GDPR and SAP
Data Privacy with SAP Business Suite and SAP S/4HANA
1st Edition
Published on 28. July 2018
Book
Hardback
430 pages
978-1-4932-1712-0 (ISBN)
Description
Can your data privacy protocols prevent data breaches? With this guide, you'll develop and implement a privacy policy that protects your data and complies with GDPR. Learn to block and delete data, implement purpose-based processing, and determine who can access what information in your SAP system. Use the Information Retrieval Framework, SAP MDG, SAP Read Accessing Logging, and other tools to support your data privacy efforts. Get compliant before it's too late!
Highlights include:
Personal data
SAP Information Lifecycle Management (SAP ILM)
Data Controller Rule Framework
Information Retrieval Framework
SAP Read Access Logging
SAP Master Data Governance (SAP MDG)
SAP Test Data Migration Server
Authorizations
Purpose-based processing
Auditing
Project planning
More details
Persons
Author
Volker Lehnert has worked at SAP for eight years. He has worked for SAP (Switzerland) AG since 2008, where he is a consultant on all topics concerning the authorization system, and continuously returns the authorization system to its core questions: business functions, organizational concepts, and legal requirements. Within this scope, his consulting work focuses on authorization concepts, SAP BusinessObjects Access Control, and the processes of User Life Cycle Management. Furthermore, Volker Lehnert is co-author of the data privacy guideline of the German-speaking SAP User Group (DSAG).
Content
... Foreword ... 15
... Preface ... 17
... Objective of the Book ... 17
... Composition of the Book ... 18
... Acknowledgments ... 23
1 ... Introduction to General Data Protection Regulation ... 25
1.1 ... What Does the GDPR Mean for you? ... 25
1.2 ... Which Requirements Require Technical Support? ... 53
1.3 ... Which Requirements Can Be Technically Supported? ... 72
1.4 ... Summary ... 79
2 ... Personal Data in SAP Business Suite and SAP S/4HANA ... 81
2.1 ... SAP Business Suite and SAP S/4HANA Data ... 81
2.2 ... Personal Data in SAP ERP ... 84
2.3 ... Personal Data in SAP ERP HCM ... 99
2.4 ... Personal Data in SAP CRM ... 103
2.5 ... SAP Business Suite Technical Integration Example ... 108
2.6 ... Summary ... 109
3 ... Implementation Approach ... 111
3.1 ... Project Implementation Steps ... 111
3.2 ... Record of Processing Activities Approaches ... 130
3.3 ... Summary ... 132
4 ... Blocking and Deletion with SAP Information Lifecycle Management ... 133
4.1 ... Introduction to SAP ILM ... 133
4.2 ... Preparatory Steps ... 143
4.3 ... Blocking from a Business Perspective ... 168
4.4 ... Deletion from a Business Perspective ... 185
4.5 ... Legal Case Management ... 191
4.6 ... Time-Based Blocking of Personal Data in Personnel Management ... 193
4.7 ... Summary ... 195
5 ... Purpose-Based Processing ... 197
5.1 ... Controller and Purpose ... 197
5.2 ... Organizational Structures (Line Organization) ... 200
5.3 ... Process Organizational Structures ... 206
5.4 ... How Organizational Structures Define Purpose ... 214
5.5 ... Summary ... 215
6 ... Data Controller Rule Framework ... 217
6.1 ... Data Controller Rule Framework ... 221
6.2 ... Summary ... 237
7 ... Authorization Concept ... 239
7.1 ... Users and Authorizations: An Introduction ... 239
7.2 ... Rethinking Organizational Levels ... 244
7.3 ... Defining Process Attributes ... 247
7.4 ... Authorization Risks ... 250
7.5 ... Summary ... 254
8 ... Information Retrieval Framework ... 255
8.1 ... Transparency: Access to Data and Information ... 256
8.2 ... Setup of the Information Retrieval Framework ... 257
8.3 ... SAP ILM Objects in the Information Retrieval Framework ... 260
8.4 ... Creating an Information Retrieval Framework Data Model ... 264
8.5 ... Handling a Data Subject Request ... 279
8.6 ... Central Instance ... 282
8.7 ... Further Technical Information ... 283
8.8 ... Summary ... 284
9 ... Read Access Logging ... 285
9.1 ... Scope of Read Access Logging ... 285
9.2 ... Setup and Maintenance ... 287
9.3 ... Logging Purpose and Domains ... 290
9.4 ... Recordings for User Interface Channels ... 292
9.5 ... Configuration ... 297
9.6 ... Evaluation of Logs ... 301
9.7 ... Configurations for Remote API Channels ... 305
9.8 ... Conditions ... 307
9.9 ... Transport, Import, and Export ... 312
9.10 ... Summary ... 312
10 ... SAP Master Data Governance ... 315
10.1 ... Master Data Maintenance Scenarios ... 316
10.2 ... Maintaining Sensitive Data ... 322
10.3 ... Organizational Separation ... 324
10.4 ... Data Quality Assurance Using Services ... 326
10.5 ... Summary ... 329
11 ... SAP Test Data Migration Server ... 331
11.1 ... Use Cases ... 332
11.2 ... Structure and Functionality ... 335
