## 13.2.11.7  Data Protection
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries. This section describes the specific features and functions that SAP provides to support compliance with the relevant legal requirements and data privacy.
This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations with regard to additional features that would be required in a particular environment; decisions related to data protection must be made on a case-bycase basis and under consideration of the given system landscape and the applicable legal requirements.
##  Note
In the majority of cases, compliance with data privacy laws is not a product feature.
SAP software supports data privacy by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data.
SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source.
## Glossary
| Term                 | Definition                                                                                                                                                                                                                                                              |
|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Personal data        | Information about an identified or identifiable natural per- son.                                                                                                                                                                                                       |
| Business purpose     | A legal, contractual, or in other form justified reason for the processing of personal data. The assumption is that any purpose has an end that is usually already defined when the purpose starts.                                                                     |
| Blocking             | A method of restricting access to data for which the primary business purpose has ended.                                                                                                                                                                                |
| Deletion             | Deletion of personal data so that the data is no longer usa- ble.                                                                                                                                                                                                       |
| Retention period     | The time period during which data must be available.                                                                                                                                                                                                                    |
| End of purpose (EoP) | A method of identifying the point in time for a data set when the processing of personal data is no longer required for the primary business purpose. After the EoP has been reached, the data is blocked and can only be accessed by users with special authorization. |
Some basic requirements that support data protection are often referred to as technical and organizational measures (TOM). The following topics are related to data protection and require appropriate TOMs:
- Access control: Authentication features as described in section User Management and Authentication [page 175]
- Authorizations: Authorization concept as described in section Authorization Management in Incentive and Sales Force Management [page 180]
- Read access logging: as described in section Read Access Logging [page 225].
- Transmission control: as described in section Network and Communication Security [page 220]
- Input control: Change logging is described in the application-specific documentation
- Availability control as described in:
- Section Data Storage Security
- SAP NetWeaver Database Administration documentation
- SAP Business Continuity documentation in the SAP NetWeaver Application Help under FunctionOriented View Solution Life Cycle Management SAP Business Continuity
- Separation by purpose: Is subject to the organizational model implemented and must be applied as part of the authorization concept.
##  Caution
The extent to which data protection is ensured depends on secure system operation. Network security, security note implementation, adequate logging of system changes, and appropriate
usage of the system are the basic technical requirements for compliance with data privacy legislation and other legislation.
## Configuration of Data Protection Functions
Certain central functions that support data protection compliance are grouped in Customizing for CrossApplication Components under Data Protection . Additional industry-specific, scenario-specific or applicationspecific configuration might be required.
For information about the application-specific configuration, see the application-specific Customizing in SPRO.