We have a cloud-based B2B solution that is meant to help them collate and manage their operational data. One of clients wants to ensure that their employees can only access their data from devices within their own premises. To allow this we are considering collecting IP information alongside their regular login details and only allow access to the IP addresses from a pre-defined range provided by the client. However, some people in the team raised concerns regarding the legality of using IP addresses this way in countries such as Germany.
However, As per what I read online though the limitation is basically on collecting IP data to create individual user profiles and our approach should be fine as it is IP information provided by their employer to access an organisational database. Can someone please confirm if this is the right understanding or if there might be legal limitations?