Let's Talk Data Security

Controlling the risk

As we all know now, GDPR (the General Data Privacy Regulation) has brought in the requirement that every company has to be able to remove data both proactively, against retention criteria, and reactively, in response to an individual’s request, where no legal reason to hold the data remains. Similar requirements are apparent in other global data privacy legislation. For the last two years, I have been running implementations throughout Europe of the EPI-USE Labs’ solution to this challenge.

Governments worldwide are prioritizing data privacy and personal information security, and have invested significant resources in creating data privacy laws and amending existing ones. The EU’s GDPR (General Data Protection Regulation) was created to protect the individual citizens of the European Union (EU) and the European Economic Area (EEA). However, its influence has extended beyond its intended borders, making it a more global law and leading to updated data security and privacy legislation in other countries.

British Airways given £183 million fine for data breach – the first public GDPR fine in the UK

In the sunrise period for GDPR (the General Data Protection Regulation), it was a hot topic not just in the industry, but temporarily in the mainstream media as well. People with no interest in IT, never mind data security, were aware of the law and interested to see what was going to happen. A bit like how we all become Tennis aficionados for two weeks during Wimbledon. Since then, with (relatively speaking) small fines being issued which occurred under the old laws, the subject had left the mainstream again until today, with the news that the Information Commissioners Office (ICO) has handed down a fine of £183 million to British Airways (BA).

You MAY not do testing with personal data...and many people say they CAN not do testing with anonymised data. But there is a balance between the two; you are both allowed to and able to do testing with data which is both realistic and scrambled.

The General Data Protection Regulation (GDPR) that came into effect in May 2018 has changed the world’s view on data privacy. Every organisation that is either doing business with European Union citizens, or based within the EU, has spent many hours on the topic. It has changed the way we think about and act on personal data, from both a personal and business view.

Are you compliant with the terms of your SAP support contract?

One of my colleagues shared with me an excerpt from the SAP Cloud Services Data Processing Agreement (DPA), which states, “This DPA does not apply to non-production environments of the Cloud Service if such environments are made available by SAP, and Customer shall not store Personal Data in such environments.”

I decided to also look at some of the other SAP data processing agreements, and found similar language in their support and professional services DPAs:“Customer shall not grant SAP access to Licensee systems or personal information (of Customer or any third party) unless such access is essential for the performance of SAP Services. Customer shall not store any Personal Data in non-production environments.”

SAP customers have recently been receiving emails highlighting these changes to terms and conditions, requiring customers to take action very soon.

The news in Europe is abuzz with Brexit and the many complexities around it. One of the many questions companies are considering is how compliance with GDPR is affected by Brexit...

Missed the previous articles?  Read them here: Article 1 | Article 2 | Article 3 | Article 4 | Article 5 | Article 6 | Article 7 | Article 8

Breaches happen, and they will happen to you.  In the ninth and final article of this series, we look at how GDPR and POPIA treat data breaches. Read on:

• “Our system was compromised”
• Breach procedures are clear
• Notify them - it is the right thing to do
• Measuring risk and time limits
• Go with the strictest requirements
• All's well that ends well
• You want this poster
• SAP Knowledge Sidebar

Missed the previous articles?  Read them here: Article 1 | Article 2 | Article 3 | Article 4 | Article 5 | Article 6 | Article 7

Deleting data is never as simple as pressing a button. In this eighth article on GDPR and POPIA we look at the requirements and complexities of data deletion. Read on:

• “All good things come to an end”
• No purpose? No data.
• The laws encourage deletion
• The Right to be Forgotten
• Deleting records is a priority, but what about backups?
• Clean data is a clean conscience
• We have a webinar you need to watch
• SAP Knowledge Sidebar

Missed the previous articles?  Read them here: Article 1 | Article 2 | Article 3 | Article 4 | Article 5 | Article 6

How long can you keep data? In the seventh article in our series on GDPR and POPIA we look at the rules and exceptions for archiving data on systems.  Read on:

• “They’re just not that into you”
• Archiving and statistics
• Data retention and the laws
• Redact or archive, it is the safer option
• For the history books
• Missed our webinar? View it here for free.
• SAP Knowledge Sidebar

SAP: ERP off the shelf

Why has SAP been so successful for so long? Because they designed a massively powerful – and scalable – ERP system, which could be installed from the same CDs/DVDs/Files (delete as appropriate depending on your age) at almost any organisation in the world. From there it could be quickly/slowly/glacially (delete as appropriate depending on your industry/project scope etc) tailored to fit a very wide variety of business processes, just by making settings in the IMG. No need for custom code or tables in the database unless you really wanted to bring your own processes to the system, and even that wasn’t too hard to do. 

Read on to find out about:

• BOW: customer-defined objects
• Our SAP GDPR Compliance/Data Privacy Suite: flexibility built in
• Personalised gifts for MAPA
• My own custom-made dummy!