Want users to decide what organisations an acces their data

Question

Im working on a concept where users can allow certain organisations to see their data. I want to store the permission on a private ethereum blockchain. I thought smart contracts would be the way to go but I can't really wrap my head around it.

Would I need te create a contract for each user in which they say which organisations should get acces to their data?

Can users change which organisations have acces to their data if I use contracts, say for instance the user wants to change to another organisation?

Can I add more organisations to already existing contracts?

If contracts aren't the way to go here, could somebody give me a point in the right direction?

Image of the intended flow (simplified top more in depth bottom):

EDIT:

I made a start on a contract probably incorrect but lets see it as pseudo code:

pragma solidity >=0.5.0;

contract UserPermissions {
    string private notpermitted;
    

    mapping(address => mapping(bytes32 => mapping(address => bool))) permissions;

    constructor() public {
        notpermitted = "You do not have permission to view this users data";
    }

    function setPermissions(address they, bytes topic, bool allowed) external {
        permissions[msg.sender][topic][they] = allowed;
    }

    function getPermitted(address they, bytes topic){
        if (permissions[they][topic][msg.sender] = true) {
            //if permission is granted return this
            return permissions[they][topic][msg.sender]; 
        } else {
            return notpermitted;
        };
    }

    function getOwnPermitted(){
        //returns list of all permissions this acount has granted
    }
}

Answer 1

There is another problem to wrap your head around, but first to address the small questions directly.

Would I need te create a contract for each user in which they say which organisations should get acces to their data?

Probably not. A single contract could store a registry in which each user stores a suitable structure, e.g. a mapping of permissions and authorized users. Something like:

// user => permission => authorizedUsers => true/false
// bool isAllowed = permissions[me][topic][you];
mapping(address => mapping(bytes32 => mapping(address => bool))) permissions;

Can users change which organisations have acces to their data if I use contracts, say for instance the user wants to change to another organisation?

Yes. You need a function for them to do so. Given the hypothetical data structure above and assuming one can only manage their own permission space ...

function setPermission(address they, bytes topic, bool allowed) external {
  permissions[msg.sender][topic][they] = allowed;
}

Can I add more organisations to already existing contracts?

Sure. In the simple examples, all possible addresses are already assumed to exist so there is nothing left to add, but you can define the business rules (i.e. what does "add" mean in the context of you app) and codify the process.

If contracts aren't the way to go here, could somebody give me a point in the right direction?

Now the big issue.

You will find it nearly impossible to keep a secret on the blockchain because the blockchain is optimized for transparency. You can use it to keep a record of who should have access to the secrets and you can use it to authenticate the information (this is a true copy of the secret) but it is not a good place to store the secret itself.

Hope it helps.