Are there any legal limitations to using IP based authorisation so that only users from client premises can have access to cloud?

Question

We have a cloud-based B2B solution that is meant to help them collate and manage their operational data. One of clients wants to ensure that their employees can only access their data from devices within their own premises. To allow this we are considering collecting IP information alongside their regular login details and only allow access to the IP addresses from a pre-defined range provided by the client. However, some people in the team raised concerns regarding the legality of using IP addresses this way in countries such as Germany.

However, As per what I read online though the limitation is basically on collecting IP data to create individual user profiles and our approach should be fine as it is IP information provided by their employer to access an organisational database. Can someone please confirm if this is the right understanding or if there might be legal limitations?

Answer 1

The problem restated:- Control Access to a cloud based B2B application for an enterprise such that users of the enterprise can only access the B2B application from the enterprise network.

Possible solution:- Create an access control list on the Cloud application to permit only the source network of the Enterprise to access the application. The users can then be fine grained controlled using Username/Password or 2FA.