These work-arounds are usually driven by practical needs, such as speed and flexibility. But they also point to a disconnect between how institutional systems are designed and how people actually use data. When governance frameworks are unclear, inconsistent or difficult to follow, users are more likely to find their own solutions.
That disconnect is a growing concern. The “2025 EDUCAUSE Horizon Report: Data and Analytics Edition” describes a shift toward unified data models and integrated data ecosystems, yet notes that many institutions still lack the governance structures and data literacy needed to support that vision. This creates an environment in which shadow data can proliferate.
As data moves outside governed systems, institutions lose visibility and control, along with the ability to answer critical questions like, where is sensitive data stored? Who has access? How is it protected? Without clear answers, institutions increase their exposure to security incidents and compliance risks.
Where Shadow Data Lives
In higher education environments, shadow data often accumulates in familiar places:
- Personal laptops and external drives
- Departmental shared folders
- Unsanctioned cloud storage platforms
- Research data sets stored outside institutional repositories
- Student data exports used for analysis or reporting
Faculty may download class rosters to manage grades offline. Researchers may store data locally for faster processing. Administrative staff may export student information to spreadsheets for streamlined reporting. While these shortcuts can improve productivity in the moment, they fragment the institution’s data ecosystem.
That behavior has broader consequences. “Data is most valuable when access is coordinated, shared and supported by unified systems rather than fragmented across siloed units,” Pelletier says.
But shadow data does the opposite. It creates silos that weaken data quality, limit collaboration and increase risk.
From Shadow IT to Shadow Data: Why the Problem Has Evolved
These examples point to a broader shift. Higher education institutions have long dealt with shadow IT or unsanctioned apps and systems used by faculty and staff. But the problem has evolved.
LEARN MORE: Data governance is considered a human issue.
Today, even within approved tools, users can extract, copy and share data in ways that bypass governance. A data set may start in a secure system but quickly move into spreadsheets, personal devices or external platforms, creating new layers of risk.
The rise of cloud services, application programming interfaces and AI tools has accelerated this dynamic. Data is easier than ever to move and duplicate. While that flexibility supports innovation, it also increases the likelihood of data sprawl.
Pelletier says growing demand for access is a key driver. “With the accelerating pace of AI innovations and growing data needs — such as staff and student access to APIs for workflow automation — institutions must establish clear and consistent approaches to organizing and accessing their data,” she says.
In other words, the challenge is no longer just controlling systems. It is managing how data flows across them.
The FERPA Problem: How Unsanctioned Data Creates Compliance Exposure
The Family Educational Rights and Privacy Act governs how institutions handle student education records, requiring that personally identifiable information be protected and shared only under specific conditions.
FERPA compliance becomes harder to meet when data moves beyond approved systems. When faculty or staff download student information into spreadsheets or store it on personal or unsanctioned platforms, it may no longer be protected by institutional safeguards, such as encryption.
WATCH: Four AI trends to monitor this year.
This is where shadow data becomes a compliance risk. A spreadsheet containing student records stored on an unsecured device or shared improperly can expose sensitive information and potentially violate FERPA.
Just as important, responsibility does not shift when data leaves institutional systems. Under FERPA, institutions remain accountable for safeguarding education records and controlling access to student data, even when it is stored or processed outside core environments.
That is why governance is critical. “Mature data governance and management practices are essential,” Pelletier says. “They safeguard data quality, security and compliance across the institution.” Without those practices, institutions face “greater security and privacy risks, inconsistent data definitions and misguided planning.”
