Before you add or import participants to a learning journey, Knowly may remind you that your organisation needs a legal basis to process their personal data. This article explains what that means, what you should check before adding participant data, and where to go if you are unsure.
Not legal advice. This article is general information, not legal advice. Your organisation is responsible for deciding the right legal basis for its own use of Knowly. If you are unsure, involve the person responsible for privacy or legal questions in your organisation.
What legal basis means
Under GDPR, an organisation needs a legal basis before it processes personal data. In Knowly, that can include names, email addresses, mobile phone numbers, learning journey participation, progress, answers, messages, manager relationships, and other participant data your organisation adds or syncs into Knowly.
Knowly provides the service and acts as a data processor for most personal data in a learning journey. Your organisation decides why the data is processed, which participants should be included, and which legal basis applies.
Common legal bases for participant data
The right legal basis depends on your organisation, the learning journey, and the relationship with the participants. Two common examples are legitimate interest and consent.
Legitimate interest. This may be relevant when your organisation has a clear reason to invite participants to a learning journey, and that reason is balanced against the participants' rights and expectations. For example, a work-related learning journey may sometimes fit here, but your organisation still needs to make that assessment.
Consent. This may be relevant when participation is genuinely optional and each participant can choose whether to take part. Consent has its own requirements, including that participants understand what they are saying yes to and can say no without pressure.
Do not assume that one legal basis always applies. The same Knowly feature can be used in different ways, and the right answer can change depending on the purpose, audience, and local rules.
What to check before adding participants
Before you add participants manually or import a list, make sure your organisation has decided:
why the participants should be included
which personal data you need to add
how participants will be informed about the learning journey and the data processing
whether participation is required or optional
who handles privacy requests such as access, correction, or deletion
If your organisation uses directory sync or dynamic lists, the same principle applies. The source data may come from your identity provider, but your organisation still needs a legal basis for using that data in Knowly.
Where to read more
For a broader overview of personal data in Knowly, see the article on personal data in Knowly and GDPR. Knowly's own processing as a data controller is described in Knowly's privacy policy.
Lastly, if the legal basis is unclear, pause before adding or importing the participants and ask the privacy or legal owner in your organisation.