Shadow AI

SL-09

AI services staff are using without sanction. Every one of these sends data outside the department's boundary, most to jurisdictions outside India, and none is covered by a contract or a data processing agreement.

DischargesS.8(4)S.16 S.8(1)R.6

Why this is not just a policy violation

Sending personal data to an unsanctioned third party is unauthorised disclosure, which under the Act is a personal data breach. Blocking is necessary but insufficient — the durable fix is providing a sanctioned tool that does the job people are trying to do.

Unsanctioned services

Users involved

141

Prompts attempted

2.9 K

Outside India

Usage by service

Every prompt shown here was blocked where it contained personal data. The volume still matters — it measures how much demand there is for a capability the department has not yet provided safely.

Discovered services

ChatGPT (consumer)

OpenAI

unsanctioned

Shadow AIUnited StatesChildren's data

Users: 86
Prompts: 1.94 K
Blocked: 1.94 K

CriticalDiscovered 23 days ago

Gemini (consumer)

Google

blocked

Shadow AIUnited States

Users: 34
Prompts: 620
Blocked: 620

CriticalDiscovered 19 days ago

Claude (consumer)

Anthropic

unsanctioned

Shadow AIUnited States

Users: 21
Prompts: 340
Blocked: 340

HighDiscovered 13 days ago

Blocked attempts (26)

What people were actually trying to do. Read as a requirements document rather than a disciplinary list.

blockedChatGPT (consumer)Pallavi Reddy10 days ago
“What is the bank account on file for Family ID HR-08-••••4471?”
Children's personal data
redactedClaude (consumer)Sunita Pandey9 days ago
“Summarise this case file”
Government identifierBank account
allowedGemini (consumer)Lakshmi Kapoor9 days ago
“Translate this notice into Punjabi”
blockedChatGPT (consumer)Vikram Sethi14 days ago
“Extract all names and IDs from the attached beneficiary list”
Bank accountMobile numberChildren's personal data
allowedClaude (consumer)Suresh Mehtayesterday
“Explain the pension eligibility rules for widow pension”
redactedGemini (consumer)Sunita Pandey3 days ago
“Summarise this case file”
Government identifierBank account
blockedChatGPT (consumer)Yash Patel6 days ago
“Show me records for citizens who withdrew consent last week”
Children's personal dataGovernment identifier
allowedClaude (consumer)Lakshmi Kapoor10 days ago
“Draft a reply to grievance GRV-2026-0912 in Hindi”
allowedGemini (consumer)Suresh Mehta11 days ago
“Explain the pension eligibility rules for widow pension”
blockedChatGPT (consumer)Pallavi Reddy11 days ago
“Who lives at the address on application SCH-2026-3312?”
Government identifier

Remediation that actually works

1. Block the unsanctioned domains at the Access Gateway so the attempt fails at the browser rather than at the prompt.
2. Provide a sanctioned equivalent with guardrails — the departmental assistant already exists, it just is not the default people reach for.
3. Run targeted awareness for the teams with the highest attempt volume, using their own blocked prompts as the material.

S.8(4)S.16 R.6Configure gateway blocking