Dark data is information collected and stored by an organization but never analyzed, used, or leveraged, often containing personal data that creates unmanaged privacy risk.
Source: IQWorks Glossary — iqworks.ai | Last updated: 2026-02-01
Last verified: February 1, 2026
Dark data refers to data that organizations collect and retain but do not actively use for any business purpose. Research estimates that 60-90% of enterprise data is dark data. This unused data often contains personal information that creates privacy risk without corresponding business value—it increases breach exposure, storage costs, and compliance complexity.
The storage limitation principle under GDPR and DPDP Act requires that personal data not be kept longer than necessary. Dark data by definition fails this test. DiscoverIQ illuminates dark data by scanning all data repositories and identifying personal data that is stored but not actively accessed or used, enabling informed decisions about retention or deletion.
Relevant Regulations
Frequently Asked Questions
What is Dark Data?
Dark data is information collected and stored by an organization but never analyzed, used, or leveraged, often containing personal data that creates unmanaged privacy risk.
Which regulations reference Dark Data?
Dark Data is referenced in or relevant to: gdpr, dpdpa.
Related Solutions
Know where personal data lives and how risky it is, and label it by policy.
How IQWorks Helps
Related Terms
Shadow IT
Shadow IT refers to technology systems, applications, and cloud services used within an organization without formal IT department approval or oversight.
Data Discovery
Data discovery is the automated process of identifying and cataloging personal data across an organization technology landscape, including databases, file systems, cloud storage, and SaaS applications.
Data Retention
Data retention refers to policies and practices governing how long personal data is stored before being deleted or anonymized, aligned with regulatory storage limitation requirements.
Data Minimization
Data minimization is a core data protection principle requiring organizations to collect and process only the personal data that is strictly necessary for the specified purpose, and no more.