When personal data flows from a data source into the IAM, at which three points must the legal basis for processing be checked?
At the source (may the data be processed there, and does that basis cover passing it on?), on the transfer (may it be transmitted to the IAM?), and in the IAM (may the IAM process it for its purpose?).
* Three checkpoints for the processing basis, and a fourth question when the flow crosses a company boundary. *
Personal data does not carry a general permission. It is processed on a basis (Grundlage) such as a contract, the person's consent, a legal obligation or a legitimate interest, and that basis is tied to a purpose. Moving the data to a new system with a new purpose is a new processing step, so all points along the way need checking:
- At the source: is the processing at the data source itself lawful? An HR system processes employee data on the basis of the employment contract. Does that basis also cover handing the data on?
- The transfer: is it lawful to transmit this data to the IAM (and, as part of that, is the transport secured)?
- In the IAM: is it lawful for the IAM to store and use the data for its own purpose, for example creating accounts and granting access?
Only if the answer is yes at all three points is the flow legally sound. If it fails anywhere, the process step "establish the data-protection basis" has to fix it, for example by extending a contract, obtaining consent or making a formal arrangement between the parties.
Go deeper:
Art. 5 GDPR: Principles of processing — purpose limitation and data minimisation, the principles that make each new use of data a fresh question.- ICO: Principle (b), purpose limitation — when using data for a new purpose needs a new justification.