Secure remote working
for a small business

It depends on where the things your team uses actually live. If the work lives in the office, on a server, a NAS with the shared folders or a management program installed on a machine there, then yes: the sensible way in from home is a VPN that requires two-step verification, not opening that server or remote desktop directly to the internet. If everything you use is already in cloud services, email, documents and management software, you may not need the VPN, because each service is already reachable over an encrypted connection; what becomes critical then is identity: individual accounts, mandatory two-step verification and the ability to remove someone's access in a minute. What makes no sense is something we see often: a VPN set up to get into the office and, right next to it, remote desktop open to the internet because it was more convenient.

No. Spain's remote working law (Ley 10/2021) states that the employer must provide the worker with the necessary resources, equipment and tools, and that it cannot require software or apps to be installed on devices the worker owns, nor require those devices to be used for remote work. That law applies to regular remote working, which it defines as at least thirty per cent of working hours over a three-month period; for occasional situations, or if an employee voluntarily prefers to use their own machine, it can be agreed, but in writing and with conditions. From a security point of view, a company computer is almost always the better option: it's up to date, encrypted and configured by you, and you get it back when the person leaves. Specific employment questions are for your adviser; we'll tell you what technical conditions each option has to meet.

The minimum ones in the AEPD's note on mobility and remote working: a genuine, up-to-date operating system and software, and considering limiting those machines to a restricted part of the network, the one with the least critical resources. To that we add what experience teaches: a separate user account on the computer for work, which the AEPD itself recommends so personal and professional activity don't mix; no company data stored on the local disk, but in the company's shared storage or cloud; no passing documents through personal email, messaging apps or private cloud accounts; two-step verification on every work account; and the computer locked with a password when nobody is using it. Put it in writing, have the person sign it, and make sure they know it also helps protect their own data. If the role handles sensitive information, the honest answer is that it needs a company computer.

It doesn't reduce them, and in practice it adds work. The business remains the controller for the data handled from home, just as if it were handled in the office, and has to apply appropriate technical and organisational measures for that new setting. The AEPD's recommendations for mobility and remote working ask, among other things, for a written remote working policy, informing staff of their obligations and the risks, limiting access according to role and device, and keeping computers updated and properly configured. If a laptop with customer data is lost on a train or a home computer gets infected, the breach belongs to the business, with the obligation to always document it and to notify the AEPD within 72 hours when it poses a risk to people. Working remotely doesn't shift that responsibility onto the employee.

Less than people tend to think if everything else is done properly, and more than it should be if it isn't. With access to the business encrypted, whether through a VPN or through cloud services that already are, whoever shares the home wifi can't read what goes over it. Even so, a minimum is worthwhile: change the router's factory password, use the most modern encryption it supports, keep the router updated and don't have devices on the same network that nobody knows anything about. If the provider's router can't be updated or even minimally configured, the article on the provider's router versus your own explains when it's worth replacing. What the AEPD does explicitly advise against is connecting to the company network from public places and open wifi networks, such as a café's or a hotel's: for that, it's better to use your phone's data.

The simplest way is for there to be nothing to back up on the laptop: work documents saved straight to the company's storage, whether the office server through remote access or the corporate cloud, with backups made there as always. That's also what the AEPD recommends: avoid storing information generated while mobile locally, use the shared resources the organisation provides, and don't block or disable the backup policy. The problem starts when everyone saves to their laptop's desktop, because those files aren't in any backup and are lost along with the computer. Check where each person really saves things, not where they should. And remember that having information in the cloud is not the same as having a backup: a deletion or ransomware syncs just like a good change does.

The same as with someone in the office, but faster, because there's no waiting for them to hand back a key before they can no longer get in. On the same day: disable their account on every service, revoke their VPN access, close open sessions and change any shared password they knew. If they used a company computer, get it back; if they used a personal one with a work user, delete that user and any company data that might be there, ideally with the person present or through remote management agreed beforehand. That's why it matters so much that everyone has their own accounts and that someone keeps the list of what each person has access to: without that list, offboarding depends on someone remembering every place. It's one of the points we go through in the article on IT maintenance and GDPR.

Yes, and it doesn't have to be long. The AEPD's note on remote working starts precisely there: define a policy for mobile working, inform staff and have them sign an agreement setting out their obligations. In a small business it can fit on two pages: which computer is used and under what conditions, how people access the business, where documents are saved, which channels are allowed for sharing information and which aren't, what to do if a device is lost or an email looks suspicious, and who to tell. If remote working is regular, Ley 10/2021 also requires an individual remote working agreement with its own minimum content, which is a matter for your employment adviser. What matters is that what the paper says matches what is configured: a policy that bans saving locally, on laptops where everyone saves locally, protects nothing.