How can you increase data privacy compliance in SAP?
The aim of any privacy project is to increase compliance with the required data privacy laws within the company’s jurisdiction. And SAP’s structure makes addressing data privacy compliance particularly tricky. One of the most compelling reasons for data privacy compliance is the enforcement fines; the new laws provide for high financial sanctions to be applied by legal bodies.
We have been implementing privacy projects around the globe in multiple industries for over 20 years, and have identified essential steps in a common project approach:
- Identify your risks: Impact and risk assessment
- Find and map your PII
- Review access Risk and Controls
- Clean up the backlog in Production
- Manage PII in Production copies
- Handle Data Subject Access Requests (DSARs)
- Process individual requests for removal
- Proactive identification of Data Subjects
- Ongoing audit and review
Respond to the Right to Access/Removal in Production systems
Whether you’re adhering to PDPA in Thailand, one of the state laws in the USA, or GDPR in Europe, you are required to provide a response to the Right to Access and deletion of personal data from your environment.
The Right to Removal does not overrule any of your other legal and compliance requirements, such as keeping records for tax audit. You now need to find a way to validate if data is required for any other legal reason, and if not, remove sensitive data from your system.
SAP presents a challenge in data removal; as a relational database, the sensitive data is intrinsically linked with your business transactions. So traditional ways of archiving or deleting mean you need to remove your transactions and master data completely.
EPI-USE Labs provides an alternative in Data Redact, removing the PII from records but leaving the referential integrity of the solution. And Data Disclose provides effective PII mapping in a PDF output, allowing an efficient process to respond to the Right to Access.
Scramble data in non-production systems
Every business needs to test their processes, whether it’s the annual payroll taxation updates, service pack upgrade or new customizations. You don’t want to find out you have an issue with the new processes in Production; so most businesses will take a copy of their Production systems and create test environments.
The number of testing environments varies depending on the business, but a typical set-up would be to have
- Development with limited to no real data
- Quality a reduced data copy from Production
- Pre-production a full copy of the Production database.
The new privacy laws state that you must have informed and explicit consent for the use of the data relating to data subjects. In our experience, most businesses do not have this consent for using data for testing purposes. Even if you did have a consent process there is an additional challenge in understanding what to do for a no-consent response from a data subject.
We recommend data anonymisation with Data Secure, providing direct in-place data anonymisation, or the ability to scramble on exit when linked with Client Sync, part of the Data Sync Manager Suite.
Improve and understand your data privacy and security risks
To solve a problem, you first need to understand the problem. For both data privacy and security, you need to understand the risks you hold in your business process and your IT estate.
Consider your business processes and security risks. For example, do your front office or HR colleagues take notes during calls? If so, what is the security process for those notes? Are you following best practice for data security throughout your business?
Regarding your IT estate, three primary considerations are:
- External threat: Network and infrastructure security such as firewalls or VPN protection.
- Internal threat: The risk of access to data in the network / SAP system.
- Compliance risk: Where is your PII and how is it being managed?
Our
comprehensive SAP data privacy assessment service provides transparency about the Internal and Compliance risks for your business.
Drive business-centric GRC for SAP
Governance, Risk and Compliance (GRC) solutions take many aspects of access risk into account. We are partnered with Soterion, offering a fast, efficient analysis of your GRC risks with standard delivered rulesets to cover:
- Segregation of Duties (SoD)
- Privacy: users accessing sensitive data
- Cross-jurisdictional data access
- Critical transaction risk.
These solutions can integrate between SAP and cloud applications (such as SAP SuccessFactors) to provide a holistic view of your access risk.
Soterion also offers assessment of your system licences, firefighter access processes and more.
