An HR manager sets up a free Trello board to track candidates because the applicant tracking system is slow to update. A recruiter pastes a resume into ChatGPT to draft a rejection email. A team lead builds a shared Google Sheet with salary bands because the HRIS doesn’t have a comparison view they like. None of this feels like a security incident. It feels like getting work done.
That’s shadow IT in HR, and it’s sitting inside almost every HR function right now, whether anyone in IT knows about it or not.
What Shadow IT Actually Means in an HR Context
Shadow IT is any software, app, or cloud service employees use for work without formal approval or visibility from the IT department. In most companies, the term gets applied to engineering or sales teams. But HR departments are just as exposed, and arguably more exposed, because HR handles some of the most sensitive data a company holds: salaries, health information, performance reviews, disciplinary records, background checks, bank details.
Common examples inside HR teams include:
- WhatsApp or Telegram groups used to coordinate interviews or share candidate details
- Personal Gmail or Google Drive accounts used to send offer letters or payroll files
- Free scheduling tools connected to a personal calendar
- Spreadsheet-based “mini HRIS” systems built by a single team member
- AI chatbots used to draft policies, JDs, or performance feedback using real employee data
- Browser extensions installed to speed up LinkedIn sourcing or resume parsing
Each of these tools solves a real problem. That’s exactly why they spread so fast, and why banning them outright rarely works.
Why HR Teams Reach for Unapproved Tools
IT teams tend to assume shadow IT comes from carelessness. In HR, it usually comes from pressure. Recruiters are measured on time-to-fill. Generalists are handling onboarding, exits, engagement surveys, and compliance filing at the same time, often without a dedicated systems admin. When the approved HRIS takes three weeks to add a new field, or the ticketing queue for IT support is backed up, people find a workaround.
There’s also a knowledge gap. Many HR professionals don’t think of a shared spreadsheet or a WhatsApp group as “technology” in the way a CRM or an ERP is technology. It’s just how the team has always worked. That’s part of what makes shadow IT in HR harder to catch than shadow IT in a product or engineering org, where new software purchases are more visible on a company card.
The Real Risk: Why This Isn’t a Minor Issue
The stakes in HR are different from other departments because the data involved rarely stays contained to one team. A leaked spreadsheet with compensation data affects trust across the whole company. A resume shared through an unsecured tool can trigger a data protection complaint months later, long after anyone remembers which app was used.
Data privacy and compliance exposure: HR data is subject to some of the strictest regulations that exist, from India’s Digital Personal Data Protection Act to the EU’s GDPR and California’s CCPA. When employee data moves through a tool that was never reviewed by IT or legal, the company usually has no idea where copies of that data are stored, who else can see them, or whether the vendor even meets basic security standards. If a breach happens, “we didn’t know the app was in use” is not a defense regulators accept.
Security gaps that are invisible until something breaks: Unapproved apps sit outside the company’s password policies, multi-factor authentication, and access reviews. 1Password’s 2025 Access Trust Gap report found that roughly half of employees have downloaded apps without IT approval at some point, and a comparable share admit to bypassing IT entirely when it feels like it’s slowing them down. In HR specifically, that often means offer letters, ID scans, or bank details sitting in a personal cloud account nobody is monitoring.
Fragmented, inconsistent employee records: When part of the team tracks leave in one tool and part tracks it in a spreadsheet, HR loses a single source of truth. That shows up later as payroll errors, inconsistent policy enforcement, or an audit that can’t be completed on time.
Loss of institutional knowledge: If a recruiter builds their own candidate tracker and then leaves the company, that data often leaves with them, or simply disappears when the account is deactivated.
Reputational damage: Employees trust HR with information they wouldn’t hand to any other department. A visible data mishandling incident, even a small one, tends to do outsized damage to that trust, and to the employer brand a company has spent years building.
