## 7.5.1  Glossary for Data Protection and Privacy
The following terms are general to SAP products. Not all terms may be relevant for SAP BTP.
| Term                       | Definition                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
|----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Blocking                   | A method of restricting access to data for which the primary business purpose has ended.                                                                                                                                                                                                                                                                                                                                                                          |
| Business purpose           | The legal, contractual, or in other form justified reason for the processing of personal data to complete an end-to-end business process. The personal data used to complete the process is predefined in a purpose, which is defined by the data controller. The process must be defined before the per- sonal data required to fulfill the purpose can be determined.                                                                                           |
| Consent                    | The action of the data subject confirming that the usage of his or her personal data shall be allowed for a given pur- pose. A consent functionality allows the storage of a consent record in relation to a specific purpose and shows if a data subject has granted, withdrawn, or denied consent.                                                                                                                                                              |
| Data subject               | Any information relating to an identified or identifiable natu- ral person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identifica- tion number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. |
| Deletion                   | Deletion of personal data so that the data is no longer avail- able.                                                                                                                                                                                                                                                                                                                                                                                              |
| End of business            | Defines the end of active business and the start of residence time and retention period.                                                                                                                                                                                                                                                                                                                                                                          |
| End of purpose (EoP)       | The point in time when the processing of a set of personal data is no longer required for the primary business purpose, for example, when a contract is fulfilled. After the EoP has been reached, the data is blocked and can only be accessed by users with special authorizations (for example, tax audi- tors).                                                                                                                                               |
| End of purpose (EoP) check | A method of identifying the point in time for a data set when the processing of personal data is no longer required for the primary business purpose . After the EoP has been reached, the data is blocked and can only be accessed by users with special authorization, for example, tax auditors.                                                                                                                                                               |
| Term                    | Definition                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Personal data           | Any information relating to an identified or identifiable natu- ral person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identifica- tion number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.                                                                                |
| Purpose                 | The information that specifies the reason and the goal for the processing of a specific set of personal data. As a rule, the purpose references the relevant legal basis for the proc- essing of personal data.                                                                                                                                                                                                                                                                                                                                  |
| Residence period        | The period of time between the end of business and the end of purpose (EoP) for a data set during which the data remains in the database and can be used in case of sub- sequent processes related to the original purpose. At the end of the longest configured residence period, the data is blocked or deleted. The residence period is part of the over- all retention period.                                                                                                                                                               |
| Retention period        | The period of time between the end of the last business activity involving a specific object (for example, a business partner) and the deletion of the corresponding data, subject to applicable laws. The retention period is a combination of the residence period and the blocking period.                                                                                                                                                                                                                                                    |
| Sensitive personal data | A category of personal data that usually includes the follow- ing type of information: • Special categories of personal data, such as data reveal- ing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or sex life or sexual orientation. • Personal data subject to professional secrecy • Personal data relating to criminal or administrative of- fenses • Personal data concerning insurances and bank or credit card accounts |
| Term                                        | Definition                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
|---------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Technical and organizational measures (TOM) | Some basic requirements that support data protection and privacy are often referred to as technical and organizational measures (TOM). The following topics are related to data protection and privacy and require appropriate TOMs, for example: • Access control: Authentication features • Authorizations: Authorization concept • Read access logging • Transmission control / Communication security • Input control / Change logging • Availability control • Separation by purpose: Is subject to the organizational model implemented and must be applied as part of the authorization concept. |