The Influence of Employees' Integration of Generative Artificial Intelligence Tools on Organizational Data Exposure Risks Within the Context of Data Security Posture in Uganda

The rapid diffusion of generative artificial intelligence (GenAI) tools such as ChatGPT, Gemini, Copilot, and Claude into everyday work practices has created a new and poorly governed channel through which organizational data can leave the enterprise. This review synthesized theoretical, empirical, and practitioner literature on the relationship between employees' integration of GenAI tools and organizational data exposure risks, situating that relationship within the broader context of organizational data security posture. The review is organized around four themes, the extent, drivers, and patterns of employee GenAI integration in the workplace, the phenomenon of "Shadow AI" and "Bring Your Own AI" (BYOAI), the mechanisms through which GenAI use generates data exposure, leakage, and compliance risks, and the role of data security posture encompassing governance frameworks, visibility, policy, and employee security behavior in moderating those risks. Literature from developed economies dominates the field, while evidence from Uganda and the wider Sub-Saharan African context remains scarce. The review identifies key theoretical anchors (the Technology Acceptance Model, Protection Motivation Theory, and information security governance perspectives), synthesized documented incidents such as the Samsung ChatGPT data leak, and highlights empirical survey evidence showing widespread unsanctioned use of GenAI by employees. It concludes by delineating conceptual and empirical gaps particularly the absence of studies that jointly model GenAI integration, data exposure risk, and data security posture in developing country organizational settings and proposes a conceptual framework to guide future research in Ugandan organizations.