CDS pluginCDS plugintypeInstalls into a CAP project and extends the runtime. CAP loads it through cds.requires or the plugin hook.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
@cap-js/data-privacy
Integration with SAP Data Privacy Integration, driven by the personal-data annotations already on the model — the annotation that marks a field is the one the service acts on.
Data privacyCAPData privacycapabilityDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.
@sap/cds≥ 9.8@sap/cdsartifactThe peer range, as published.
Who is behind it
SAP Cloud Application Programming ModelSAP Cloud Application Programming ModelOrganisationMaintains this In the atlas: maintains 34@cap-jsmaintainerGuilherme DellagustinPersonContributes to this In the atlas: contributes to 27@dellagustin-sapMarten SchiwekPersonContributes to this In the atlas: contributes to 16@schiwekMSimon EngelPersonContributes to this In the atlas: contributes to 14, wrote 4@SirSimon04Stefan RudiPersonContributes to this In the atlas: contributes to 13, wrote 5@stefanrudi4 contributors
Before choosing this
crawled
Conditions
LicenceSAP Developer License Agreement 3.2 CAP§ 1, 2, 3A cds-plugin is used with SAP CAP materials, or an artifact is explicitly identified as a CAP plugin or application.
Derived: the instrument's applicability matches this artifact, checked
§ 1License. Productive customer applications are limited to SAP BTP or another SAP-licensed platform, and mass extraction to a non-SAP product is restricted except where solely required for SAP interoperability.
§ 2Intellectual Property. The agreement retains SAP's rights in the covered materials and limits making APIs, tools or software available to third parties, while preserving ownership of customer applications subject to SAP's underlying rights.
§ 3Artificial Intelligence Training. The agreement prohibits use of the covered materials and customer applications for training artificial-intelligence models or systems.
declared, How the plugin is installed into a CAP project, as its documentation says.
Connections1
Group by
NodeRelationConditionBasis
Functional1
Data privacyData privacycapabilityHandling personal data the way the law requiresSAP only
→provides
Integrates SAP Data Privacy Integration from the @PersonalData annotations on the model, so the fields marked personal are the ones the service acts on.
provides Data privacy
Functional, stated
For
Integrates SAP Data Privacy Integration from the @PersonalData annotations on the model, so the fields marked personal are the ones the service acts on.
Basis
“In order to automate audit logging, personal data management, and data retention management as much as possible, the first and frequently only task to do as an application developer is to identify entities and elements (potentially) holding personal data using @PersonalData annotations.”Annotating Personal Data — capire, checked
stated
provides Data privacy
Functional, stated
For
Integrates SAP Data Privacy Integration from the @PersonalData annotations on the model, so the fields marked personal are the ones the service acts on.
Basis
“In order to automate audit logging, personal data management, and data retention management as much as possible, the first and frequently only task to do as an application developer is to identify entities and elements (potentially) holding personal data using @PersonalData annotations.”Annotating Personal Data — capire, checked
In particular based on @PersonalData and @ILM annotations in the data model, the plugin automatically provides a /dpp/information endpoint and a /dpp/retention endpoint via which the SAP DPI service can request personal data to show it in its Manage Personal Data app and block and delete data based on retention rules defined in SAP DPI.
In tests/bookshop-app/ you can find a sample application that is used to demonstrate how to use the plugin and to run tests against it.
Local Testing
To execute local tests, simply run:
npm run test
For tests, the cds-test Plugin is used to spin up the application. More information about cds-test can be found here.
Support, Feedback, Contributing
This project is open to feature requests/suggestions, bug reports etc. via GitHub issues. Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our Contribution Guidelines.
Security / Disclosure
If you find any bug that may be a security problem, please follow our instructions in our security policy on how to report it. Please do not create GitHub issues for security-related doubts or problems.
Code of Conduct
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its Code of Conduct at all times.
Licensing
Copyright 2026 SAP SE or an SAP affiliate company and data-privacy contributors. Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.
