Stoke-on-Trent City Council has been told to improve its data security after a memory stick with personal details about 40 children in care was lost.
The unencrypted USB stick had no password protection and was found by someone in Hanley on 26 March.
There was a legitimate reason for the data to be on a mobile device but more security was needed to protect it, the Information Commissioner's Office said.
The council has agreed to better train its staff how to handle sensitive data.
A member of the public gave the social services' USB stick to journalists who handed it back to the council.