GDPR and custom development in C4C

Wilco Menge, 07 February 2018

In a number of previous blog posts we have paid attention to the General Data Protection Regulation (GDPR) as well as some tools that SAP have made available that aid in compliance to these laws.

In short, the law – which goes in to effect on may 25th of 2018 – arranges that personal data can only be gathered legally under strict conditions, for a legitimate purpose.

Persons or organizations that collect and manage personal information must protect it from abuse and must respect certain rights of the data owners which are guaranteed by EU law. Some examples are the right to access data and the right to be forgotten.

It is important to realize that these laws also apply to Custom Development in C4C. In this blog post we will highlight some tooling SAP makes available in the 1802 release to help you in complying with these laws.

SAP provides the following tools for the following tasks:

Enabling disclore of custom data
Enabling removal of custom data
Enabling read access logging of custom data
Marking extension fields or custom object fields as personal data

Detailed information on these topics can be found in the PDI 1802 reference documentation.

Enabling disclore of custom data

When a customer requires (based on his GDPR rights) to be informed about all the data that is stored in the system about him, we need to “bypass” the regular checks and balances regarding authorizations – and stay compliant at the same time.

Custom Business Objects (BOs) and Business Object (BO) extensions that may have personal data can be made available in the Data Protection and Privacy work center by defining a new OWL and linking this to the Data Protection and Privacy workcenter using the Personal Data Disclosure content type

Enabling removal of custom data

Custom BOs and BO extensions that may have personal data must be removed or anonymized when the person’s details are removed using the data privacy tool.

Enabling read access logging of custom data

You can log and monitor read access to sensitive personal data, such as bank data, using Read Access Logging (RAL). You can define fields that contain sensitive personal data for business partners (such as, Employees, Service Agents, Individual Customers, and Contacts), and custom BO fields.

There can be a maximum of 5 personal sensitive fields per solution – additional 5 more fields can be defined using the Key User Tool.

Marking extension fields object fields as personal data

You can define fields that contain personal data for business partners in extension BOs. The personal data fields content is destroyed when the corresponding business object instance is removed using the data removal process.

Currently, the extension fields of only business partner, customer, employee, and service agent are allowed to be defined as personal data.

Example: Removing custom data

Let’s take a closer look at removing custom data. When the data of a person has to be deleted, we have to also take into account personal data that has been stored in Custom BOs and BO extensions. Sometimes the entire record can be deleted, sometimes the record may be anonymized.

For this task, SAP has provided a Customer Enhancement called DataPrivacyDestructionofCustomPersonalData. This enhancement is called when an officer removes a data record using the Data Protection and Privacy workcenter

The tool applies to Employees, Service Agents, Individual Customers and Contacts.

Create BO

Let’s create a Custom BO that holds some sensitive data:

A number of screens can be autogenerated to allow you to add some data:

Create Enhancement

In your solution, create a new Customer Enhancement with the following options:

A new enhancement has been created.

In the .enht file, you can add messages that you will be shown in the deletion logs when personal data is deleted.
The DESTROY.absl file should be populated with logic to remove or anonymize data in your Custom BOs or BO extensions.

In our example we will choose to anonymize our data: