My research data was on a stolen laptop, what are my obligations?

You need to treat the loss as a data breach and act right away. Most universities and funding agencies define a breach as any unauthorized acquisition of personally identifiable or sensitive research information, and an unencrypted laptop that’s been stolen definitely fits that description. That means you should report the incident to your institution’s research compliance office (or equivalent) as soon as possible, file an incident report with the IT security team, and let your IRB know that the data you were collecting may now be exposed. After those internal steps, you’ll have to consider notifying the participants whose interview content was on the drive, because they have a right to know that their confidential information might be compromised and to decide whether they want any follow‑up protection. A common misconception is that you can wait until you’re sure the data was actually accessed before you act. In practice, the risk assessment is done before you know the outcome; the mere possibility of exposure triggers the reporting requirement. Most institutions have a set timeline—often within a few days—to file a breach report, and many also have templates for participant notifications. The trade‑off is between acting quickly to meet policy and giving yourself a moment to gather the facts so you can be accurate in your communication. If you delay too long, you could be violating policy, and participants may feel you’re hiding something. On the other hand, sending a vague or overly alarmist notice without confirming what was on the laptop can cause unnecessary panic. The best approach is to report internally first, get a concise risk assessment, and then craft a clear, honest notice that explains what happened, what data was involved, what steps you’re taking, and what participants can do (for example, monitoring for identity misuse or changing passwords if any identifiers were stored). Let’s imagine you were conducting a study on college students’ mental‑health experiences and you recorded audio interviews that included names, dates of birth, and personal anecdotes. The laptop with those files was stolen from your car on a rainy Tuesday night. You call the campus security office that same afternoon, fill out the breach form, and let the IRB know that the data was unencrypted. The compliance office advises you to send a brief email to each participant within 48 hours, saying: “We’re sorry to inform you that a laptop containing your interview transcript was stolen. No one has accessed the files yet, but because the data includes personal details, we recommend you remain vigilant for any unusual activity. We’re offering free credit‑monitoring services and have taken steps to secure the rest of the study data.” By acting promptly, you satisfy institutional policy, demonstrate respect for participants, and reduce the chance of further harm. What you ultimately need to do depends on the specific rules of your institution, the nature of the data, and any contractual obligations you have with funders. In most cases the steps are the same: report the loss internally, get a risk assessment, notify the IRB, and then inform participants in a timely, transparent