Business Travel Cybersecurity: What to Do Before You Leave

The sales director of a manufacturer in Vaughan heads to a three-day trade show in Las Vegas, then a week in Mexico City. Her laptop holds price lists, the client file, and access to email and the CRM. At the hotel, she joins the free Wi-Fi. At the airport, she charges her phone at a USB kiosk. On the way home, the phone stays behind in the back seat of a cab.

Taken one at a time, none of this is dramatic. Put together, it leaves a lot of doors open. The good news: an hour of preparation before departure covers most of the risk.

Before you leave: prepare your devices

The best protection when travelling is to leave with less: fewer devices, less data, and devices that are updated, encrypted and backed up. That's the heart of the Canadian Centre for Cyber Security's Mobile devices and business travellers (ITSAP.00.087, October 2024), which also recommends asking IT for a travel device before high-risk trips.

• Operating system and apps up to date.
• Disk encrypted, and the device locked with a PIN, password or biometrics.
• A recent, verified backup.
• Remote wipe turned on, as Travel.gc.ca also recommends.
• Unneeded data removed; sensitive files stay in the company's cloud environment instead of being copied to the disk.
• Bluetooth, location and Wi-Fi auto-connect turned off.
• A company-issued travel device for high-risk destinations.
• Your IT provider's emergency number written down somewhere other than your phone.

Public Wi-Fi, hotels and charging stations

Use your cellular data or your phone's hotspot whenever you can: the Canadian Centre for Cyber Security recommends it and advises avoiding unknown, unsecured or public Wi-Fi networks when accessing sensitive information. The Cyber Centre also says to assume there is no privacy in offices, hotels, Internet cafés and other public places.

If you have to use hotel or trade show Wi-Fi:

• confirm the exact network name with staff, since a fake network with a near-identical name is easy to set up;
• connect through your company VPN, if it's available and legal in the country you're visiting, as Travel.gc.ca points out;
• stay away from sensitive accounts, such as banking, on public networks;
• turn off "Remember me" on business websites.

For charging, Travel.gc.ca advises against using public computers and unknown devices or storage media. Bring your own wall charger or a power bank. And watch for people looking over your shoulder on the plane or in the lounge. The same habits apply to remote work at your local coffee shop.

Multi-factor authentication on the road

Plan your multi-factor authentication before you leave: a text message code may not arrive abroad, and a lost phone can lock you out of every account. A few precautions save a lot of frantic calls to IT:

• use an authenticator app or a security key, which work without a cellular network;
• register a second method, such as a security key packed in a different bag;
• print your backup codes and keep them away from your phone;
• if your company blocks sign-ins from certain countries, give your IT provider your itinerary;
• never approve a prompt you didn't trigger, especially in the middle of the night abroad.

Our guide to choosing the right multi-factor authentication method compares the options.

At the border: what officers can examine

At the Canadian border, CBSA officers can examine your personal digital devices under the Customs Act, but these examinations are not routine: according to the agency, they happen only when there are indicators that border laws may have been contravened. Its page, updated in March 2026, reports that 0.007% of travellers processed at the border had a device examined between November 2017 and December 31, 2025.

What the CBSA says:

• "You are obligated to provide your password when asked." Refusing may lead to the device being detained.
• The officer disables network connectivity, for example with airplane mode, and only examines what is stored on the device.
• If the officer finds content protected by solicitor-client privilege, they must stop inspecting it. If that applies to you, say so up front.

In the United States, Customs and Border Protection (CBP) distinguishes a basic search, done manually, from an advanced search, where equipment is connected to copy or analyze the contents. According to CBP, an advanced search requires reasonable suspicion and approval from a senior manager. A device that can't be inspected may be detained, and a foreign national's refusal may be weighed in the admissibility decision.

The practical takeaway is simple: if you carry confidential client information, the safest approach is not to have it on the device. The Cyber Centre also recommends powering off your devices as you go through customs. Answer questions honestly and, if a device is seized, ask for a receipt. This summary isn't legal advice: check your situation with your legal advisor, especially if you carry information protected by professional privilege.

Lost or stolen device: the first hour

Report the loss to your company immediately: locking, remote wipe and ending sessions only work if they happen fast. In order:

1. Call your IT provider to locate, lock or wipe the device.
2. Have open email and business app sessions ended, then change the password for your main account.
3. Report the theft to local police; your insurer will ask for the report.
4. Assess what the device contained. For a Quebec business, losing unencrypted personal information is a confidentiality incident under Law 25: record it in your register and, if it presents a risk of serious injury, report it to the CAI and to the people affected. Elsewhere in Canada, PIPEDA has its own breach rules. Have your legal advisor validate the assessment.

An encrypted, locked device changes everything: the thief gets hardware, not your data.

When you get back

When you return, change the passwords for accounts you used abroad and have your devices scanned before reconnecting them to the company network, as the Canadian Centre for Cyber Security recommends. Report any unusual device behaviour to IT, and glance at the sign-in history of your main accounts.

To turn these rules into habits, a one-page travel policy and devices configured in advance beat a long email before every trip. Our team can set them up with you through our ongoing security partnership. To talk it through first, book a free consultation with one of our experts.