How to Protect Client Data in Your Home Office: A Practical Checklist for Solo Business Owners

When you work from home, you are the IT department. There's no security team checking your laptop, no locked records room and no one to call when an email looks off. Yet the data you handle is the same as in any office: client names and addresses, contracts, invoices, tax forms and sometimes payment details.

Criminals know this. The FBI's latest Internet Crime Report counted nearly $21 billion in reported cybercrime losses in 2025. Business email compromise, the scam where someone poses as a client or supplier to redirect a payment, accounted for about $3 billion of that on its own.

The good news is that protecting client data at home doesn't take expensive software. It takes a few settings, a couple of free tools and some habits. This checklist follows the five principles in the FTC's guide for businesses, adapted for a one-person home office.

---

1. Take Stock: Find Where Client Data Actually Lives

You can't protect what you've forgotten about. Spend fifteen minutes listing every place client information ends up. For most solo businesses it's more spread out than expected:

---

2. Scale Down: Keep Only What You Need

The safest data is data you never stored. A few easy wins:

• Don't keep full card numbers or Social Security numbers unless the law or your work truly requires it. Let your payment processor hold card details.
• Clear your Downloads folder once a month after filing what matters in one proper place.
• Review shared links and folders in your cloud drive and remove access for finished projects.
• Set a retention rule, for example "client files are deleted X years after the project ends," based on what your accountant or industry rules require.

---

3. Lock It: The Settings That Do the Heavy Lifting

Use a password manager

Reused passwords are how one leaked account turns into five. A password manager creates and remembers a unique password for every login. Bitwarden's free plan covers unlimited passwords on unlimited devices, and its Premium plan is $19.80 a year. If you're all-Apple, the built-in Passwords app (iOS 18 and macOS Sequoia or later) stores passwords, passkeys and verification codes at no cost.

Turn on two-factor authentication, in the right order

CISA, the US government's cybersecurity agency, says multifactor authentication makes you 99% less likely to be hacked. Start with the accounts that unlock everything else:

1. Email, because every password reset goes there.
2. Banking and payment accounts.
3. Cloud storage where client files live.
4. Your website host and domain registrar, so nobody can take over your site.

Not all second factors are equal. Text-message codes are better than nothing, but CISA notes that SMS isn't encrypted and can be intercepted. An authenticator app or a passkey is stronger, and a hardware security key (such as a YubiKey or Google Titan) is the top option for your most important accounts.

Encrypt your laptop

If your laptop is stolen from your car or a café, encryption is the difference between losing a device and losing your clients' data.

• Windows 11: go to Settings → Privacy & security → Device encryption and turn it on. It's available on Home editions with supported hardware; on Pro you can also use BitLocker. If you sign in with a Microsoft account, the recovery key is saved to that account. Check that it's there.
• Mac: go to System Settings → Privacy & Security → FileVault and turn it on. Store the recovery key somewhere safe, such as your password manager.
• Phone: use a six-digit passcode or longer plus Face ID or fingerprint, and set auto-lock to a minute or two.

Separate work from family life

• Give the work computer its own user account, and don't let kids or guests use it.
• Lock the screen every time you step away: Windows key + L on a PC, Control + Command + Q on a Mac.
• Keep paper files in a locking drawer or cabinet, not on the desk.
• Put smart devices on a separate guest network. Our guide to securing your home office Wi-Fi walks through it.
• Turn on automatic updates for your computer, phone, browser and router. Most attacks use holes that already have a fix.

Smart home blind spot: an indoor security camera pointed at your desk can record your screen and the papers on it, and a smart speaker in the room hears your client calls. Angle cameras away from your workspace, and mute the speaker's microphone during confidential calls.

---

4. Watch for the Scam That Costs Businesses the Most

Business email compromise doesn't need malware. A message arrives that looks like it's from a client or supplier: "We've changed banks, please send this invoice to the new account." Sometimes it really does come from their account, because their email was hacked.

• Call to confirm any change in payment details, using a phone number you already have, not one in the email.
• Slow down when a message is urgent. Pressure to act "today" is the most common red flag.
• Tell your clients how you'll never ask them to pay, for example "we will never change our bank details by email."

---

5. Pitch It: Dispose of Data Properly

The FTC's advice is simple: shred, burn or pulverize paper, and don't trust the Delete key with old devices, because deleted files can stay on the drive.

• Paper: use a cross-cut or micro-cut shredder. Strip-cut shredders leave long strips that can be pieced back together.
• Windows PC: before selling or donating, use Settings → System → Recovery → Reset this PC → Remove everything and choose the option to clean the drive.
• Mac: use Erase All Content and Settings in System Settings → General → Transfer or Reset.
• Phones: sign out of your accounts, then do a full factory reset.

---

6. Plan Ahead: A One-Page "If Something Happens" Plan

You don't need a binder, just one page you can find under stress:

• Who to call: your bank's fraud line, your email provider, your website host, and an IT or legal contact if you have one.
• First moves: change the email password, sign out all sessions, check email forwarding rules (attackers love to add one), and freeze any pending payments.
• Clients: every US state has a data breach notification law, so know your state's rules before you need them.
• Backups: keep a copy of important files that isn't connected to your computer, so ransomware or a dead laptop isn't the end of your business.

---

Your Home Office Data Checklist

Sources: FTC, Protecting Personal Information: A Guide for Business; CISA, Multifactor Authentication; FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Prices and settings checked October 2026.