An analysis of employee risk perception regarding cloud-based Shadow IT and GDPR compliance in small organizations

Sammanfattning

The findings explore the employee risk perception in cloud-based Shadow IT use and implications of this to GDPR in small organizations. The study was conducted using a mixed-methods approach consisting of a Systematic Literature Review (SLR) and semi-structured interviews. The findings suggest that Shadow IT is a widespread phenomenon in small organizations where the main drivers of use are the convenience, efficiency and ease of use of the unofficial systems compared to the advantages of using officially approved systems. Unauthorized cloud services are sometimes taken up because of functionality limitations of existing tools and time constraints. Simultaneously, the risks related to these practices that are associated with GDPR are often underestimated. Some people notice that certain individuals are aware of the compliance risks, but some don’t believe that these risks will occur, particularly in smaller companies. The results also indicate that the responses to Shadow IT have been extremely informal and are not regulated by any systematic measures. The importance of the risk perception is in the development of the behavior: the higher the level of awareness, the more careful practices will be, the lower the level of awareness, the more powerful the effect of normalizing the non-conforming behavior. In the context of both behavioral and regulatory aspects, this paper details the importance of usability and risk awareness, both of which are vital to improving GDPR compliance. The results will help to understand how to achieve the balance between productivity and regulatory requirements in the scenario of cloud-based technologies.