1802: Define sensitive fields in custom business objects and enable read access logging

In this blog, I explain how you can use Cloud Applications Studio to mark fields that will capture sensitive data about natural persons. Whenever these fields are viewed by an end user, a Read Access Log entry is created. You can enable read access logging for these fields using different types of channels/medium of access like UI screens, ABSL message, Web service operation etc.

I have used a simple use case of a travel solution in which certain details about the customer and travelers is captured. I have created an extension business object (XBO) for Customer as well as created a custom business object to capture the traveler details.

Introduction to the Travel Solution

In this video, I explain a simple travel solution that capture the details of a customer and co-travelers. With this solution, you can capture travel document details like passport, visa and certain other sensitive data like nationality.

Enable sensitive personal fields

The below video explains how you can mark fields as sensitive data fields. Make sure, you have the following prerequisites in place before you enable sensitive fields:

• You have enabled read access logging in business scoping question in business configuration under Built-in Services and Support à System Management à Security
• You can define fields as sensitive only if the business object root node or the sub-node is change history relevant

Limitation Note:

• You can define sensitive fields only in the extension business object (XBO) and custom business object. Extension node is not supported.
• There can be a maximum of 5 personal sensitive fields per solution – addition 5 more fields can be defined using key user extension

Enable read access logging for user screen

You can follow the steps in the below video to learn how to enable read access logging for Thing Inspector screen of a custom business object. These steps are not required if you are using fields defined in an extension business object.

Guideline: Currently sensitive fields are allowed for use in data list and search help. So, advice is not use the fields in these lists during implementation, since it will create a log entry for each record in the data list or search help. This will have an impact on the performance while loading the list values.

Create read access log for ABSL script

You can create direct access log whenever the sensitive data fields are accessed using ABSL script. You can create the log using the newly release context functions. You need to create direct access log in following scenarios:

1. Raise messages with sensitive personal data shown in the content
2. Write sensitive personal data to ABSL trace
3. Call web service and pass sensitive field values to the service

Enable read access log for queries on custom objects and use in web service operation

You can follow the steps in the below video to enable read access log for sensitive fields used in queries of custom business objects. The read access log is created with channel that is used for executing the query.

For example, you can use a web service – read or query option to query the data from a custom business object. In such a case, the read access log will be created using the web service read channel.

Disclaimer

The information provided in this blog should not be considered as legal advice or replace legal counsel for your specific needs. Readers are cautioned not to place undue reliance on these statements and they should not be relied upon in making purchasing decisions or for achieving compliancy to legal regulations.