Let's Talk Data Security

Every implementation of our software can throw up unique test data masking requirements. In this blog, one of our senior consultants Adan Willemse explains how Infotype 41 data had to be accurately masked in the test system, without devaluing the quality of the test data. In years gone by, this would have had us reaching for the ABAP exit functionality to code a solution, but with Data Secure 3, powerful masking rules can be built by anyone with knowledge of the data model, without the need for programming skills.

- Paul Hammersley, VP of ALM Portfolio at EPI-USE Labs

Infotype 41 challenges

SAP HCM customers are familiar with the Infotype 41 Date Specifications screen that stores many of an employee's key dates. We have blogged about the challenges of working with this infotype in the past from a reporting standpoint (see this blog about Fixing duplicate line reporting in SAP HCM).

This blog discusses the potential issues around implementing CCPA compliance if a superseding federal law is enacted. It covers:

• The fragmented states of data privacy
• The global data privacy drive hits the US
• The CCPA: a template for Federal law?
• Should I wait before tackling a CCPA compliance project?
• What can I do to prepare for a Federal law?
• Disclaimer

In this blog post, we provide a quick overview of the POPI Act, how it differs from GDPR, and practical steps you can take towards POPI compliance, specifically for SAP systems.

Controlling the risk

As we all know now, GDPR (the General Data Privacy Regulation) has brought in the requirement that every company has to be able to remove data both proactively, against retention criteria, and reactively, in response to an individual’s request, where no legal reason to hold the data remains. Similar requirements are apparent in other global data privacy legislation. For the last two years, I have been running implementations throughout Europe of the EPI-USE Labs’ solution to this challenge.

Governments worldwide are prioritizing data privacy and personal information security, and have invested significant resources in creating data privacy laws and amending existing ones. The EU’s GDPR (General Data Protection Regulation) was created to protect the individual citizens of the European Union (EU) and the European Economic Area (EEA). However, its influence has extended beyond its intended borders, making it a more global law and leading to updated data security and privacy legislation in other countries.

British Airways given £183 million fine for data breach – the first public GDPR fine in the UK

In the sunrise period for GDPR (the General Data Protection Regulation), it was a hot topic not just in the industry, but temporarily in the mainstream media as well. People with no interest in IT, never mind data security, were aware of the law and interested to see what was going to happen. A bit like how we all become Tennis aficionados for two weeks during Wimbledon. Since then, with (relatively speaking) small fines being issued which occurred under the old laws, the subject had left the mainstream again until today, with the news that the Information Commissioners Office (ICO) has handed down a fine of £183 million to British Airways (BA).

You MAY not do testing with personal data...and many people say they CAN not do testing with anonymised data. But there is a balance between the two; you are both allowed to and able to do testing with data which is both realistic and scrambled.

The General Data Protection Regulation (GDPR) that came into effect in May 2018 has changed the world’s view on data privacy. Every organisation that is either doing business with European Union citizens, or based within the EU, has spent many hours on the topic. It has changed the way we think about and act on personal data, from both a personal and business view.

Are you compliant with the terms of your SAP support contract?

One of my colleagues shared with me an excerpt from the SAP Cloud Services Data Processing Agreement (DPA), which states, “This DPA does not apply to non-production environments of the Cloud Service if such environments are made available by SAP, and Customer shall not store Personal Data in such environments.”

I decided to also look at some of the other SAP data processing agreements, and found similar language in their support and professional services DPAs:“Customer shall not grant SAP access to Licensee systems or personal information (of Customer or any third party) unless such access is essential for the performance of SAP Services. Customer shall not store any Personal Data in non-production environments.”

SAP customers have recently been receiving emails highlighting these changes to terms and conditions, requiring customers to take action very soon.

The news in Europe is abuzz with Brexit and the many complexities around it. One of the many questions companies are considering is how compliance with GDPR is affected by Brexit...

Missed the previous articles?  Read them here: Article 1 | Article 2 | Article 3 | Article 4 | Article 5 | Article 6 | Article 7 | Article 8

Breaches happen, and they will happen to you.  In the ninth and final article of this series, we look at how GDPR and POPIA treat data breaches. Read on:

• “Our system was compromised”
• Breach procedures are clear
• Notify them - it is the right thing to do
• Measuring risk and time limits
• Go with the strictest requirements
• All's well that ends well
• You want this poster
• SAP Knowledge Sidebar