Data privacy
Doing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.
Overview
@cap-js/data-privacy Integration with SAP Data Privacy Integration, driven by the personal-data annotations already on the model — the annotation that marks a field is the one the service acts on.
@sap/cds Data retention management, the third automation the personal-data annotations are meant to drive: the guide page exists and says it is under construction, and nothing is shipped to cite yet.
Not covered: At the DPI service. It presumes that service, and it does not answer retention for anything the annotations do not cover. capire's own overview says SAP gives no advice on whether these features are the best method for a given regulation; that judgement stays with the project.
No community artifact is documented here.
On an ABAP system part of this concern sits in non-production systems that hold real personal data, such as contact names, personal email addresses and bank account details, which have to be made irreversibly anonymous before anyone works with them.
SAP Test Data Migration Server scrambles confidential data so that it is anonymous in a non-production system, either in one system on its own or while data is transferred to another.
Not covered: At test data. Scrambling makes a non-production copy anonymous; it does not mark which fields in production are personal or answer a data subject's request about them.
SAP Information Lifecycle Management, which blocks and deletes personal data in production, is not covered here: no page describing it could be retrieved, so what_core_does is limited to scrambling.
On BTP data privacy is a platform service an application calls: SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp holds the retention rules, reports a data subject's personal data and anonymises unstructured data, and its Enterprise plan now includes the features of SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp and SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp.
SAP ships data privacy on BTP as services an application consumes: SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp keeps retention rules and triggers deletion at end of purpose, reports the personal data stored with export, correction and deletion, and anonymises free text, text files and images. SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp and SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp are each "scheduled to be removed from the list of Eligible Cloud Services", as of September 15, 2026 and September 16, 2026, and their notices name the SAP Data Privacy Integration Enterprise service plan instead, which now includes their features.
Not covered: At the applications that consume it: SAP Data Privacy Integration's privacy functions are a set of APIs, which applications call to support their customers' GDPR/DPP compliance.
No community artifact is documented here.
Artifacts
Content
Show 3 more
Details
Coverage
For your agent
- Ref
capability:data-privacy- JSON
- /capabilities/data-privacy.json
- MCP
- Connecting an agent