With 1911 release of SAP Business ByDesign Cloud ERP we introduce a new dimension to manage data privacy with the new information lifecycle management work center.
So with 1911 we recommend to use only the new information lifecycle management work center and it's configuration and to retire the old data protection and privacy work center.
To move to the new information lifecycle based data privacy management you need to do the following:
Here you can find more details regarding configuration.
Please be aware that the information provided in this blog is describes the old functionality to have a reference. The new functionality can be found in this blog.
Here is quick overview on what ByDesign has offered until 1908 to support data privacy. Please do not use it in parallel with the new information lifecycle management work center introduced in 1911:
The demo video below gives you an impression on how this works in detail:
As you have seen in the demo the data privacy expert can use the data privacy work center to easily find employees, service agents (i.e. external employees) or private accounts (1) and block data for usage or trigger the deletion (3). Additionally he can generate a synopsis for master and transaction data which is stored for a natural person in the system (2) as you can see in the screenshots below.
Data disclosure and deletion of personal data coming from custom add-ons is also supported by using the cloud application development studio (PDI). Since 1711 customers and partners are enabled to identify all the personal data stored in add-on BO’s using ABSL coding and to include it for disclosure, anonymization or deletion. Here you find a good tutorial on how this works.
Furthermore you can define in the business configuration the data retention periods for multiple business areas and countries which control that data cannot be deleted within the minimal retention period.
Besides disclosing and deleting natural persons data it is also possible to manually or automatically block it for usage in new business processes:
The screenshots above show you how reports will look like if they contain blocked persons:
With our 1902 release we have added capabilities to automatically block business partners for normal business users. So besides the well known capabilities it is now also possible to automatically block data for usage by using a scheduled run.
In the blocking run you can define the recurrence (e.g. daily) and an offset for how long a business partner needs to be in “obsolete” status before getting blocked by the run (e.g. 30 days).
Additionally data privacy experts are able to disallow the deletion of natural persons data e.g. due to a legal hold or other reasons.
Data privacy experts can configure which predefined business partner attributes are to be treated as special category of data and activate read access logging for sensitive data of natural persons.
Administrators, sales and marketing employees can according to their authorization access change logs:
Sales and marketing employees can mark contacts and private accounts to be excluded, included or checked before executing outbound marketing campaigns:
Finally ByDesign does not only control what happens inside the system but also how data is being consumed in external applications with the standard web-services and interfaces.
Here you get general overview material on GDPR, the SAP GDPR policies and especially the SAP data center data privacy measures and it's certifications which are continuously being audited:
The information provided in this blog should not be considered as legal advice or replace legal counsel for your specific needs. Readers are cautioned not to place undue reliance on these statements and they should not be relied upon in making purchasing decisions or for achieving compliancy to legal regulations.
So with 1911 we recommend to use only the new information lifecycle management work center and it's configuration and to retire the old data protection and privacy work center.
To move to the new information lifecycle based data privacy management you need to do the following:
- Business Configuration: Activate scoping element “Information Lifecycle Management”
- Business Configuration: Double check that you have activated the scoping question “Read Access Logging” under Security/System Management (this is unchanged but has been moved to the ILM work center)
- Business Configuration: Configure the new retention periods for business documents
- Assign information lifecycle management work center to the administrator or data privacy officer
- Double check that you have activated the read access log field groups (this is unchanged but has been moved to the ILM work center)
- Activate the document lifecycle KPIs for the data privacy officer or other users
Here you can find more details regarding configuration.
Please be aware that the information provided in this blog is describes the old functionality to have a reference. The new functionality can be found in this blog.
Here is quick overview on what ByDesign has offered until 1908 to support data privacy. Please do not use it in parallel with the new information lifecycle management work center introduced in 1911:
- Data Protection & Privacy Work Center for Data Privacy Officers: Allows to disclose and delete personal data across business scenarios including custom add-ons by partners (PDI). Support for all natural persons like private accounts, contacts, internal and external employees and for leads without reference to account master data.
- Data Retention Periods: Configure minimal retention periods for key business documents in order to control deletion.
- Block usage of data: Manually or automatically block usage of data for new business processes.
- Logging: Change logs and read access logs for special categories of personal data like religion, bank etc.
- Marketing permissions: Manage the natural persons consent for marketing communication.
- Authorization: Grant and revoke access to data only to users which need the data.
- More information: Most important links on GDPR, Business ByDesign, SAP and it's data centers, certifications, security measures and privacy by design.
The demo video below gives you an impression on how this works in detail:
1. Central Data Protection & Privacy Work Center
As you have seen in the demo the data privacy expert can use the data privacy work center to easily find employees, service agents (i.e. external employees) or private accounts (1) and block data for usage or trigger the deletion (3). Additionally he can generate a synopsis for master and transaction data which is stored for a natural person in the system (2) as you can see in the screenshots below.
Data disclosure and deletion of personal data coming from custom add-ons is also supported by using the cloud application development studio (PDI). Since 1711 customers and partners are enabled to identify all the personal data stored in add-on BO’s using ABSL coding and to include it for disclosure, anonymization or deletion. Here you find a good tutorial on how this works.
2. Configuration of data retention periods
Furthermore you can define in the business configuration the data retention periods for multiple business areas and countries which control that data cannot be deleted within the minimal retention period.
3. Block usage of data for new business
Besides disclosing and deleting natural persons data it is also possible to manually or automatically block it for usage in new business processes:
- Blocked persons will not appear in master data work centers, value helps & webservices and cannot be used for new business processes anymore.
