Data Purge and Anonymization: SAP SuccessFactors Recruiting

[KimLessley]

Overview

In today’s increasingly regulated world, companies are faced with the challenge of balancing legal and business requirements to keep data against requirements to purge data when it’s no longer needed for a business purpose. This requirement is getting even more attention now with the upcoming General Data Protection Regulation (GDPR). The SAP SuccessFactors Recruiting solution offers a number of features that help with this challenge:

1. External candidates can delete their own profile at any time, by clicking "Delete" in the candidate site. Their applications are still visible to operators, but the profile itself is purged. The candidate cannot log in and will not appear in any candidate searches anymore.


2. You can create a regular schedule to purge external candidate profiles after a specified period with no logins. For example, the administrator can configure candidates from France to be purged from the system after 365 days without a login.


3. You can create a regular schedule to anonymize applications (whereby all information linking the application to a particular person is removed) after a specified period from the application date. For example, the administrator can configure applications to jobs in Germany to be anonymized after three years. The records will still exist for reporting purposes, but the identity of the applicant can no longer be determined after that time.

Below is a guide on how to purge candidate and application data from SAP SuccessFactors Recruiting Management.

Prerequisites

The following features must be enabled:

1. DPCS 2.0 (Data Privacy Consent Statements);


2. Provisioning -> DRM 2.0 Candidate Purge (optional);


3. Provisioning -> DRM 2.0 Application Purge (optional);


4. Provisioning -> Data Retention Management;


5. Configure specific fields for anonymization (anonymization=”true”) in the Candidate Profile, Application and Offer Detail Templates if you plan to use anonymization.

Permissions

The following permissions need to be assigned to the appropriate users in Admin Center -> Manage Permission Roles -> Manage User Data:

• Create Data Purge Request


• Approve Data Purge Request

Decide on which elements to purge or anonymize

You need to decide what happens to attachments and correspondence linked to the candidate profile and application before defining purge rules. This is done in Admin Center-> Manage Recruiting -> Manage Recruiting Settings -> Deletion of Attachments & Deletion of Correspondence:

Attachment purge options:

• Delete any document attached to the candidate's profile


• Delete any document attached to the application


• Delete any document attached to the offer letter


• Delete any document attached to the offer approval


• Delete any document attached to the correspondence email

Correspondence purge options:

• Delete all email and print correspondence available for candidate


• Delete all offer letters available for candidate


• Anonymize all the request/response info of background check available for candidate


• Anonymize all the request/response info of onboarding available for candidate

Define purge rules

You can define rules, by country, on when inactive candidates and inactive applications should be purged in Admin Center-> Company Settings -> Data Management. There you define whether the rule you are creating is for purging inactive candidates or inactive applications, give the rule an appropriate name and then define the appropriate country or countries and time periods for each country. You then define one or more approvers for the purge rule.

Purge Object	Country Used for Calculation	Date Used for Calculation
Inactive candidate profile	Candidate’s country of residence on the candidate profile	Date the candidate last logged into their candidate profile
Inactive applications	Job requisition country	Date the application was last modified or dispositioned

Below you can see a screenshot showing the Create New Purge Rule screen.



In the above example, all external candidates with the country of residence Germany who have not logged into the career portal for 365 days will be purged as well as all external candidates with the country of residence United States who have not logged into the career portal for 730 days.

Once you create the rule, you can Save, Schedule or Launch Now…

• Save the purge rule – the rule is saved for later, but is not launched


• Schedule the purge rule – you define the cadence of when the rule should be run. See screenshot below:

• Launch Now – will run the purge rule once

Approve purge rules

Once the job is either Scheduled or Launched manually, a user with the “Approve Data Purge Request” permission will have to approve the job to run. Once approved, another scheduled job will be automatically triggered to physically purge the data.

Keep in mind that each purge rule only has to be approved by the approver(s) once, and then will reoccur automatically according to the recurring pattern set up in the "Schedule Purge Rule."

More information

Customers can also refer to the following Knowledge Base Articles to learn more:

• When is application considered "inactive": 2325887


• Is it possible to anonymize internal candidate profile: 2166373


• Setting up Recruiting Data Privacy Consent Statement (DPCS) 2.0: 2341240


• Setting up Data Retention Management: 2088065

You can learn more about how SAP SuccessFactors can help you prepare for the General Data Protection Regulation here.