Windows 10 Encryption: Enable BitLocker

If you store personal data on laptops there is a risk of those devices being lost or stolen. Under GDPR that lost/stolen laptop will have to be reported to your country's Supervisory Authority (SA) within 72 hours, and also report it to the Data Subjects whose personal data you have lost. 

One way to mitigate this risk is to employ Full Disk Encryption on any notebook that will be taken out of the office. The way to implement this depends on which platform and operating system you're running. 

(Note. Always take a backup of any important files before enabling Full Disk Encryption)

For Windows 10, enable BitLocker:

1. Click the Start button and type BitLocker, then select Manage BitLocker.
2. For the required drive, click Turn on BitLocker.
3. Follow the instructions, it may need to enable the TPM hardware in which case it will ask you to reboot.
4. If you rebooted, run Manage BitLocker again.
5. It will ask you how you want to save your recovery key. Save it to a secure server/NAS on your network if possible. It's also prudent to print the key, label it with the computer name and add it to a folder and keep it in the safe.
6. Choose Encrypt used space only if it's a new PC, or Encrypt entire drive if it's an older machine (so that deleted files are also encrypted).
7. Select Compatibility mode.
8. Tick the Run BitLocker system check and click Start encrypting.
9. Windows will start encrypting the drive in the background.
10. To check the encryption progress, Open Powershell as administrator and run the command: 

    manage-bde -status c:
     

11. If necessary you can reboot/shutdown the PC whilst it's still encrypting. Be warned that it may take a long time to reboot, leave it to complete.

If you're running an older version of Windows which doesn't have BitLocker built in, take a look at the Open Source software VeraCrypt.