## 13.5.4.2.1  Data Protection
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific
legislation in different countries. This section describes the specific features and functions that SAP provides to support compliance with the relevant legal requirements and data privacy.
This section and any other sections in this Security Guide do not give any advice on whether these features and functions are the best method to support company, industry, regional or country-specific requirements. Furthermore, this guide does not give any advice or recommendations with regard to additional features that would be required in a particular environment; decisions related to data protection must be made on a case-bycase basis and under consideration of the given system landscape and the applicable legal requirements.
##  Note
In the majority of cases, compliance with data privacy laws is not a product feature.
SAP software supports data privacy by providing security features and specific data-protection-relevant functions such as functions for the simplified blocking and deletion of personal data.
SAP does not provide legal advice in any form. The definitions and other terms used in this guide are not taken from any given legal source.
## Glossary
| Term                 | Definition                                                                                                                                                                                                                                                             |
|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Personal Data        | Information about an identified or identifiable natural per- son.                                                                                                                                                                                                      |
| Business purpose     | A legal, contractual, or in other form justified reason for the processing of personal data. The assumption is that any purpose has an end that is usually already defined when the purpose starts.                                                                    |
| Blocking             | A method of restricting access to data for which the primary business purpose has ended.                                                                                                                                                                               |
| Deletion             | Deletion of personal data so that the data is no longer usa- ble.                                                                                                                                                                                                      |
| Retention period     | The time period during which data must be available.                                                                                                                                                                                                                   |
| End of purpose (EoP) | A method of identifying the point in time for a data set when the processing of personal data is no longer required for the primary business purpose. After the EoP has been reached, the data is blocked and can only be accessed by users with special authorization |
Some basic requirements that support data protection are often referred to as technical and organizational measures (TOM). The following topics are related to data protection and require appropriate TOMs:
- Access control : Authentication features as described in section User Administration and Authentication.
- Authorizations : Authorization concept as described in section Authorizations.
- Read access logging : as described in section Read Access Logging.
- Communication Security : as described in section Network and Communication Security.
- Availability control as described in:
- Section Data Storage Security
- SAP NetWeaver Database Administration documentation
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Business Continuity into the search bar, press Enter , and open the search result with that title.
- Separation by purpose : Is subject to the organizational model implemented and must be applied as part of the authorization concept
##  Note
The extent to which data protection is ensured depends on secure system operation. Network security, security note implementation, adequate logging of system changes, and appropriate usage of the system are the basic technical requirements for compliance with data privacy legislation and other legislation.
## Configuration of Data Protection Functions
Certain central functions that support data protection compliance are grouped in Customizing for CrossApplication Components under Data Protection.
Additional industry-specific, scenario-specific or application-specific configuration might be required. For information about the application-specific configuration, see the application-specific Customizing in SPRO.