a VPN. Many also limit the countries you may work from. The reasons include data security, rules on transferring data abroad, tax risks for the company, social security and labour-law exposure, and insurance and export-control concerns. Ask your employer for the list of approved countries before you travel and work.

The warnings and FAQ below cover the most common mistakes and questions.

What to watch out for

• Delaying a report of a lost laptop: A lost laptop or a suspected breach that you do not report quickly can leave your company unable to notify the authority in time, and you may face disciplinary action. Tell your employer immediately, usually the IT, security or data protection contact, and give them the facts. Encrypt your devices so a loss is less likely to be a serious breach.

• Public or insecure wifi in cafes and coworking: Open wifi lets others intercept your traffic, and many employers ban it unless you use a VPN. Use the company VPN or secure access, or a personal hotspot. Lock your screen when you step away and keep screens out of view.

• Mixing work and personal use or sharing devices: Letting family use your work device, or doing company work on personal tools, puts confidential data at risk and may break company rules. Use only approved devices, keep work and personal use separate, and protect your home router with a strong password. Use multi-factor authentication and keep software updated.

• Phishing emails: Fake emails and links are a common way to steal work logins when you are away from the office. Do not click unexpected links, check the sender, and report anything suspicious quickly.

• Working from a country your employer has not approved: Many employers limit the countries you may work from because of data-transfer rules, tax, social security and insurance risks. Get written approval from your employer before working from another country.

Frequently asked questions

Am I personally responsible if client data leaks while I work from home?

No, your employer is the one legally responsible for the data, not you. You still have to follow its security instructions, keep data confidential and use only approved devices and tools. Ignoring those rules can lead to disciplinary action under labour law.

Do I have to report a data breach to the data protection authority myself?

No, you only report it to your employer, who decides whether to notify the AEPD, Spain's data protection authority. Tell your IT, security or data protection contact straight away and explain the facts. Help contain the problem if you can.

Why does my employer ban public wifi or working from some countries?

Employers do this to protect data and avoid legal exposure, not to control you. Public wifi is often allowed only with a VPN. Country limits come from data-transfer rules, tax risks such as creating a permanent establishment, social security, labour-law and insurance concerns. Ask your employer before working from abroad.

Can my employer read what I do on a company laptop?

Your employer can set rules for its devices, but you keep digital rights over your privacy when using them. The same law covers your right to digital disconnection. Ask for the company's device-use policy to see what is monitored.