A lost or stolen laptop without encryption is a data breach: anyone removing the drive can read data. With encryption it stays unreadable. For personal data this is also a recognised technical measure.
How BitLocker works
Encryption generally uses the device's TPM chip so startup works without additional input.
Optionally a PIN can be required before start for higher protection.
A recovery key allows access if hardware or boot configuration changes.
Manage centrally
Back up recovery keys automatically to Entra ID or Active Directory.
Enforce encryption through Intune or group policy.
Report compliance: which devices are encrypted?
Define a process for releasing keys, with identity verification.
Typical pitfalls
A missing or inactive TPM, keys that were not backed up and firmware updates that trigger recovery. Plan these cases before rollout.