Fixed an issue where key associations were not correctly handled
Fixed an issue with cds add adding redundant xsuaa scope information
Fixed an issue that caused a server crash when no db connection was available during HANA role cleanup
Fixed an issue where the dppBlockingDate field was not correctly propagated across entities in the project, particularly entities containing a union or joins
Fixed an issue where HANA Analytic Privileges were not correctly generated for views with joins or unions
cds add data-privacy now adds the HDI default role with the schema role for accessing DPP views included. Previously it was only generated by cds build.
Fixed
Fixed an issue where entities with joins or unions would crash the data privacy service generation logic
Fixed an issue with handling ILM objects which are projections on top of base tables
Fixed an issue with handling inline compositions
Fixed an issue with resolving backlinks from projections
Fixed an issue where key associations were not correctly handled
Provide the sap.ilm.RetentionService as a REST service at /dpp/retention, requiring the DataRetentionManagerUser role, to integrate with the SAP Data Privacy Integration NG (DPI) Retention Management module.
Automatically generate the retention service interface from CDS models annotated with @PersonalData.EntitySemantics and related annotations.
Support ILM Object discovery via GET /dpp/retention/iLMObjects, returning metadata including object names, reference dates, organizational attributes, conditions, and data subject roles.
Support blocking of ILM object instances and their compositions via dataSubjectILMObjectInstanceBlocking, setting dppBlockingDate and destruction dates recursively through the entire composition hierarchy.
Support blocking of data subject master data via dataSubjectBlocking, with validation that no active ILM object instances remain.
Support destruction (deletion) of ILM object instances via dataSubjectsILMObjectInstancesDestroying when the earliest destruction date has passed.
Support destruction of data subjects via dataSubjectsDestroying when the earliest destruction date has passed and no active ILM object instances remain.
Support end-of-business checks via dataSubjectEndOfBusiness to determine whether all business for a data subject is concluded.
Support end-of-residence evaluation via dataSubjectsEndOfResidence and dataSubjectsEndOfResidenceConfirmation to identify data subjects eligible for blocking based on retention sets and residence periods.
Support retrieval of latest retention start dates via dataSubjectLatestRetentionStartDates per retention set, including condition-based filtering.
Support retrieval of organizational attribute values for a data subject via dataSubjectOrganizationAttributeValues.
Support retrieval of data subject display information (name and email) via dataSubjectInformation, derived from @Communication.Contact annotations.
Support async callback handling for blocking status updates via dataSubjectBlockingAsyncCallback.
Support @ILM.ObjectName to customize the ILM object name exposed to the DPI service. The default remains the entity name.
Support i18n in DPI UIs
Organizational Attributes & Value Help
Automatically generate value help endpoints for organizational attributes annotated with @PersonalData.FieldSemantics: 'DataControllerID' or @ILM.FieldSemantics: 'LineOrganizationID'.
Support three resolution strategies for organizational attribute value help: @Common.ValueList annotation, association target with @Common.Text or @UI.HeaderInfo.Title.Value, or SELECT DISTINCT fallback.
Automatically generate value help endpoints for condition fields annotated with @PersonalData.FieldSemantics: 'PurposeID' or @ILM.FieldSemantics: 'ProcessOrganizationID'.
Blocking & Destruction Aspects
Automatically inject sap.ilm.blocking (with dppBlockingDate) and sap.ilm.destruction (with ilmEarliestDestructionDate, ilmLatestDestructionDate) aspects into ILM Objects, Data Subjects, and their composed entities.
Support brownfield scenarios where existing fields are annotated with @PersonalData.FieldSemantics: 'BlockingDate' or @PersonalData.FieldSemantics: 'EndOfRetentionDate', skipping injection of the respective aspect fields.
Access Restrictions for Blocked Data
Restrict access to blocked data at the application layer (default) by injecting WHERE clauses into all CQN queries against ILM-relevant base entities, filtering out records where blockingDate is set and in the past.
Skip application-layer restrictions for privileged CAP users (_is_privileged), allowing internal service-to-service calls to access all data.
