Guide · Shadow IT
Personal Dropbox for work is shadow IT
Affiliate disclosure: This page contains affiliate links, which are labeled. If you buy through one, Small Biz Cyber Guide may earn a commission at no extra cost to you. Recommendations are not for sale. See the full affiliate disclosure.
It starts innocently: a client file is too big to email, so someone drops it in a personal Dropbox or Drive “just for today.” Months later that personal account holds client documents, the company cannot see who else has the link, backups do not cover it, and when the person leaves, the files effectively leave with them. That is shadow IT — work systems the business does not control.
This guide turns our Short on personal Dropbox use into a practical cleanup: approve one work home for files, migrate what matters, and close the personal-account path without slowing the team down.
Quick verdict
- One approved home for work files: your Microsoft 365 or Google Workspace drive, or another business storage the company admins control.
- Personal Dropbox/Drive is not a work system: no admin visibility, no offboarding revoke, and no business backup guarantee.
- Migrate, then close: move active client files, re-share with named people, and delete the personal copies.
Work storage vs personal accounts
| Topic | Personal Dropbox / Drive | Approved work storage |
|---|---|---|
| Ownership | The individual’s account and recovery email | The business account, with admin recovery |
| Offboarding | Files can stay accessible after departure | Disable the account, access ends centrally |
| Sharing control | “Anyone with the link” links you cannot audit | Named sharing, expirations, and admin review |
| Backup | Sync is not backup; deletions sync too | Can be covered by a real backup plan |
Cleanup steps (this week)
- Name the approved home and tell the team plainly: work files live there, starting now.
- Ask each person to move active work files from personal accounts; owners should not need to hand over personal passwords — have them move files into a shared work folder.
- Re-share with named people instead of open links; add expirations for external shares where the tool allows.
- Check for client or regulated files first (contracts, IDs, health or payment data) and prioritize those.
- After confirming the work copies open correctly, delete the personal copies and empty trash.
- Write the rule into onboarding: which storage, who approves new tools, and what happens at exit. Pair it with our password manager guide so logins and files both offboard cleanly.
Backup is a separate job
Moving files into work storage solves ownership — it does not by itself create a backup. Sync still propagates deletions and ransomware. Cover laptops and your Microsoft 365 / Google Workspace data with a real backup and test a restore. See our backup solutions guide.
Backup option to check: IDrive
IDrive can back up endpoints and, on the relevant plans, Microsoft 365 / Google Workspace data. Check current plan details for the exact coverage you need before you buy.
Bottom line
Convenience today becomes a custody problem at exit, audit, or incident time. Give files one business-controlled home, share by name, back it up separately, and retire the personal-account workaround.
Prefer video? Watch the under-a-minute version on YouTube: Personal Dropbox for Work Is Shadow IT.
Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.
Name one approved home for work files. The Small Business Security Essentials Toolkit ($79) includes Acceptable Use and Data Sharing policies that forbid personal cloud accounts for client work and point staff to the business storage you chose.