Are LoB apps for internal users required to comply with GDPR for work email addresses used in login?
<p>In Europe, developing Android and iOS Apps, server backend hosted in Azure, on behalf of a customer. The Apps are line-of-business for internal users only, accepting sign-up/login as the work email address of the user.
Does GDPR require that these apps fulfill GDPR requirements for use of the users' personal data (which in this case is exclusively the email address , potentially the user location)?</p>

<p>Extensive research on the topic does not seem to yield any definitive answers.</p>

<p>To be clear, does having a simple login form to a work-only app which requires only the work email address mean that the app must fulfill GDPR active consent to login, use the email, display ToC/Privacy etc?</p>

<blockquote>
  <p>Does GDPR require that these apps fulfill GDPR requirements for use of the users' personal data</p>
</blockquote>

<p>The simple answer is yes - e-mail addresses (even work ones) are still personally identifiable information (PII) and fall under GDPR.</p>

<blockquote>
  <p>does having a simple login form to a work-only app which requires only the work email address mean that the app must fulfill GDPR active consent to login, use the email, display ToC/Privacy etc?</p>
</blockquote>

<p>If this is a work-only app and logging in (or more specifically having an account associated with that e-mail address regardless of whether they actually login or not) then it might not require "active consent", active consent is only <em>one</em> of the potential legitimate bases for processing PII. If the app is necessary for the functioning of the business then it could fall under "legitimate interest".</p>

<p>To determine whether this may apply there's a three-part test, since the customer is going to be the one actually using the e-mail addresses here, it's really them that need to address these aspects:</p>

<p><strong>Identify a legitimate interest</strong></p>

<p>If the need to login and use the app in the course of doing the individual's job, then that's likely a legitimate interest. </p>

<p><strong>Show that the processing is necessary to achieve it</strong></p>

<p>Does carrying out the business purposes the app is used for require the person to be identified?</p>

<p><strong>Balance it against the individual’s interests, rights and freedoms</strong></p>

<p>This is about considering the potential impact on the individual by doing this, and it means asking yourself some questions. Would the individual <em>reasonably</em> expect you to use the PII in this way? Would using the information in this way cause them unwarranted harm? How sensitive is the information? What safeguards do you have int </p>

<h2>Yes</h2>

<p>The email address identifies an individual in the EU. Therefore, GDPR applies. Whether that requires "active consent to login, use the email, display ToC/Privacy etc" depends on the reason the data is being collected/stored. For example, consent is the <em>last</em> reason you should turn to for collecting personal data.</p>

gdpr