Does GDPR require that these apps fulfill GDPR requirements for use of the users' personal data
The simple answer is yes - e-mail addresses (even work ones) are still personally identifiable information (PII) and fall under GDPR.
does having a simple login form to a work-only app which requires only the work email address mean that the app must fulfill GDPR active consent to login, use the email, display ToC/Privacy etc?
If this is a work-only app and logging in (or more specifically having an account associated with that e-mail address regardless of whether they actually login or not) then it might not require "active consent", active consent is only one of the potential legitimate bases for processing PII. If the app is necessary for the functioning of the business then it could fall under "legitimate interest".
To determine whether this may apply there's a three-part test, since the customer is going to be the one actually using the e-mail addresses here, it's really them that need to address these aspects:
Identify a legitimate interest
If the need to login and use the app in the course of doing the individual's job, then that's likely a legitimate interest.
Show that the processing is necessary to achieve it
Does carrying out the business purposes the app is used for require the person to be identified?
Balance it against the individual’s interests, rights and freedoms
This is about considering the potential impact on the individual by doing this, and it means asking yourself some questions. Would the individual reasonably expect you to use the PII in this way? Would using the information in this way cause them unwarranted harm? How sensitive is the information? What safeguards do you have int
