Crossing borders with a laptop or phone: protect your devices and data
Customs and border officers in many countries have lawful powers to examine the phones and laptops of people entering. You cannot stop a lawful search, but you can decide what a device carries, make sure a lost or stolen device is unreadable, and keep your work safe on the networks you use while away. Travel with full-disk encryption on, a fresh backup at home and only the data you need, and use a VPN for hotel and airport Wi-Fi.
What the rules say
The powers and their limits differ from country to country. Officers act within published rules, and knowing them helps you plan.
| Country | What the published rules say |
|---|---|
| United States | Customs and Border Protection (CBP) Directive 3340-049B, in force since 1 January 2026, allows a basic search of a device without suspicion. Copying a device's contents needs reasonable suspicion or a national security concern, and senior approval. Officers look only at what is stored on the device and switch off its network connection first. |
| United Kingdom | Schedule 7 to the Terrorism Act 2000 allows examination at ports for counter-terrorism purposes without suspicion. Travellers must give access to devices, including passwords, and refusing is an offence. Devices can be kept for up to seven days. |
| Canada | The Canada Border Services Agency examines devices only where there are signs of a breach of the law it enforces. Passwords must be given, and the device is put into airplane mode first. |
| Australia | Australian Border Force treats the data on phones and laptops as documents that officers may examine and copy. |
| South Africa | The South African Revenue Service (SARS) can stop and examine travellers' baggage. SARS publishes no specific rules on searching the data on devices. |
Searches are uncommon. CBP reports that it searched the devices of 55,318 international travellers in its 2025 financial year, out of more than 419 million it processed, and that 92 per cent of those were basic searches.
Before you travel
Encrypt every device
Full-disk encryption makes a device's contents unreadable without the password, which matters most if a laptop is lost or stolen on the trip.
- iPhone and Android phones encrypt their storage by default once a passcode is set. Use a strong passcode rather than a short PIN.
- Mac: turn on FileVault.
- Linux: choose full-disk encryption (LUKS) when installing. Ubuntu offers it in the installer.
Turning a device fully off before a crossing, rather than leaving it asleep, means its data stays locked until the password is entered again. That is Noiz's advice drawn from how Apple and Android encryption work, not a rule from any border agency.
Back up, then travel light
- Back up before you leave, to a copy that stays at home or with your office. The UK National Cyber Security Centre (NCSC) includes backups and remote lock and wipe in its small business guidance for this reason. If a device is lost, kept or damaged, nothing is gone.
- Carry only what the trip needs. Old client files, archives and years of email do not need to cross a border. Some organisations issue a separate travel laptop or phone with only what the trip needs on it.
- Sign out of what you do not need. The UK code of practice allows officers to see data that a device can reach through the apps already on it, not only what is stored locally. CBP and the Canadian agency, by contrast, limit their searches to the device itself.
Secure your accounts and your number
- Turn on two-factor sign-in for email and banking before you go, and carry backup codes separately from the phone.
- Set a PIN on your mobile account with your network provider. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends this to make it harder for someone to move your number to another SIM card.
- Set up remote lock and wipe for your phone and laptop.
On the road
- Treat public Wi-Fi as untrusted. The NCSC advises avoiding unknown hotspots for sensitive work and using mobile data, tethering from your phone or a VPN instead.
- Use a VPN your organisation provides, not a random free one. A VPN encrypts your traffic between the device and the VPN server, so the hotel or airport network cannot read or tamper with it. The NCSC notes that it protects only the traffic sent through it. CISA advises against personal VPN services, which shift your trust to a provider you know little about, and treats a VPN run for your organisation as a different case.
- Avoid unknown charging points and turn off Bluetooth when you are not using it, as CISA advises.
What a VPN does not do
A VPN protects data while it travels across a network. It does nothing for the data stored on a device, so it is no help during a border examination. Encryption, backups and carrying less are what protect the device itself.
If a device is examined or kept
- Stay calm and courteous. The officers are applying their country's law.
- Ask for a receipt if a device is held, and note the officer's details.
- When you get the device back, or if you have any doubt about it, change the passwords of the accounts it was signed in to, from another device.
- For a business device, tell your IT contact so they can check it before it rejoins the network.
Where Noiz fits
The Noiz VPN add-on is a managed VPN, set up and supported by Noiz, with an encrypted tunnel from each desktop, laptop and phone and nothing for the traveller to configure. The Backup add-on is a managed backup for servers and workstations, so the copy at home is taken care of before the trip.
If your team works from airports and hotels, add the Noiz VPN to their devices before the next trip.
Sources
- CBP Directive 3340-049B, border search of electronic devices (January 2026): https://www.cbp.gov/sites/default/files/2026-01/cbp_directive_3340-049b_jan_2026_508.pdf
- CBP, border search of electronic devices: https://www.cbp.gov/travel/cbp-search-authority/border-search-electronic-devices
- Terrorism Act 2000, Schedule 7: https://www.legislation.gov.uk/ukpga/2000/11/schedule/7
- UK Home Office, Schedule 7 code of practice (October 2025): https://www.gov.uk/government/publications/codes-of-practice-for-officers-using-examination-powers-at-ports/examining-officers-and-review-officers-under-schedule-7-to-the-terrorism-act-2000-accessible-version
- Canada Border Services Agency, examination of digital devices: https://www.cbsa-asfc.gc.ca/travel-voyage/edd-ean-eng.html
- Australian Border Force, at the border: https://www.abf.gov.au/entering-and-leaving-australia/crossing-the-border/at-the-border
- SARS, inspections for travellers: https://www.sars.gov.za/customs-and-excise/travellers/inspections-for-travellers/
- CISA, mobile communications best practice guidance: https://www.cisa.gov/sites/default/files/2025-12/guidance-mobile-communications-best-practices_508c.pdf
- CISA, holiday travel with internet-enabled devices: https://www.cisa.gov/news-events/news/holiday-traveling-personal-internet-enabled-devices
- NCSC, virtual private networks: https://www.ncsc.gov.uk/collection/device-security-guidance/infrastructure/virtual-private-networks
- NCSC, Small Business Guide: https://www.ncsc.gov.uk/files/NCSC_A5_Small_Business_Guide_v4_OCT20.pdf
- Apple, FileVault: https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac
- Android, encryption: https://source.android.com/docs/security/features/encryption
- Ubuntu, full-disk encryption: https://documentation.ubuntu.com/security/security-features/storage/encryption-full-disk/
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
