The security conversation usually starts with the outside threat. Firewalls, phishing emails, ransomware gangs. All real, all worth defending against. What gets discussed far less often is the risk sitting inside the business already, wearing a staff lanyard and meaning no harm at all.
The employee who is only trying to help
Picture the scenario. A deadline is close, the company file-sharing system is slow or unfamiliar, and a capable, well-liked employee emails a client spreadsheet to their personal Gmail so they can finish it from home. No malice anywhere in that decision. It is simply the fastest route to getting the job done, and it is also, quietly, a data protection incident.
Multiply that single decision across a team over a year and a picture starts to form: work documents in personal Dropbox accounts, client details in WhatsApp chats, passwords shared over Slack because setting up proper access felt like more admin than the task warranted. None of it was intended as risky. All of it adds up to sensitive data sitting outside any system the business actually controls.
This is shadow IT, and it is more common than most owners think
Shadow IT refers to any tool, account or workaround that staff use for work without the business knowing about it or approving it. It thrives in environments where the approved way of doing something is slower or more frustrating than the unapproved way. The fix is rarely to punish the employee for solving a problem. It is to make the approved route the easy one.
What actually reduces this risk
Clear, simple policy on where client and company data is allowed to live matters more than a long document nobody reads. Straightforward, fast tools for the tasks staff are currently improvising around remove the temptation to work around them. Regular, low-pressure reminders, rather than a once-a-year compliance email, keep the message current. None of this requires treating staff as a threat. It requires recognising that policy beats paranoia, and that a workable system beats a strict rule nobody follows.
The POPIA angle
Under POPIA, a business is accountable for personal information even when an employee’s own device or personal account is where a leak occurred. That accountability does not pause because the mistake was well-intentioned.
