News

GDPR and Shadow IT: Two Major Headaches

July 23, 2020

In their day-to-day operations, companies face a number of risks stemming from their employees’ activities. Among these, one of the most significant is human error—that is, any type of management error or mistake resulting from the misuse of the tools at their disposal.

In the following paragraphs, we will discuss one of the risks faced by European companies or those operating in Europe—a risk that is within their power to avoid. We are referring to the GDPR.
To address this issue, we can start by asking ourselves: What is a data breach, and what does personal data have to do with all of this? According to the AEPD, a data breach is an incident that affects the personal data of various individuals. This incident, which is generally accidental in nature, is an event that results in the loss, alteration, or unauthorized access by a third party to this personal and sensitive data. In other words, all European companies are constantly at risk of regulatory violations due to malpractice, negligence, or the use of improper tools by employees in their day-to-day work. Other possibilities include the loss of physical devices, such as USB drives or other data storage systems.
But if there is one phenomenon that significantly impacts a company, it is technology-related. The phenomenon of shadow IT—or parallel IT—is one that organizations of all sizes face. Shadow IT refers to all the technology that, whether corporate control departments are aware of it or not, coexists in day-to-day operations to meet employees’ needs. Examples of shadow IT range from private cloud storage applications such as free personal Dropbox or Box accounts, personal cloud services like OneDrive or Google Drive, and, to top it all off, tools for sharing large files such as WeTransfer.

These aforementioned tools pose a threat both to company-owned information and to the company itself. In general terms, the risks are as follows:

Off-site data storage, beyond the reach of IT and in locations not controlled by the company. In other words, a lack of awareness regarding what data resides on corporate systems, what data is stored on external servers, and where the cloud is located. This poses a significant risk, especially when we consider that it is not just a single employee acting alone; there are companies where tens of thousands of employees use this type of free software.
IT’s lack of awareness regarding what these software companies might do behind the scenes with the stored information. In other words, many of the free tools that meet these needs include, as part of their terms, the right to access data for commercial purposes and to extract data for third parties.
Lack of awareness regarding the security conditions under which data is stored. And this is the main risk: not knowing where the information is stored or under what security conditions. In other words, this is one of the reasons why companies suffer security breaches—due to loss of control over their data.

How to Put an End to These Headaches?

Today, in a world shaped by the pandemic and the new reality of remote work, many security leaders are tasked with ensuring information security within their organizations. Remote work and COVID-19 have completely upended the CISO’s agenda and plans for 2020. Now, organizations need to adopt new channels and establish new approaches to ensure information security in the modern, decentralized workplace.

To address this need, many organizations are providing their employees with Tranxfer as a secure tool that integrates advanced security policies and complements “traditional” methods such as email. With Tranxfer, organizations no longer have to worry about the security of home network connections or the “invisible” use of shadow IT by employees working from home.
With Tranxfer, you can avoid GDPR non-compliance thanks to its advanced security policies focused on minimizing data exposure, encryption, and layers such as antivirus and DLP, as well as traceability and control over data transfers.

How can non-compliance with regulations be harmful?

To begin with, non-compliance with European data protection regulations entails financial consequences due to penalties that range, depending on the size of the organization, from 10 to 20 million euros or between 2% and 4% of the company’s annual turnover.

Not to mention the most delicate consequences: those related to reputation. Their impact, of incalculable value, can harm a brand by discrediting it and causing it to lose market value, leading to far more serious consequences that can result in business interruptions and even the loss of customers.

How can these risks be avoided? We make Tranxfer available to all organizations, regardless of size, to ensure a secure flow of information exchange and to enable remote work under optimal conditions without causing security and technology managers to worry about the use of non-corporate tools and shadow IT.