Plan it before the resignation, not after. Recovering company laptops when an offshore hire leaves is a privacy control rather than a logistics chore, and most Australian businesses find out which one it is on the morning somebody stops replying. Outstaffer sells the version where the device comes back and publishes what that covers, so read the numbers below as a disclosure of interest.
The regulator opened that file in May 2023 and it is still open
Yesterday the Office of the Australian Information Commissioner published a statement on the 2023 Latitude breach. The useful detail is a date, not a finding. The Commissioner began investigating Latitude's personal information handling on 10 May 2023, accepted a representative complaint in February 2024, and the investigation has still not concluded. Three years and four months with the file open.
The statement is blunt about what sits at the end. Where a contravention of an Australian Privacy Principle is substantiated, the OAIC can apply to the court for a civil penalty order under section 80W.
Scale, from the same regulator. The OAIC received 1,205 data breach notifications in 2025, an 8 per cent rise on the 1,112 notified in 2024. Of those, 716 were attributable to malicious or criminal activity.
Which leaves 489 that nobody attacked you to cause.
What recovering a company laptop costs when the hire leaves
Virtual Coworker's published FAQ sets the market default. "All independent contractors are required to have a professional home office set-up", including "a modern, up-to-date computer capable of handling their tasks efficiently". The same page sets notice at seven days during probation and fourteen after.
Fourteen days, and the computer holding your client files belongs to the person who just gave notice. Nothing to collect, no right to wipe.
Price the alternative honestly. Outstaffer's published Employer of Record fee is $250 per employee per month, read off the live pricing page this morning, which is $3,000 a year for one person and $15,000 across five. For that, the equipment page publishes what the exit looks like: "Remotely wipe data before collecting outgoing employee devices", "Device recovery with end-to-end logistics supported globally by DHL", and wiping "in strict alignment with NIST SP 800-88 r1 standards".
$15,000 a year is a line you can forecast. An open regulator file is not.
Who owns the machine your offshore hire works on?
Whoever paid for it. Somebody has to buy the laptop, and that decision settles whether shipping laptops to offshore staff is an expense you carry or a control you hold. Buy the device and you can demand it back. Let the worker supply it and your only move on the last day is a polite email.
The honest case for not worrying about the hardware
716 of 1,205. The clear majority of notified breaches last year came from someone deliberately attacking an organisation, not from a device walking out a door in Cebu. Phishing, credential theft and ransomware are the volume problem, and a business spending its security budget on courier logistics while running shared admin passwords has aimed badly.
That holds until the day you tell the regulator what happened to a specific file. Then the question is narrow: where is the device, who controls it, and what was on it.
Related reading
- ASD Says The Fix Is Not In The Model, It Is In Who Holds The Laptop
- What A Head Actually Costs Once Someone Itemises It
Own the company laptop, or keep the data off it
Two positions work. Own the hardware, manage it, wipe it and collect it. Or accept the worker's own machine and keep every client record in systems you can revoke, which means no local downloads and an offboarding step that ends the engagement properly rather than quietly.
What does not work is the middle, where most 30-person businesses sit.
What home office setup must an offshore contractor have?
Enough that the work gets done, not so much that it becomes where your data lives. Specify the internet and the workspace. Do not let the specification hand ownership of the machine to the contractor.
If you cannot name who holds each device your remote team works on, that is the audit. Run one role through and see the numbers, or price the hardware yourself and write the recovery step into the contract.
So when your next remote hire resigns, who is legally entitled to ask for the laptop back?
More from
Remote Work
category
%201.svg)
