Can I use an Employee's Personal ID in an company internal project? (EU Data protection Law)

Question

I want to create an Order-Website for our company, where employees can order dishes from the canteen, so they know roughly how much food to order.

Now the question came up, if you order some dish, but later want to cancel it, how would you do it. The idea was that employees enter their personal ID when ordering food, so they can change the order later, but now we don't know if that's legal, due to European Data protection.

Only some Admins in IT have access to the database, that connects the personal ID to the respective employee, so it is not possible for normal employees to trace back a Personal ID. For them, it's just a number.

Can we use the ID for our project, or do we have to do something else, like encrypting the ID, so this information also is not accessible to others

Answer 1

GDPR does allow the processing of personal data, provided there is a permission of the data subject and/or a justification by law. Personal data needs appropriate safeguards and deletion policies.

You might want to get specific legal advice for the country you're in. I'd ponder briefly if dietary preference constitutes either medical or religious affilation data, but probably not. So if employees are free to use the system (or not) and get informed about the data processing, there should be no problem.