11.3 ... Integration of the System Landscape in SAP TDMS ... 346
11.4 ... Data Protection with SAP TDMS ... 347
11.5 ... Summary ... 351
12 ... Accountability: Protection, Audits, Controls, and Documentation ... 353
12.1 ... Control Frame and Principles of Processing ... 354
12.2 ... Lawfulness, Fairness, and Transparency ... 355
12.3 ... Purpose Limitation ... 357
12.4 ... Data Minimization ... 360
12.5 ... Accuracy ... 364
12.6 ... Storage Limitation ... 366
12.7 ... Integrity and Confidentiality ... 369
12.8 ... Accountability ... 377
12.9 ... Abstract Technical Controls ... 378
12.10 ... Technical Control Actions: Examples ... 381
12.11 ... Summary ... 413
... Appendicess ... 415
A ... Relevant Transactions, Reports, and SAP Notes ... 415
B ... The Authors ... 419
... Index ... 423
... Preface ... 17
... Objective of the Book ... 17
... Composition of the Book ... 18
... Acknowledgments ... 23
1 ... Introduction to General Data Protection Regulation ... 25
1.1 ... What Does the GDPR Mean for you? ... 25
1.2 ... Which Requirements Require Technical Support? ... 53
1.3 ... Which Requirements Can Be Technically Supported? ... 72
1.4 ... Summary ... 79
2 ... Personal Data in SAP Business Suite and SAP S/4HANA ... 81
2.1 ... SAP Business Suite and SAP S/4HANA Data ... 81
2.2 ... Personal Data in SAP ERP ... 84
2.3 ... Personal Data in SAP ERP HCM ... 99
2.4 ... Personal Data in SAP CRM ... 103
2.5 ... SAP Business Suite Technical Integration Example ... 108
2.6 ... Summary ... 109
3 ... Implementation Approach ... 111
3.1 ... Project Implementation Steps ... 111
3.2 ... Record of Processing Activities Approaches ... 130
3.3 ... Summary ... 132
4 ... Blocking and Deletion with SAP Information Lifecycle Management ... 133
4.1 ... Introduction to SAP ILM ... 133
4.2 ... Preparatory Steps ... 143
4.3 ... Blocking from a Business Perspective ... 168
4.4 ... Deletion from a Business Perspective ... 185
4.5 ... Legal Case Management ... 191
4.6 ... Time-Based Blocking of Personal Data in Personnel Management ... 193
4.7 ... Summary ... 195
5 ... Purpose-Based Processing ... 197
5.1 ... Controller and Purpose ... 197
5.2 ... Organizational Structures (Line Organization) ... 200
5.3 ... Process Organizational Structures ... 206
5.4 ... How Organizational Structures Define Purpose ... 214
5.5 ... Summary ... 215
6 ... Data Controller Rule Framework ... 217
6.1 ... Data Controller Rule Framework ... 221
6.2 ... Summary ... 237
7 ... Authorization Concept ... 239
7.1 ... Users and Authorizations: An Introduction ... 239
7.2 ... Rethinking Organizational Levels ... 244
7.3 ... Defining Process Attributes ... 247
7.4 ... Authorization Risks ... 250
7.5 ... Summary ... 254
8 ... Information Retrieval Framework ... 255
8.1 ... Transparency: Access to Data and Information ... 256
8.2 ... Setup of the Information Retrieval Framework ... 257
8.3 ... SAP ILM Objects in the Information Retrieval Framework ... 260
8.4 ... Creating an Information Retrieval Framework Data Model ... 264
8.5 ... Handling a Data Subject Request ... 279
8.6 ... Central Instance ... 282
8.7 ... Further Technical Information ... 283
8.8 ... Summary ... 284
9 ... Read Access Logging ... 285
9.1 ... Scope of Read Access Logging ... 285
9.2 ... Setup and Maintenance ... 287
9.3 ... Logging Purpose and Domains ... 290
9.4 ... Recordings for User Interface Channels ... 292
9.5 ... Configuration ... 297
9.6 ... Evaluation of Logs ... 301
9.7 ... Configurations for Remote API Channels ... 305
9.8 ... Conditions ... 307
9.9 ... Transport, Import, and Export ... 312
9.10 ... Summary ... 312
10 ... SAP Master Data Governance ... 315
10.1 ... Master Data Maintenance Scenarios ... 316
10.2 ... Maintaining Sensitive Data ... 322
10.3 ... Organizational Separation ... 324
10.4 ... Data Quality Assurance Using Services ... 326
10.5 ... Summary ... 329
11 ... SAP Test Data Migration Server ... 331
11.1 ... Use Cases ... 332
11.2 ... Structure and Functionality ... 335
11.3 ... Integration of the System Landscape in SAP TDMS ... 346
11.4 ... Data Protection with SAP TDMS ... 347
11.5 ... Summary ... 351
12 ... Accountability: Protection, Audits, Controls, and Documentation ... 353
12.1 ... Control Frame and Principles of Processing ... 354
12.2 ... Lawfulness, Fairness, and Transparency ... 355
12.3 ... Purpose Limitation ... 357
12.4 ... Data Minimization ... 360
12.5 ... Accuracy ... 364
12.6 ... Storage Limitation ... 366
12.7 ... Integrity and Confidentiality ... 369
12.8 ... Accountability ... 377
12.9 ... Abstract Technical Controls ... 378
12.10 ... Technical Control Actions: Examples ... 381
12.11 ... Summary ... 413
... Appendicess ... 415
A ... Relevant Transactions, Reports, and SAP Notes ... 415
B ... The Authors ... 419
... Index ... 423