EU-hosted identity provisioning and GDPR

What a provisioning platform processes

To create the right account on the right day, a provisioning platform needs the employee's name, employee ID, job title, department, location, manager, start date and end date. To keep accounts aligned, it reads changes to the same fields every day. That makes the platform a processor of personal data about your whole workforce, under Article 28 of the GDPR.

What GDPR asks of that flow

For a processor that handles employee data, the questions a DPO asks are predictable:

• Where is the data stored and processed, and by which sub-processors?
• Is there a data processing agreement that names them?
• If data leaves the EU, which transfer mechanism covers it?
• Is the data minimised to what provisioning needs?
• How are breaches reported, and how do you get your data out at the end?

Why EU hosting keeps it short

When the platform and every sub-processor sit inside the EU, the transfer question has a one-line answer and the DPA stays simple. For organisations under NIS2 as well, a provisioning platform that processes identity data inside the EU is one less supply-chain risk to explain.

How Joinly handles it

Joinly hosts all data and resources in Amsterdam. Every sub-processor is based in the EU and listed in the DPA. Joinly reads only the HR fields provisioning needs, records every change in an audit log, reports a breach without undue delay and within 24 hours of becoming aware of it, and lets you export your data to Excel or through the REST API at any time. The platform is ISO 27001-certified and audited every year.