In the qualitative path, in which order do the checks after the scope decision run, and why does the data-protection check come before looking for a data source?
Extend the data model, then check the data-protection basis (create it if missing), then check whether a data source exists (build one if not), then agreement and connection; there is no point finding or building a source for data that may not legally be processed.
The order is:
- Scope worthwhile? (no: solution outside IAM)
- Extend the business data model: define what exactly is to be processed.
- Data-protection basis OK? If missing: establish the data-protection basis (DaSchu-Grundlage herstellen), then continue.
- Data source available? If missing: build a new data source.
- Find the person responsible for the source, conclude the data delivery agreement.
- Set up the technical connection.
Each step needs the result of the one before. The legal question can only be asked once the data model says precisely which data is meant (the "data minimisation" conversation happens here). And the source question should only be asked once processing is known to be allowed: otherwise you might negotiate with a source owner, or even launch a project to build a new source, for data that the IAM is then not permitted to hold. Cheap "no" answers come first, expensive work comes last.
Go deeper:
Art. 6 GDPR: Lawfulness of processing — the list of legal bases at least one of which every processing of personal data needs under EU law.