How to Prevent Data Theft in a Small Business

Data theft comes from two directions, attackers outside the business and people inside it, and the controls that stop one mostly stop the other: limit who can reach what, require a second factor to sign in, block the easy copying routes, encrypt the devices, watch for unusual activity, and take access away the moment someone leaves. This article, first published in 2012 and updated in September 2026 with our older piece on insider data theft folded in, covers both directions and the policies and technical controls that work for a business of five to two hundred people.

Data theft is still theft

If your business uses email and computers, some of your data has probably already walked out the door, not through a hacker but through an employee who meant no harm. A document emailed to a personal account to finish at home and never deleted. A project folder copied to a thumb drive. A customer list downloaded the week before a resignation. Contacts synced to a personal phone. Most people would never take a laptop, yet copying data does not feel like theft to them, and it is far more damaging: a client list in a competitor’s hands or a former employee’s pricing spreadsheet can cost more than any piece of equipment. The reverse is also true. A new hire who brings a customer list from their last employer makes your company party to the theft.

Where the data goes

• Personal email. Forwarding rules and “send to self” are the most common route and the easiest to detect in the mail logs.
• Removable drives. Thumb drives and external disks, still cheap and still everywhere.
• Personal cloud storage. Dropbox, Google Drive and iCloud accounts signed into on a work computer.
• Personal devices. Phones and home computers with company mail and files synced to them.
• Printing and photographs. Low-tech and hard to prevent, which is why access limits matter more than any single blocking tool.
• Access that outlives the job. Former employees whose passwords still work weeks later, a problem our guide to protecting systems from ex-employees addresses directly.

Policies that hold up

Write down what employees may and may not do with company data, have them sign it, and repeat it at offboarding. Include: no forwarding to personal accounts, no personal storage services, no removable media without approval, company data stays on company-managed devices, and everything is returned or deleted on departure. State plainly that data from previous employers must not be brought in. A policy nobody reads is still the document that lets you act when something happens, and it is what the cyber insurer and the auditor ask to see.

Technical controls

• Least privilege. People see the folders and systems their role needs, not the whole company. The customer database does not need to be open to the warehouse.
• Multi-factor authentication on every account, so a stolen or shared password is not enough from outside, and so accounts can be revoked reliably.
• Block the easy routes. Microsoft 365 and endpoint tools can block USB storage, prevent forwarding to external addresses, restrict personal cloud services and watermark or restrict sensitive documents. Log what cannot be blocked.
• Encrypt every laptop and phone, so a lost or taken device does not become a breach. Our guide to encryption explains the options.
• Monitor. Alerts on new mail-forwarding rules, bulk downloads, sign-ins from new locations and large transfers to removable drives catch most incidents while they are happening. Managed detection covers the outside attacker doing the same things with a stolen password.
• Offboard in an hour. Every account disabled, devices collected, shared passwords changed, and a review of what the person accessed in their final weeks. This requires an inventory of accounts, which is worth having anyway.
• Back up, because data theft is sometimes data deletion, and a tested backup is the only recovery.

The outside threat

Attackers want the same data and use the same paths, with a stolen password in place of a badge. The controls above stop most of them, and preventing ransomware attacks and our endpoint security guide cover the rest: patching, email filtering, endpoint detection and a response team. Staff training closes the loop, since the phishing email is where most outside theft begins; our phishing quiz is a good place to start.

If it happens

Preserve the evidence before anything else: logs, the mailbox, the device. Revoke access. Talk to counsel before confronting the person. If personal data about customers or employees was involved, notification laws may apply, and our data breach response plan lays out who does what. Under a managed plan, most of the monitoring and the offboarding above already happens; our network security service puts the technical controls in place for businesses that do not have them yet.

Common questions

What counts as data theft by an employee?

Copying company data somewhere the company does not control: emailing documents to a personal account, moving files to a thumb drive or personal cloud storage, downloading the customer list before resigning, or keeping access after leaving. It is theft whether or not the person meant harm, and it is the most common form of data loss that small businesses never detect.

How do we stop staff taking data when they leave?

Disable every account within the hour on their last day, including Microsoft 365, VPN, line-of-business applications and shared passwords; collect devices; and review what they accessed and downloaded in the final weeks. Both the policy and the technical ability to do this have to exist before the day comes.

Is it legal for a new hire to bring data from their last employer?

No, and it exposes your business. Customer lists, pricing and documents from a previous job are that employer’s property, and using them can put your company on the wrong end of a lawsuit. Say so in the offer letter and mean it.

What technical controls matter most?

Multi-factor authentication on every account, access limited to what each role needs, blocking or logging removable drives and personal cloud services, encryption on every laptop, and monitoring that flags unusual downloads or mail forwarding rules. Endpoint protection and a tested backup cover the outside threats.

What should we do if we discover data was taken?

Preserve the evidence, revoke the person’s access, and involve counsel before confronting anyone. If customer or employee personal data was involved, breach notification laws may apply. Our data breach response plan walks through the steps.

Talk to us

Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.