Three key tips to comply with employees’ right to privacy

August 05, 2021
Written by Danielle Larocca

Senior Vice-President of HCM Solutions Danielle Larocca has worked in the SAP HCM space for over 20 years. An SAP Mentor and featured speaker at numerous conferences, Danielle has authored four best-selling books on SAP, is the Technical Editor for the SAP Professional Journal, and often the Voice of the Expert on SAPInsider’s Ask the Expert series for HR.


There is quite a bit in the news lately about hackers, scammers, ransomware and technology, and security is always at the forefront. The protection of employee data is a critical aspect for those of us in the Human Capital Management and Payroll workforce. The laws and regulations vary by country and include the POPI Act, GDPR and HIPAA as examples, but there is also simply the commonsense requirement to maintain employees’ right to privacy.


Many times the vulnerability of employee data is caused by human error, as in this famous example from a few years back: Payroll company apologizes for accidentally publishing social insurance numbers. Other times it is more malicious in nature, where the motivation is to cyberattack an organization to steal employee identities.


Regardless of the intent, ensuring your critical HR and Payroll data is secure is a necessity. For those companies using SAP® or SAP SuccessFactors, here are a few key points that you need to be aware of.

1. Make sure your data is secure in non-production systems

Whether you are using SAP or SuccessFactors, your data may reside in more than one environment. Often customers need valid data in non-productive instances or clients for testing, support, or training. This is an area of vulnerability as the controls in place in non-productive environments may be different from those in production. Customers often refresh data from one environment to another which may include employee data. In these cases, you require a secure mechanism for the secure movement of that data and the appropriate anonymization of that data in SAP or SAP SuccessFactors hybrid environments. To learn more and to be sure that your critical data is secure and leveraging an SAP-certified solution, visit Data Sync Manager (DSM) for HCM for more information.


Make sure your data is secure in non-production systems

2. Ensure you know all the places this employee data exists

It is easy to identify the primary location that stores a lot of the basic employee data. For example, we know that the Gender field is stored on Infotype 0002 Personal Information in SAP and on the Employee Profile in SuccessFactors Employee Central. However, we also need to think about any of the places that data is propagated to including reports, interfaces and spool files, and ensure that the data is secured there as well. Knowing all of these touchpoints is critical. One way to ensure that your data is protected is to be sure that any third-party solutions that you are using are certified by SAP, as only those that hold the appropriate certifications are ensured to respect the appropriate SAP and SuccessFactors authorizations. For reporting, interfaces and documents, the leading solution that holds this critical SAP certification is the Query Manager with Document Builder, visit Query Manager for more information.


leveraging an SAP-certified solution to access sensitive HR data

3. Routinely review your SAP authorizations

Ensuring compliance with any regulations is not a one-time activity but rather a recurring event that requires continuous review and update. In the SAP ECC world, this includes not only access to employee data but access to develop or execute ABAP (where code can be written to evaluate table or cluster data) and database access. I have seen many employers that made an enormous effort to keep master data locked down at the transaction code/infotype/user level while ignoring the availability of that sensitive data to anyone with the skills to review data either via code, ad hoc table access (SQ01), spools or Basis database (Select *...) access. Additionally, data is also fed to Finance modules with their own sets of authorizations that require review. Keep in mind any monies paid are recorded somewhere and even a cost center report could divulge critical sensitive information that may make an employee’s personal data vulnerable.


For SAP HCM, authorization objects are the nuts and bolts of your HR security. They decide what can be done on a given infotype. Access needs to be controlled and reviewed regularly but you also need to consider segregation of duties for payroll processing. To look after these concerns and assess, update and maintain roles and authorizations in a cost-effective and intuitive way, and comply with data privacy regulations, check out Soterion Access Risk Manager. Visit Soterion's compliance software for more information.


Routinely review your security authorizations and protocols



Explore Popular Tags

Query Manager SAP SuccessFactors SAP HCM reporting SAP HCM HCM Reporting SAP Payroll SAP Reporting HCM SAP SuccessFactors Employee Central Payroll EPI-USE Labs SAP SuccessFactors Reporting reporting Intelligent HR and Payroll PRISM Payroll Document Builder Human Capital Management (HCM) Payroll reporting Query Manager Analytics Connector SAP Analytics Cloud SAP HCM Data SAP Query Microsoft PowerBI SAP SuccessFactors People Analytics SAP Payroll data Variance Monitor HR and Payroll data Tableau HXM Move Payroll Data SAP HCM Payroll SAP HR Reporting SAP HXM SAP S/4HANA SAP S/4HANA Private Cloud Edition (S/4 PCE) people analytics sap query hr Data Sync Manager Employee Central Payroll Journey to SAP SuccessFactors PRISM for HCM (Private Cloud Edition) PRISM free assessment SAP SAP ERP HCM SAP HCM On-Premise Solutions SAP HCM journey SAP and SuccessFactors HXM Reporting COVID-19 Cloud-based SAP HCM solutions Employee payroll HCM Productivity Suite HR SAP HCM/HXM SuccessConnect reporting solution ABAP DSM for HCM Employee Central Payroll Reporting Employee data GeoClock H4S4 Let's Talk HCM On-Premise Payroll Pay Recon SAP Data Warehouse Cloud SAP HCM Analysis SAP SuccessFactors HCM Journey SAP SuccessFactors Roadmaps SAP data privacy and compliance SuccessFactors Ultimate Guide: SAP HCM & Payroll Options data validation payroll control center Artificial Intelligence (AI) Data Sync Manager for HCM Digital transformation Employee Central GDPR HCM, HR OData PRISM for ECP PRISM for H4S4 Query Manager with Document Builder Real-time reporting and document creation SAP Analytics Cloud (SAC) SAP HCM On-premise SAP HCM for SAP S/4HANA On-Premise SAP HR SAP On-Premise customers SAP Payroll to the Cloud SAP Road maps SAP customers SAP data SAP data privacy & security Success Factors SuccessConnect 2019 Tax Reporting Transformation without re-implementation accurate payroll data certification custom infotype data source ebook on-premise SAP HCM s/4HANA Analytics solutions Automated reports Automation Cloud migrations DSM Object Sync for SuccessFactors Hybrid Data Secure Data Types Data analysis EPI-USE Labs’ solutions Employee Letters Employee communication Free HCM Assessment HR Journey HR employee reports Human Experience Management (HXM) Human Resources Human Resources data Hybrid Reporting SAP and SuccessFactors Hybrid SAP and SuccessFactors Hybrid reporting Hybrid reporting solution Integrated reporting SuccessFactors SAP Intelligent Enterprise Machine Learning (ML) Microsoft Excel News OData integration OM Object Sync On-Premise Payroll S/HANA Sidecar On-premise reporting Organization of the data PA People Analytics Workforce Planning Personalized documents Protect personal employee data Report Stories Reporting and analysis Robotic Process Automation (RPA) Robotic Process Automation framework S/4HANA Private Cloud Edition (PCE) SAP Data Privacy Suite SAP Data Security SAP ERP Payroll customers SAP HCM 2023 SAP HCM Roadmap SAP HCM and Payroll customers SAP HCM for S/4HANA SAP HXM 2021 SAP Mentors SAP SuccessFactors Hybrid SAP SuccessFactors Next-Gen Payroll SAP SuccessFactors Release updates SAP SuccessFactors Time Management SAP SuccessFactors Time Tracking SAP Wage Type Reporter SAP certified solution SAP migration SAPPHIRE 2018 SuccessFactors and the Intelligence Enterprise SuccessFactors' Employee Central Payroll TCO Calculator The Report Center The Road to People Analytics Time management Workforce Planning ad hoc data variances easy reporter high-speed, low-risk on-premise SAP data partner roadmap single reporting solution sq01 stories in SAP SuccessFactors People Analytics technology third party AI ALE STP report ASUG Accessing COVID-19 data Ad Hoc Query American Payroll Association (APA) Analytics Connector Analytics reports Analytics solution At-risk employees Australian Payroll Australian Tax Office (ATO) Automated analysis and pay run reconciliations Automatic HR reports BTP Best practice in BI Bots Business Analytics Business Intelligence COVID-19 statistics COVID-19 vaccinations Certified solutions ChatGPT Check for data replication errors Client Sync Cloud hosting SAP PCE Company Branding Compare legacy HR and Payroll data Comparing data Configuration Center Copy and mask test data Coronavirus Created timestamp Custom store Customer-specific infotypes DSAG Data Privacy Data Replication Data Sources Data Sync Manager (DSM) Data access Data privacy regulations Data production support issue solution Democratize data Description Diversity & Inclusion reporting DocuSign Document Building Dubai Dynamic data ECC EPI-USE ERP Education sector Electronic Signatures Embedded Analytics Edition Employee Central time Employee Central timesheets Employee NICs Employee Retention Analytics (ERA) Employee payment summaries Employee right to privacy Employer NICs Encrypt data FAQ Index Font Guidelines Gender Pay Gap
+ See More

Get Instant Updates

Leave a Comment: