Shadow IT

What it means

Shadow IT refers to applications, cloud services and devices that employees use for work without the company’s knowledge or approval. It may be a personal cloud storage account for sharing documents, a free translation tool, a private email address or a task management app.

Staff usually turn to such tools in good faith: they want to work faster and the official tools are insufficient or missing. The problem is that the company does not know where its data are, who can access them or whether they are protected, which runs counter to the GDPR requirement to stay in control of personal data.

Shadow IT is related to BYOD, the use of personal devices. The difference is that BYOD can be managed and approved by the company, whereas shadow IT is by definition outside its oversight. With the spread of AI tools, a new form has emerged: pasting company documents into public chatbots.

How it works in practice

When reviewing a client’s IT, we ask staff which tools they actually use, not just which are official. It often turns out that supplier documents travel through personal storage or messaging apps and that someone forwards work email to a private account.

The answer is not just a ban but an approved alternative that is just as convenient. If the company provides shared storage with easy access and a password manager, the reason for private workarounds usually disappears. A clear rule on which tools may be used also helps.

When an employee leaves, shadow IT complicates revoking access. If company data sat in a personal account, the company cannot remove it or even know what was taken. An overview of the services used should therefore be part of onboarding and offboarding.

What to watch out for

The biggest risk is a leak of personal data or confidential information through a service the company does not control. As controller, the company is responsible even for data it did not know about and must report the incident to the authority, which without an overview of tools in use it often cannot even do.

Unapproved apps are usually not updated under patch management and may contain vulnerabilities. They are also a frequent target of phishing, because their credentials are not protected by company authentication.