## 11 Data Protection and Privacy
## Use
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data protection acts, it is necessary to consider compliance with industry-specific legislation in different countries. This section describes the specific features and functions that SAP provides to support compliance with the relevant legal requirements and data protection.
This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations with regard to additional features that would be required in a particular environment; decisions related to data protection must be made on a case-bycase basis and under consideration of the given system landscape and the applicable legal requirements.
##  Note
In the majority of cases, compliance with data privacy laws is not a product feature.
SAP software supports data protection by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data.
SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source.
## Glossary
| Term          | Definition                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Personal data | Any information relating to an identified or identifiable natu- ral person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identifica- tion number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person |
| Purpose       | The information that specifies the reason and the goal for the processing of a specific set of personal data . As a rule, the purpose references the relevant legal basis for the proc- essing of personal data.                                                                                                                                                                                                                                                |
| Term                 | Definition                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Blocking             | A method of restricting access to data for which the primary purpose has ended, while the relevant data might need to be retained for legal reasons. In that case, it either remains in the database (for example marked with a blocking indica- tor) or is moved to an archive. During the blocking phase, business users of SAP applications are prevented from dis- playing and using this data; it can only be processed if there are mandatory legal provisions. |
| Deletion             | Deletion of personal data so that the data is no longer usa- ble.                                                                                                                                                                                                                                                                                                                                                                                                     |
| Retention period     | The period of time between the end of the last business activity involving a specific object (for example, a business partner) and the deletion of the corresponding data, subject to applicable laws. The retention period is a combination of the residence period and the blocking phase.                                                                                                                                                                          |
| End of purpose (EoP) | The point in time when the processing of a set of personal data is no longer required for the primary business purpose, for example, when a contract is fulfilled. After the EoP has been reached, the data is blocked and can only be accessed by users with special authorizations (for example, tax audi- tors).                                                                                                                                                   |
Some basic requirements that support data protection are often referred to as technical and organizational measures (TOM). The following topics are related to data protection and require appropriate TOMs:
Access control : Authentication features as described in section User Administration and Authentication [page 10].
Authorizations : Authorization concept as described in section User Management [page 10].
Read access logging : as described in section Read Access Logging [page 33].
Transmission control / Communication security : as described in section Network and Communication Security [page 19].
Input control / Change logging as described in:
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , and open the search result with that title. Navigate to the section Change Documents .
Availability control as described in:
- Section Data Storage Security [page 23]
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Business Continuity into the search bar, press Enter , and open the search result with that title.
Separation by purpose : Is subject to the organizational model implemented and must be applied as part of the authorization concept.
##  Caution
The extent to which data protection is ensured depends on secure system operation. Network security, security note implementation, adequate logging of system changes, and appropriate usage of the system are the basic technical requirements for compliance with data privacy legislation and other legislation.
You also need to make sure that no personal data enters the system in an uncontrolled or non-purpose related way, for example, in free-text fields, through APIs, or customer extensions. Note that these are also not subject to the RAL example configuration.
## Configuration of Data Protection Functions
Certain central functions that support data protection compliance are grouped in Customizing for CrossApplication Components under Data Protection .
Additional industry-specific, scenario-specific or application-specific configuration might be required.
For information about the application-specific configuration, see the application-specific Customizing.
## More Information
You can find detailed information on data protection in the SAP Help Portal at https:/ /help.sap.com/ s4hana\_op\_2021 under Product Assistance Cross Components Data Protection .