In modern industry, cybersecurity is no longer fought only on central servers or office firewalls. For companies with deskless staff, the real risk sits in their employees' pockets. This is known as shadow IT, and it has become one of the main vulnerabilities for Operations and IT managers running plants, warehouses or logistics networks.
Shadow IT doesn't come from bad intentions. It appears when employees, trying to work faster, adopt unapproved tools such as WhatsApp, Telegram or personal cloud storage to coordinate shifts, solve incidents or share photos of delivery notes. What looks like a quick fix for the worker is a serious compliance and security threat for the organization.
The risks for the employer
When company communication flows through channels that IT doesn't oversee, the organization loses the ability to protect its most valuable asset: information. The main risks are:
- Data leaks and GDPR breaches: if an operator shares customer or employee data in an informal WhatsApp group, the company remains legally responsible for that processing. Serious GDPR infringements can be fined up to 4% of global annual turnover or 20 million euros, whichever is higher.
- Zombie accounts and former employees: one of the most overlooked dangers is offboarding. When an employee leaves, HR closes their access to internal systems, but cannot delete the confidential information or contacts that remain in their personal WhatsApp.
- Technical vulnerabilities: shadow IT apps don't receive corporate security configuration or audits. That makes them an easy back door for ransomware attacks that can stop an entire production line.
Employee protections: privacy is non-negotiable
EU law protects employees against intrusive controls by their employer. For an HR Director, trying to "control" shadow IT by monitoring employees' personal devices is, paradoxically, another legal risk.
- Data minimisation: under Article 5 of the GDPR, the company should only process the data it needs. Where less intrusive alternatives exist, it is hard to justify requiring employees' private phone numbers for work.
- Privacy on personal devices: employers have no right to access the personal content of an employee's phone. Indiscriminate monitoring breaches the GDPR and the right to private life protected by the EU Charter of Fundamental Rights and national laws.
- Right to disconnect: several EU countries, such as France, Belgium and Portugal, legally require employers to respect rest time. Work messages through informal apps outside working hours make that very hard to guarantee.
| Risk factor |
Business impact |
What the employee is entitled to |
| Shadow AI |
Confidential information pasted into public AI chats. |
Clear rules and training on safe use. |
| Informal WhatsApp |
No traceability or audit trail. |
Not having to use their private number for work. |
| 24/7 messaging |
Psychosocial risks and digital stress. |
Respect for rest time, where the right to disconnect applies. |
Ommnio: eliminating shadow IT by design
The way to eliminate shadow IT is not to ban tools, but to provide professional ones that are as easy to use as personal apps and fully secure.
Ommnio transforms frontline communication through security and privacy by design:
- An official channel: a company platform that doesn't require the employee's phone number removes the need for WhatsApp. Employees feel protected and the company regains control of its data.
- Access control and logs: unlike personal apps, Ommnio lets IT see who accesses what information and revoke permissions instantly when someone leaves, eliminating "ghost users".
- Automated disconnection: the Quiet Hours feature blocks notifications outside shifts, so compliance doesn't depend on each person's discipline.
- Secure API integration: Ommnio connects company systems such as the ERP or payroll directly to the worker's phone in an encrypted way, so sensitive documents don't circulate through unsecured clouds.
Read more about the specific risks of personal messaging apps in the GDPR fine you don't see, and about employers' obligations in our GDPR guide to employee data privacy for deskless teams.
From shadow IT to governance
Shadow IT is a symptom of the gap between what frontline teams need and the tools the company provides. Ignoring informal channels is not just a technical risk: it puts compliance and business continuity at stake.
Professionalizing communication with Ommnio lets industrial companies move from shadow IT to a governance model where productivity and security go hand in hand, always respecting employee privacy.