Support tableRestrictions: "db" configuration to strip HDI user schema SELECT privileges on ILM-relevant tables, enforcing restrictions at the database level.
Generate HANA Cloud Analytic Privileges (.hdbanalyticprivilege) for each view over ILM-relevant tables, restricting access based on the dppBlockingDate column.
Generate sap.ilm.RestrictBlockedDataAccess HANA role collecting all view-level analytic privileges and assigned to the default_access_role.
Generate sap.ilm.DPPNoRestrictions HANA role granting unrestricted access to all views for support scenarios.
Annotate HANA views with @sql.append: 'WITH STRUCTURED PRIVILEGE CHECK' for analytic privilege enforcement.
Set and clear SESSION_CONTEXT('ROLES') around database requests on HANA to enable role-based analytic privilege evaluation.
Auditor Access
Grant auditors access to blocked data by default via the Auditor role (XSUAA scope or Cloud Identity Service group).
Support entity-level auditor scope override via @Auditing.AuditorScopes: ['SCOPE_NAME'].
Support service-level default auditor scope via @Auditing.DefaultAuditorScopes: ['SCOPE_NAME'], with entity-level annotations taking precedence.
Include auditor scope checks in both HANA analytic privileges and application-layer restrictions.
Dynamic Data Subject Roles
Support dynamic data subject role assignment via @PersonalData.DataSubjectRole pointing to an enum property, allowing a single entity to represent multiple data subject roles (e.g., Customer, Employee, Debtor).
Validate that dynamic role paths resolve to enum properties and do not traverse to-many associations.
Dynamic ILM Object Enablement
Support @ILM.BlockingEnabled with static boolean values to enable or disable ILM Objects.
Support @ILM.BlockingEnabled with CQL expression strings (e.g., '(SELECT isEnabled FROM Configuration)') evaluated at runtime.
Conditions
Support condition fields on ILM Objects annotated with @PersonalData.FieldSemantics: 'PurposeID' or @ILM.FieldSemantics: 'ProcessOrganizationID' to narrow retention policies to subsets of data.
Expose conditions in the ILM object discovery response with descriptions, value help endpoints, and i18n keys.
Information Reporting (sap.dpp.InformationService)
Provide the sap.dpp.InformationService as an OData V4 service at /dpp/information, requiring the PersonalDataManagerUser role, to integrate with the SAP DPI Information Reporting module.
Automatically expose all entities annotated with @PersonalData.EntitySemantics and their compositions as read-only projections in the Information service.
Automatically generate @UI.LineItem annotations for exposed entities, ordering fields by keys, semantic keys, personal data, sensitive data, and remaining fields.
Automatically generate @UI.FieldGroup annotations for exposed entities if not already provided.
Extending Services
Allow manual extension of the sap.ilm.RetentionService to expose entities with custom projections, aliases, or computed fields from associations (e.g., exposing a DataControllerID from a navigation path).
Allow manual extension of the sap.dpp.InformationService for customized entity exposure.
Detect already-exposed entities and skip automatic exposure for them.
Multi-Tenancy
Register DPI service instances as SaaS dependencies via cds.xt.SaasProvisioningService or cds.xt.SmsProvisioningService for tenant subscription flows.
Miscellaneous
applicationName configurable via cds.env.requires['sap.ilm.RetentionService'].applicationName. By default using the name from package.json.
Leverage CAP's built-in audit logging for all queries performed by the Retention Manager against the database.
tableRestrictions configurable via cds.env.requires['sap.ilm.RetentionService'].tableRestrictions with "srv" (default) or "db" options.
Data privacyData privacycapabilityDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.SAP only
@sap/cds@sap/cdspackageThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtime
“For tests, the `cds-test` Plugin is used to spin up the application. More information about `cds-test` can be found [here](https://cap.cloud.sap/docs/node.js/cds-test).” — cap-js/data-privacy — READMEchecked
Integration with SAP Data Privacy Integration, driven by the personal-data annotations already on the model — the annotation that marks a field is the one the service acts on.
