Why is running the IAM as a processor (Auftragsverarbeiter) unsuitable for larger, cross-cutting IAM scenarios?
A processor may only act on the controller's documented instructions, so the IAM has no decision-making room of its own; a central IAM that combines data from many owners and decides how to use it for many applications does more than a processor may.
Under data protection law a processor handles personal data on behalf of a controller and only according to its instructions. The controller decides purpose and means; the processor executes. That fits a payroll bureau or a cloud host well.
A central IAM in a large organisation does something different:
- it combines data from many sources (HR of several companies, partner directories) into one identity per person,
- it decides derived things: which accounts to create, which roles follow from which attributes, which data goes to which application,
- it serves many consumers, each with its own purpose.
Who would be the single controller issuing instructions for all of that? Each data source owner can only instruct about its own data. Modelled strictly as a processor, the IAM would need separate instructions per source and could not, for example, correlate a person across two sources without permission from both. Hence the verdict: workable for simple scenarios, unsuitable for large cross-cutting ones, because the IAM is left with no room to act of its own.
Go deeper:
Art. 28 GDPR: Processor — the contract and the "documented instructions" duty that bind a processor.- Swiss FADP, Art. 9: Processing by processors — the Swiss equivalent: a processor may process data only as the controller itself may.