A GDPR Audit That Uncovered Shadow MarTech Nobody Approved

I was hired to help a mid-size SaaS company build a data map for a GDPR audit — the boring, necessary documentation exercise of listing every system that touches personal data and why. The plan was a week of interviews and some network sniffing on the marketing site. It turned into three weeks, because the number of tools actually collecting data didn't match the number anyone could name.

The official vendor list had fourteen tools with data processing agreements on file. The actual network tab on the pricing page had twenty-six distinct third-party requests firing. The gap was shadow MarTech — tools a growth marketer or a product manager had signed up for with a company card, wired into the site via a tag manager snippet, and never routed through legal or IT.

How it accumulates

Nobody set out to create compliance risk. Someone wanted to test a heatmap tool for a week, added the snippet, got useful data, forgot to either formalize it or remove it. Repeat that pattern with a chat widget, a referral tracker, an A/B testing tool evaluated and abandoned eighteen months ago but never pulled, and a social proof popup plugin nobody remembered installing, and you get a data map that bears no resemblance to the approved vendor list.

Shadow MarTech isn't a rogue actor problem. It's what happens when adding a tracking script is easier than getting it approved.

What we changed

• A live network audit became a recurring quarterly check, not a one-time audit artifact
• Tag manager publish permissions were restricted so new tags required a second approval, closing the one-click-deploy gap that let this happen in the first place
• A plain internal form for requesting a new tracking tool, short enough that people would actually use it instead of routing around it
• A standing DPA checklist tied to that form so new vendors couldn't go live without one on file

The audit itself passed, eventually, but the real deliverable wasn't the documentation — it was closing the gap between how tags actually get added to a site and how the organization believed they got added. Those two processes had quietly diverged years before anyone went looking.