Ghost Data
Personal data that remains in an organisation's systems after its legitimate purpose has ended and the organisation has forgotten it exists.
Full Definition
Ghost data is the subset of data sprawl where personal data lingers in systems the organisation no longer actively manages — abandoned databases, decommissioned-but-not-deleted S3 buckets, snapshots of migrated systems, old backup tapes, archived SaaS tenants, former employee laptops. Each piece of ghost data is in scope of every applicable privacy law: GDPR, DPDP, PDPA all apply to data the Fiduciary holds, regardless of whether the Fiduciary remembers holding it.
Ghost data is a breach amplifier (unmaintained systems are the softest targets), a retention-compliance failure (data kept past its lawful period) and an audit liability (the Fiduciary cannot explain data it does not know about). DSPM tooling exists primarily to surface ghost data: continuous discovery of personal data across the cloud estate finds the stores the data owners forgot about. The remediation is a disciplined decommission pipeline (identify, confirm, erase, document) rather than a one-shot cleanup.
Related terms
Data Sprawl
The uncontrolled growth of personal and sensitive data across an organisation's systems, often beyond its known inventory.
Shadow Data
Personal data that exists outside the organisation's documented inventory and governance programme — in forgotten stores, exports, snapshots or shadow applications.
Retention
The period for which an organisation keeps a specific category of personal data, defined by purpose, legal obligation or user agreement.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes