Data Redact, part of the Data Privacy Suite for SAP

Data Redact is our production privacy solution. It allows you to selectively remove data from a production environment without removing the entire record and allowing you to maintain the business intelligence that you hold in that environment. So for example, the finance transactions associated to a customer or vendor, which are your business data. They are payments or invoices that you have paid that have come through the environment, do not need to be removed in the redaction case. Instead, we will selectively remove the name, the telephone number, the bank details, etcetera, from the record, but allow the referential integrity in the transactions to continue to exist.

Data Redact™ is our unique Fiori app which has been specifically developed to address the Right to be Forgotten challenge as outlined in GDPR (the General Data Protection Regulation) and other data privacy regulations around the world. As part of our Data Privacy Suite for SAP, it quickly and seamlessly redacts field data without affecting referential integrity. This means the data can no longer be identified and linked to a specific individual, but business reporting and referential integrity are unaffected.

By redacting fields which are sensitive, or can be used to identify the natural person, the rest of the data can be retained, which drastically lowers the impact on reporting and the risk of adverse effects on other business processes or other areas of SAP, such as related CRM systems.

For many organisations, the ability to enforce a retention period on data for ex-employees is very important, and typically driven by the same 'leave date' criteria. The Leaver Report in Data Redact™ allows employees to be automatically selected for Redact submission, based on the number of days since they left the organisation.

How can you tackle the Right to be Forgotten?

As the data is effectively removed for identification purposes, you can easily and cost-effectively comply with the legislation and the individual’s Right to be Forgotten with Data Redact. Once a record has been redacted, there is no link back to who the natural person was, and any field which in itself is also sensitive is also redacted. From that point onwards the record has been fully anonymised.

Some existing SAP solutions attempt to address this challenge by blocking access for processing, or perpetual archiving, neither of which are ideal solutions in this scenario.

How can you remove sensitive data in SAP, without removing the entire record?

Article 17 of the GDPR dictates that individuals have the Right to Erasure (Right to be Forgotten); the right to have personal data erased and to prevent processing in some specific circumstances. Data Redact allows you to remove the sensitive or identifying data without removing the entire record. This makes the process simpler and less invasive. The data is effectively submitted for redaction so the data cannot be identified. Data Redact reactively addresses the Right to be Forgotten.

For more information, please schedule a discovery session, watch our on-demand webinars or learn more about our Data Removal and Data Privacy consulting services.

The need for data privacy compliance is growing around the world. EPI-USE Labs' Data Privacy Suite provides solutions to help you meet these requirements across your SAP landscape. With Data Disclose, you can search all your SAP systems to find where personal data is stored, including any non-SAP systems integrated through the product's API. This gives you a single place to search, review, and present the full data footprint for any data subject. You can then export this data as a custom branded PDF to respond to any Subject Access Requests. Depending on the scenario, you might need to erase the data for compliance. Data Redact can then be used to submit this data for redaction, so the data cannot be identified. The sensitive data is effectively redacted, allowing you to comply with the individual's Right to be Forgotten. From there, you can use Data Retain to build highly configurable rules that set appropriate retention periods for different types of data. Once configured, it will apply those rules to identify sets of data as they become due for redaction, giving you a proactive data privacy compliance solution.