Shadow Data — the Copies of Personal Data You Forgot You Made
Every organisation knows where its official personal data lives — the CRM, the HR system, the shared drive everyone agrees is “the source of truth.” That’s not where the risk is. The risk is in the copies: the export someone took, the attachment someone saved, the spreadsheet someone duplicated “just to be safe.” That’s shadow data, and on a Mac it multiplies quietly until nobody can say how many copies of a person’s details exist.
Shadow data is the single biggest reason data mapping is hard — and the single most common thing an audit surfaces.
Where shadow data comes from
Nobody sets out to scatter personal data. It happens through ordinary, well-meaning work:
- Exports. Someone pulls a CSV from the main system to sort, filter or send. The original is governed; the export is not.
- Attachments. A sensitive PDF is emailed, and now lives in the sender’s Sent, the recipient’s inbox, and both Mail Downloads folders.
- “Working copies.” A spreadsheet gets duplicated before an edit — contacts.xlsx, contacts_v2.xlsx, contacts_final.xlsx — each a full copy of everyone’s data.
- Screenshots. A record is captured “to deal with later” and sits on the Desktop for a year.
- Downloads. The universal graveyard: every one-off file anyone ever opened.
- Backups and migrations. Time Machine and Migration Assistant faithfully copy all of the above onto the next disk.
Each step feels harmless. The sum is a personal-data footprint far larger than the official one.
Why shadow data is dangerous
Shadow data breaks GDPR in three specific ways:
- It defeats data minimisation. You’re holding far more personal data than you need — you just can’t see it.
- It breaks storage limitation. The official record gets deleted on schedule; the shadow copy outlives it indefinitely.
- It sabotages every other obligation. A data-subject access request, an erasure request, a breach assessment — all require knowing every place a person’s data lives. Miss the shadow copies and every one of those answers is wrong.
And shadow data is exactly what a breach exploits. When a laptop is lost or an account is compromised, the damage isn’t the governed system behind its access controls — it’s the unencrypted export sitting in someone’s Downloads.
How to find it
You can’t manage shadow data by asking people to remember it — the whole point is that it’s forgotten. You find it by scanning for the content, not the location:
- Scan the messy places first. Downloads, Desktop, Documents, mail stores, and shared drives — where copies collect, not where the official system lives.
- Look for identifiers, not filenames. A working copy won’t be named “personal data.” It’s found by the national IDs, emails, card numbers and names inside it.
- Cluster the duplicates. Five files with the same 200 people in them is one dataset copied five times. Treat it as one problem.
- Trace it to a source. For each cluster, find the governed original. That tells you which copies are redundant.
How to collapse it
Once you can see shadow data, reducing it is straightforward:
- Delete redundant copies — properly, including Trash and backups.
- Keep one governed copy in a controlled, access-limited location.
- Fix the habit that created it. If people export because the main system is awkward to query, that’s the real fix. Shadow data is usually a symptom of friction somewhere else.
- Re-scan on a schedule. Shadow data regenerates. A quarterly pass keeps it from rebuilding.
Doing it on-device
There’s an obvious irony in scanning for scattered personal data by uploading all your files to a cloud service — you’d be creating the largest shadow copy of all. The scan has to stay local.
Your official data map is the easy half. The shadow half is where the compliance actually lives — and where the next breach is waiting. Go find your copies.
Disclosure: I make GDPR File Audit, a Mac app for on-device personal-data scanning — but the approach above works with any tool that scans locally.