Privacy and Business Risks Sitting in Old Systems

Take an everyday business scenario.

A supplier relationship ends after five years. Six months later, the account manager leaves. The business then migrates to a new platform. The passport copy and bank account details of the former supplier’s director remain inside an old system that was never properly decommissioned.

The director has no idea her personal information is still there. The business may not know either.

That is the problem with digital waste.

It is data that a business continues to carry after the original purpose, relationship or process has ended.

That may include the director’s personal information and supplier onboarding records, as highlighted in the scenario above. It may also include commercially sensitive information existing in archived deal folders, exported spreadsheets and ten early versions of a deal contract that failed to close.

Some of that information may need to be retained. But can the business explain why it has so many duplicated copies of the same data, where the information is housed, who can access it, and when it will be reviewed, restricted or deleted?

Where that discipline is missing, the impact can be significant.

Individuals can be harmed if unmanaged personal data has been retained longer than necessary, and subsequently accessed during a cyberattack.

Businesses can also incur significant operational cost for storage, system management, security monitoring, breach investigation, discovery searches - not to mention the reduction in productivity as staff spend time working out which information is current and correct.

Now add AI into the mix.

When AI tools are connected to file environments that were never cleaned up, old information can, in certain circumstances, be retrieved, summarised or relied on in ways the business did not intend and individuals would not reasonably expect.