- Only the data privacy team will be able to see all master data and also be able to unblock.
- Existing business documents will remain visible and will still be possible to process.
- PDI add-ons which use standard business partner queries need to add parameter “ExludeBusinessPurposeCompleted” to hide blocked persons
The screenshots above show you how reports will look like if they contain blocked persons:
- Blocked persons data will not appear in reports and data sources
- Reports it will not allow to filter for blocked persons
- Existing business documents will remain visible without persons data and key figures remain stable
- Navigation to the natural person will not be possible anymore
- Blocked data will not be transmitted to via interfaces to BW (so you might think about doing assuming a full upload from time to time).
With our 1902 release we have added capabilities to automatically block business partners for normal business users. So besides the well known capabilities it is now also possible to automatically block data for usage by using a scheduled run.
In the blocking run you can define the recurrence (e.g. daily) and an offset for how long a business partner needs to be in “obsolete” status before getting blocked by the run (e.g. 30 days).
Additionally data privacy experts are able to disallow the deletion of natural persons data e.g. due to a legal hold or other reasons.
4. Read access logging of sensitive data and change logs
Data privacy experts can configure which predefined business partner attributes are to be treated as special category of data and activate read access logging for sensitive data of natural persons.
- Activate or deactivate predefined field groups for read access logging including change log.
- Extension fields can be marked as special category either by key user or PDI. Field group configuration can be extended by PDI.
- PDI allows to mark partner created BO fields as special.
- Download daily read access logs by webservice or UI within 14 days. Log is provided as XML files to be archived with external applications.
- Here you can find more details on read access logging and how to automatically download logs by webs...
Administrators, sales and marketing employees can according to their authorization access change logs:
- See changes per date and user
- See changed attribute with old / new value and modification type
- Export changes
5. Marketing permissions
Sales and marketing employees can mark contacts and private accounts to be excluded, included or checked before executing outbound marketing campaigns:
- Mark contacts to be included, excluded from marketing campaigns per channel including ability to retrieve and change consent by webservice.
- Channel independent marketing permissions which can be used to indicate that overall recheck might be needed.
- Ability to add more marketing channel by configuration e.g. social media, e-mail-newsletter…
- Ability to extend channels by PDI
6. User Authorization also for external applications
Finally ByDesign does not only control what happens inside the system but also how data is being consumed in external applications with the standard web-services and interfaces.
- Communication scenarios and arrangements allow to control external access (via the Application and User Management work center).
- Valid certificates are required to allow access ByDesign Web services.
- Communication Monitoring for e.g. failed web service calls. Customers still need to assess which integration scenarios are exposed to whom.
7. More information on GDPR and links to documentation
Here you get general overview material on GDPR, the SAP GDPR policies and especially the SAP data center data privacy measures and it's certifications which are continuously being audited:
- General information on GDPR and SAP
- SAP overview on GDPR
- GDPR regulation with links to all details in multiple languages
- GDPR – What are the biggest problems companies have to solve?
- Four steps to get started with GDPR
- GDPR: Company stakeholders and obligations
- SAP Data Protection & Privacy overview
- SAP Data Processing Agreement in all languages
- SAP security and privacy by design
- SAP Global Data Protection and Privacy Policy
- SAP Compliance & Certificates
- SAP receives data privacy certification BS 10012:2017 from BSI
- Which other tools does SAP offer for managing data privacy (e.g. GRC, ILM)?
- BSI M2.509 English: How to conduct data privacy compliant testing?
- BSI M2.509 German: How to conduct data privacy compliant testing?
- Documentation & enablement for SAP Business ByDesign:
- Factsheet on ByDesign and GDPR
- What's new for GDPR in 1902
- What's new for GDPR in 1805?
- What's new for GDPR in 1802 (incl. sample code for read access log webservice)?
- ByDesign Enablement slides on GDPR (login for SAP PartnerEdge required)
- Webinar: Lessons learned from Data privacy implementations via PDI (PartnerEdge login required).
- Documentation: Data Privacy Management in Business ByDesign
- Documentation: Quick Guide for data disclosure of personal data
- Documentation: Quick Guide for data removal of personal data
- Blog: How to request a restore point before data deletion and roll back?
- Documentation: Read access logging for sensitive data
- Documentation: Information Lifecycle Management
- Data Privacy & protection in SAP Cloud Application Studio (PDI)
- Data disclosure & deletion for customer business objects in SAP Cloud Application Studio (PDI)
- Read access logging with SAP Cloud Application Studio (PDI)
- What's new in SAP Cloud Application Studio (PDI) 1711 for data privacy?
- Consulting package for GDPR and ByDesign
- Examples for potential legal bearings
- GDPR Awareness Coalition: Fines and investigations due to data privacy issues
- Google hit with £44m GDPR fine over ads
- GDPR: 5000€ fine for missing data processing agreement
- Structural GDPR noncompliance of streaming providers
- First costly warning letters are being sent by lawyers in Germany
- Fines for sending unwanted emails
- How to mitigate the risk to receive costly warnings from lawyers due to GDPR in Germany
Disclaimer
The information provided in this blog should not be considered as legal advice or replace legal counsel for your specific needs. Readers are cautioned not to place undue reliance on these statements and they should not be relied upon in making purchasing decisions or for achieving compliancy to legal regulations.
- SAP Managed Tags:
