Shadow IT

Shadow IT is the use of unsanctioned technology by business teams: a marketing team paying for a point-tool with a corporate credit card, an engineer spinning up an AWS account outside the central org, a sales team exporting customer lists to a side-system because the sanctioned CRM is slow. The driver is almost always friction — people adopt shadow tools because the governed path is too slow or restrictive — so suppressing shadow IT without unblocking the underlying need is a losing battle.

For privacy, shadow IT is high risk: tools adopted outside procurement have not been assessed for Data Protection Agreement coverage, sub-processor transparency, cross-border transfer safeguards, retention control or breach notification capability. GDPR Article 28 requires every processor engagement to be governed by a written contract with specific terms; a shadow SaaS has none. Detection combines CASB-style traffic analysis, cloud account discovery, financial-system queries for SaaS invoices, and employee surveys. Response pairs blocking (where risk is unacceptable) with sanctioned alternatives (where the underlying need is legitimate).