How to report a colleague going through your laptop or phone

MacWindowsUpdated

You can report someone who went through your laptop or phone at work. Most cases start inside work, with your manager or HR and with the IT or security team. If personal data was involved, the ICO has a complaints route. For cyber crime, the national police reporting service is Report Fraud.

This is general information, not legal advice. For a real case, speak to a solicitor (or a lawyer in the US).

Quick answer

Start at work. Tell IT or the security team about the device, and HR or your manager about the person. If your personal data was mishandled, complain to the organisation first, then to the ICO if you're not satisfied. For cyber crime, the national reporting service is Report Fraud, at reportfraud.police.uk or on 0300 123 2040. In the US, the FBI's IC3 takes reports.

Should I start with HR?

For the behaviour itself, yes. GOV.UK says that if you've tried to solve a problem informally by talking to your manager and you're not satisfied, you can make a formal grievance complaint in writing. Your employer should have a written grievance procedure that tells you what happens at each stage.

  1. Find your workplace's grievance procedure, usually in the staff handbook or on the intranet.
  2. Raise it informally with your manager if that feels right.
  3. If that doesn't settle it, put a formal grievance in writing, with dates and what you noticed.
  4. You'll have a meeting to discuss it, and GOV.UK says you can appeal if you don't agree with the decision.

GOV.UK adds that you and your employer should follow the Acas code of practice on disciplinary and grievance procedures, and that if a claim goes to an employment tribunal, any compensation could be adjusted by up to 25% where it wasn't followed.

When should the IT or security team be involved?

Straight away, for anything about the device or your accounts. The NCSC's advice for staff is to contact your IT helpdesk if you're unsure what to do in a particular situation.

Tell IT what you noticed and when, and leave the laptop as it is so nothing they'd look at gets cleared. For the checks you can do yourself first, see what to do if someone at work accessed your laptop.

When does the ICO come in?

When personal data is involved, and usually after the organisation has had its chance. The ICO says organisations must have a data protection complaints process, and that you might complain to an organisation if you're worried it hasn't kept your personal information secure, or because it used your information in a way you didn't expect.

  1. Make it clear that your complaint is about data protection.
  2. The ICO says the organisation has 30 days to acknowledge your complaint, which isn't the same as resolving it.
  3. If you're unhappy with the outcome, you can complain to the ICO. It says you can do this at any time, but recommends letting the organisation finish its process first.
  4. For the ICO's form you'll need an email address for the organisation and a copy of your complaint to it. A timeline of key events helps.

Set expectations honestly. The ICO's complaints page says complaints it needs to look at in more detail are currently being assigned to case officers around 10 months after submission, and it can't award compensation.

Separately, section 170 of the Data Protection Act 2018 makes it an offence for a person knowingly or recklessly to obtain or disclose personal data without the consent of the controller, and the ICO prosecutes these cases. In May 2024 a former management trainee at Enterprise Rent-A-Car was ordered to pay a £265 fine and £450 costs after pleading guilty under section 170; the company had referred the case to the ICO. Whether your case counts as a data breach is covered in is it a data breach if a colleague reads your files.

When is it a police matter?

When it may be an offence under the Computer Misuse Act 1990. What the Act says, and how the CPS applies it to employees, is in is it illegal to access someone's computer in the UK.

GOV.UK announced that from 4 December 2025, City of London Police's Report Fraud replaces Action Fraud as the national platform for reporting cyber crime and fraud, at reportfraud.police.uk or on 0300 123 2040, the same number as before.

The routes can overlap. In October 2024 two former RAC call-centre staff, found by the RAC's new security software and reported by the RAC to the ICO, received suspended prison sentences after pleading guilty to offences under both the Computer Misuse Act and the Data Protection Act.

What if I'm in the US?

The FBI's Internet Crime Complaint Center, IC3, describes itself as the central hub for reporting cyber-enabled crime, run by the FBI. It says to file a report even if you're unsure whether your complaint qualifies, at ic3.gov. If you or someone else is in immediate danger, IC3 says to call 911 or your local police.

If someone has used your personal information, the FTC points people to IdentityTheft.gov to report and recover from identity theft. For the federal law on computer access, see unauthorised computer access law in the US.

What should a report include?

The same short record works for every route. Write down the dates, when you were away from your device, what you noticed, and who you've already told. Keep copies of emails and of any complaint you've sent. The ICO's complaint form asks for a copy of your complaint to the organisation, and says a timeline of key events helps.

Stick to what you saw. Reports built on facts are easier for HR, the ICO or the police to act on.

Where Failshot fits

Your password is the first layer. Failshot is the second: a photo of whoever unlocks your Mac while you're away from your desk.

While it's on, Failshot photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, with the photo and the time. Photos, and Pro videos, are kept on your Mac, and leave it only in Pro email alerts and the encrypted web vault, if you turn those on.

It's for a Mac you own or are authorised to manage, running macOS 14 or later. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. The trial is on failshot.app, for the Mac. iPhone, Android and Windows are coming soon.

More questions

Do I have to go to HR before the police?

No route depends on another. Many people start at work because HR and IT can act quickly and see records you can't. If you think it's cyber crime, you can report it to Report Fraud directly. A solicitor can advise on a specific case.

Will the ICO look into one person's snooping?

The ICO handles complaints about organisations and expects you to complain to the organisation first. Section 170 offences by individuals are prosecuted by the ICO, and in the two cases above, the employer referred the matter after finding it through its own checks.

Is looking at my screen something I can report?

You can raise it with your manager or HR. Shoulder surfing at work covers what the law says about reading a screen, and how to keep yours private.

Can I use Failshot on my work Mac?

Only with your employer's agreement. It's their device, and they're responsible under data protection law for any monitoring on it. For Failshot, that also means they've agreed Failshot's Organisation Terms and told everyone who uses the laptop before Failshot is turned on.

Can I get compensation?

The ICO can't award compensation. It says you can claim compensation directly from an organisation if you've suffered damage because it broke data protection law, and that if it won't pay, the next step would be a court claim. The ICO strongly recommends independent legal advice first.

Sources