Shadow IT: Data Mengalir Lewat Jalur yang Tak Tercatat

The list of systems recorded by the IT team is almost always shorter than the list of tools actually used by employees. This discrepancy is called shadow IT, and for companies that handle personal data, this gap is where leaks are the hardest to trace. This article summarizes the definitions and guidelines from official cybersecurity agencies and vendor documentation, then connects them with the recording obligations under UU PDP.

What counts as shadow IT

The UK's National Cyber Security Centre (NCSC) defines it as the use of unknown assets for business purposes: not included in asset management and not aligned with the company's IT processes or policies. It encompasses two types. First, unmanaged devices, such as personal phones or rogue wifi access points. Second, unmanaged cloud services, such as personal storage, unapproved messaging apps, or private code repositories.

An example that is very close to offices in Indonesia: a list of customer numbers uploaded to a WhatsApp group of the team, or a recap file stored on a personal Google Drive for easy access from home. The NCSC distinguishes it from BYOD. BYOD devices are registered and controlled, while shadow IT represents risks that the company may not be aware of.

Why it happens, and how widespread it is

The NCSC emphasizes that the cause is rarely the intention to violate rules. The triggers include insufficient storage capacity, lack of ways to share files with external parties, absence of approved messaging or video tools, or slow request processes for tools. Staff are often unaware that personal tools add risk.

Regarding distribution, Microsoft in its Defender for Cloud Apps documentation states that IT administrators generally guess 30 to 40 cloud applications are used, while the actual average is over 1,000. Microsoft also mentions that 80 percent of employees use unapproved applications. This figure is a claim from vendors selling monitoring products, so read it as an illustration of scale, not a measure for your company. Another study cited by INCIBE-CERT (the Spanish cybersecurity agency) from Lookout: 32 percent of remote employees use unauthorized software and 92 percent use unregistered personal devices for work.

The connection to personal data recording

Article 31 of UU PDP requires personal data controllers to record processing activities. According to a review by Hukumonline, the contents of the record include the sources and purposes of data collection, parties who can access it, and data flow mapping. This is where shadow IT becomes a problem: flows that go through chat groups or personal storage do not appear on any map, so the records are incomplete from the start. Incomplete records also make risk assessment and incident handling rely on a flawed picture.

The consequences are felt during incidents. Notification of data protection failures to data subjects and regulators must be done within 3 x 24 hours, as outlined by Hukumonline. Companies that only discover data in unrecorded channels after a leak will lose much of that time just figuring out what data has been exposed.

Recommendations from official agencies

The series of recommendations from NCSC, Microsoft, and INCIBE-CERT are almost uniform:

First, find out. Microsoft describes a cycle: discover the applications in use through firewall logs, proxies, or agents on devices, assess their risks, then mark them as approved or unapproved. Applications not in the catalog are not automatically detected, so the results need to be read with an awareness of their limitations.
Provide official alternatives. NCSC recommends approved messaging tools, video conferencing, and storage, with a quick request process. Banning without alternatives encourages shortcuts.
Do not punish. NCSC suggests a no-blame culture so that staff are willing to report the tools they use. Staff who fear punishment will hide it more tightly.
Move the data. Data in unofficial services should be moved to supported platforms, not just banned.
Manage identities. INCIBE-CERT mentions single sign-on with two-factor authentication and role-based access as foundational layers.

This topic is also briefly discussed in the PLM class clip about data mapping.

Note of honesty: the official text of UU 27/2022 was not directly opened during the preparation of this writing. The reference to the article is taken from a review by Hukumonline, so please check the text in JDIH before using it as a basis for decisions. The implementing regulations of UU PDP will also only be published in 2026, so the details of its obligations may change.

Shadow IT: Company Data Flowing Through Unrecorded Channels

What counts as shadow IT

Why it happens, and how widespread it is

The connection to personal data recording

Recommendations from official agencies

Sources