Why does the legal check get harder when a data source and the IAM belong to different companies of the same group?
Data protection law treats each legal entity of a group as a separate party; there is no general group privilege, so moving data from company A's source to an IAM run by company B is a transfer to another controller that needs its own basis.
Large organisations are rarely one company. A group (Konzern) consists of many legal entities: a holding, national subsidiaries, service companies. Often one of them runs the IAM for all the others. To a manager it feels like "our data moving inside our group". To data protection law, company A's HR data going to company B's IAM is data leaving one controller and arriving at another.
Consequences:
- Company A needs a basis for disclosing the data, and company B needs one for receiving and processing it.
- The employees' contracts are with company A; they do not automatically cover processing by company B.
- A legitimate interest can help: the GDPR recognises that companies in a group may have a legitimate interest in transmitting personal data within the group for internal administrative purposes, including employee data. But that is a balancing test, not a free pass, and it has to be documented.
That is why the processing-basis check explicitly asks: "Is this still OK when company boundaries are crossed?", relevant mainly for larger companies and groups.
Go deeper:
GDPR Recital 48: Legitimate interest within a group of undertakings — the intra-group transfer clause, and its limits.- Art. 88 GDPR: Processing in the context of employment — national rules for employee data, explicitly including transfers within a group.