General Data Protection Regulation (GDPR)

the General Data Protection Regulation (GDPR) is an EU regulation that gives individuals control and protection over their personal data. It applies in the European Union and the European Economic Area. All companies must comply with it.

Personal data is all data that can identify an individual or serve to identify them. The GDPR generally applies directly in every member state as an EU regulation. However, numerous opening clauses allow the national legislator some leeway.

Requirements for companies

Generally, companies are not allowed to store personal data without a purpose and explicit consent. The requirements increase in four areas: providing information to individuals about their stored data, deletion (the so-called „right to be forgotten“), recording changes, and recording read access to sensitive data. Appropriate compliance measures fall within the responsibility of each company. This entry does not replace individual legal advice.

Implementation in SAP Business One

Since release 9.3 PL04, SAP Business One has supported compliance with data protection regulations through its own features. By default, GDPR is enabled for all EU countries. In Administration • Service programs • Data protection tools, personal data management, an assistant, and an access protocol for sensitive data are available.

Fields can be classified as personal, non-personal, or sensitive personal data. Sensitive fields such as bank accounts are automatically encrypted by SAP Business One. The system restricts access to them via permissions and logs them. The assistant identifies natural persons, creates reports about their data, cleans up the data, or locks it down.

The lock is intended for data that the company is not allowed to delete due to a retention period. Locked data remains in the system, but appears on the surface anonymously. The assistant does not capture some areas, for example the „Notes“ tab in the business partner master data. These areas must be manually cleaned up by the company.

Reference to the Versino accounting service

In Versino Accounting Services, CKS.DMS takes care of the audit-compliant archiving. This archiving is compliant with the GoBD, GDPR and HGB regulations.

Demarcation

This entry covers the regulation itself and its implementation in SAP Business One. Data protection, order data processing (ADV, GDPR), and the order processing agreement (AVV) have their own entries in the glossary.

SAP B1 blog