Shadow IT Is Growing Faster Than Most HR Teams Realize
This isn’t a fringe problem. Industry research on SaaS and AI adoption in the workplace consistently points the same direction: unapproved tool use has grown alongside AI adoption, not shrunk. That same 2025 report found roughly 4 in 10 employees admit to bypassing IT specifically to move faster, and close to half of security and IT professionals say unapproved software has already weakened their ability to protect company data.
The pattern in HR mirrors what’s happening company-wide: people aren’t trying to cause harm. They’re solving a real problem with the fastest tool available, and IT finds out after the fact, if at all.
How HR Can Detect Shadow IT Before It Becomes a Problem
You can’t fix what you can’t see. A practical starting point:
- Run an honest audit: Ask HR team members, without blame attached, which tools they actually use day to day beyond what’s officially sanctioned. Most audits turn up more than leaders expect.
- Check expense reports and browser extensions: Small recurring charges and unfamiliar plugins are two of the most reliable signals of shadow IT.
- Review data-sharing habits, not just tools: Ask how offer letters, ID documents, and payroll data actually move between systems. The answer is often more revealing than a list of app names.
- Loop in IT for a joint review: HR and IT rarely sit in the same room for this conversation, but the visibility problem belongs to both functions equally.
Managing Shadow IT Without Shutting Down Productivity
The goal isn’t to lock HR into rigid systems that slow everyone down. It’s to close the gap between what people need and what’s officially approved.
Build a short list of pre-approved tools: Give HR a small, vetted set of options for common needs, scheduling, e-signatures, file sharing, so there’s rarely a reason to look elsewhere.
Make the approval process fast: A large part of why shadow IT spreads is that requesting new software feels slower than just signing up for it. A same-week review process removes most of the incentive to work around it.
Set clear, specific rules for AI tools: Generic “don’t use AI without permission” policies get ignored. Specific guidance, such as never pasting real employee names, ID numbers, or compensation data into a public AI tool, is easier to follow and easier to enforce.
Train HR on why this matters, not just what’s banned: People follow policies they understand. A short explanation of what actually happens after a data leak, the notification requirements, the cost, the trust damage, tends to land better than a rulebook.
Review access regularly: Set a recurring cadence, quarterly works for most teams, to check which tools HR is actually using and retire the ones nobody remembers approving.
Companies that already treat cybersecurity awareness as part of HR’s core responsibility tend to catch shadow IT earlier, simply because the team is already primed to think about where data goes. The same applies to organizations working through a structured HR compliance framework — data handling standards that already exist for compliance purposes usually extend naturally to shadow IT policy.
Frequently Asked Questions
Is shadow IT always a security threat?
Not automatically, but it removes the visibility a company needs to manage risk. A tool can be perfectly safe on its own and still create exposure simply because IT doesn’t know it’s storing employee data.
Which HR functions are most exposed to shadow IT?
Recruitment and payroll tend to see the most, mainly because both involve moving sensitive personal data quickly, and both are functions where a slow official tool creates real pressure to find a faster workaround.
Does shadow IT include AI tools like ChatGPT?
Yes. Shadow AI is now considered a subset of shadow IT, and it’s growing faster than any other category as generative AI tools become part of everyday HR work.
Who should own shadow IT policy: HR or IT?
Both. IT typically owns technical enforcement, while HR owns the people-facing rules, training, and the judgment calls about what data can move where. Neither function can manage it alone.
Bringing HR and IT Onto the Same Page
Shadow IT in HR isn’t going away, and treating it as an IT-only problem misses the point. The tools showing up without approval are usually filling a real gap in HR’s own workflow. Closing that gap takes a joint effort: IT providing visibility and guardrails, HR providing the day-to-day judgment about how sensitive data should actually move.
Organizations that build strong people practices tend to build strong data practices alongside them, because both come down to the same thing: knowing exactly how you’re treating the information people trust you with. That’s the kind of workplace culture worth building toward, and worth getting recognized for.
