How do you keep track of employee data in outside tools?

I’d treat this as a data inventory problem as much as a vendor review problem. For each tool, record what employee data goes in, who owns the relationship, who can access it, how long it stays there, and how it gets deleted when the tool is retired. Revisit that when the vendor or the data use changes, not just at contract signing.

We have a formal review for software purchases, but that doesn’t make the risk disappear. A vendor’s security paperwork is only a snapshot, and it can’t guarantee there won’t be an incident. I’d use the review to set expectations around access controls, incident notice, retention, and deletion, then be clear about what risk the organization is accepting.

For a small organization, start with a basic list rather than waiting for a full vendor-risk program. Ask HR, finance, and team leads which online services they use for employee information, then note the data involved and whether it is genuinely needed there. A simple inventory you keep current is better than a polished process nobody can maintain.

Finding unapproved tools is its own challenge. Purchasing records and sign-in systems can help reveal what services are in use, but neither will catch everything. Have a straightforward way for staff to request a tool and explain what data it needs. That gives people a path to get work done without quietly putting sensitive records somewhere no one is watching.