New NCSC guidance on shadow IT

The National Cyber Security Centre has issued new guidance on managing ‘shadow IT’.

Shadow IT, sometimes called 'grey IT', is any unapproved tools and technologies used in an organisation for business tasks. These aren't managed by the official IT department or policies, so they pose a risk of data breaches and malware spread.

Shadow IT also encompasses cloud services – for instance, employees saving business data in their personal cloud accounts for convenience.

Practices like this challenge your business’s risk management because it's hard to protect what you don't know exists.

Mostly, shadow IT arises when employees try to work more efficiently by using tools they're familiar with, or when official tools fall short.

Common reasons for shadow IT use include:

• insufficient storage space;
• difficulty sharing data externally;
• lack of access to necessary tools or services;
• no official video chat or messaging solutions;
• slow or complex processes for requesting official resources;
• official tools lacking desired features; and
• unawareness of the risks from using personal devices or tools.

You can read the full guidance, including further examples of shadow IT and tips for mitigating the risks it poses, here.

ICO guidance for employers

The Information Commissioner's Office (ICO) has recently published and updated useful guidance for employers relevant to hybrid working arrangements.

New guidance on lawful monitoring of workers

The ICO has provided new direction on how employers can conduct monitoring fairly and in line with data protection law. The guidance also addresses specific monitoring practices, such as using biometric data to keep an eye on employee time-keeping and attendance. You can access the guidance here.

Updated guidance on handling workers' health data

The ICO has updated its guidelines on how to handle workers’ health data.

Health information is among the most sensitive types of data an employer might possess about their employees. And under the GDPR, it’s classified as ‘special category data’. This means there are stricter rules and requirements when it comes to collecting and processing it. So, for employers, handling health data with utmost care is not just a recommendation, but a must.

To help employers navigate this, the ICO’s guidance lays out their legal obligations clearly and also offers some handy best practice examples to consider. It's an invaluable resource to help employers stay compliant and respectful of their employees’ privacy.