{"ref":"capability:data-privacy","page":"/capabilities/data-privacy","json":"/capabilities/data-privacy.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"data-privacy","name":"Data privacy","domain":"security-and-compliance","ecosystems":["cap","abap","btp"],"universal":false,"description":"Doing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.","short":"Handling personal data the way the law requires","core_coverage":{"state":"core-only","assessed_at":"2026-09-27","what_core_does":"An official plugin integrates SAP Data Privacy Integration, driven by personal-data annotations on the model, so the annotations that mark a field are the same ones the service acts on. The @PersonalData annotations on entities and elements are the one input: audit logging, personal data management and retention are automated from them. For [SAP Personal Data Manager](artifact:btp-personal-data-manager) the application exposes the OData endpoint the service reads, flat projections on the annotated entities with the search fields marked and access restricted, and the service is available to enterprise accounts only.","where_it_stops":"At the DPI service. It presumes that service, and it does not answer retention for anything the annotations do not cover. capire's own overview says SAP gives no advice on whether these features are the best method for a given regulation; that judgement stays with the project.","sources":[{"url":"https://cap.cloud.sap/docs/plugins/","title":"CAP Plugins — Data Privacy","checked":"2026-09-08","quote":"Provides integration with SAP Data Privacy Integration (DPI) service based on personal data annotations"},{"url":"https://cap.cloud.sap/docs/guides/security/dpp-annotations","title":"Annotating Personal Data — capire","checked":"2026-09-27","quote":"In order to automate audit logging, personal data management, and data retention management as much as possible, the first and frequently only task to do as an application developer is to identify entities and elements (potentially) holding personal data using @PersonalData annotations."},{"url":"https://cap.cloud.sap/docs/guides/security/data-privacy","title":"Data Privacy Overview — capire","checked":"2026-09-27","quote":"This guide discusses how CAP helps applications to comply with data privacy regulations imposed by various laws and standards."},{"url":"https://cap.cloud.sap/docs/guides/security/data-privacy","title":"Data Privacy Overview — capire","checked":"2026-09-27","quote":"SAP does not give any advice on whether the features and functions provided to facilitate meeting data privacy obligations are the best method to support company, industry, regional, or country/region-specific requirements."},{"url":"https://cap.cloud.sap/docs/guides/security/dpp-pdm","title":"Personal Data Management — capire","checked":"2026-09-27","quote":"To answer this question, the PDM service needs to fetch all personal data using an OData endpoint. That endpoint has to be provided by the application as follows."},{"url":"https://cap.cloud.sap/docs/guides/security/dpp-pdm","title":"Personal Data Management — capire","checked":"2026-09-27","quote":"The SAP Personal Data Manager service is currently only available for enterprise accounts."},{"url":"https://cap.cloud.sap/docs/guides/security/#data-protection-vs-data-privacy","title":"CAP Security and Data Privacy — capire","checked":"2026-09-27","quote":"A legal concept / human rights."},{"url":"https://cap.cloud.sap/docs/guides/security/#data-protection-vs-data-privacy","title":"CAP Security and Data Privacy — capire","checked":"2026-09-27","quote":"Security, data protection and data privacy are critical aspects of modern application development, with significant legal and ethical implications."}]},"history":[{"date":"2026-08-31","field":"core_coverage.state","from":"core","to":"core-only","reason":"States renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately."},{"date":"2026-09-14","field":"ecosystems","from":"cap","to":"cap, abap","reason":"Widened to ABAP: vlutsas/DST anonymises PII and PHI irreversibly in non-production SAP systems, from a template the user maintains."},{"date":"2026-09-15","field":"ecosystems","from":"cap, abap","to":"cap, abap, btp","reason":"Widened rather than forked: answering a data subject and deleting personal data at end of purpose is the same concern on BTP. Done so [SAP Data Privacy Integration](artifact:btp-data-privacy-integration), [SAP Personal Data Manager](artifact:btp-personal-data-manager) and [SAP Data Retention Manager](artifact:btp-data-retention-manager), staged in intake-20260915-btp-services, can provide it."},{"date":"2026-09-15","field":"coverage_by_ecosystem.btp","from":null,"to":"core-only","reason":"All three providers behind the BTP door are SAP's own. Assessed on the day the Personal Data Manager notice names for its removal from the Eligible Cloud Services list, a day before Data Retention Manager's, so the coverage states both notices and the Data Privacy Integration Enterprise plan they name."},{"date":"2026-09-15","field":"framing_by_ecosystem.btp","from":null,"to":"a platform service an application calls","reason":"On BTP the concern is a set of APIs and apps an application connects to, which differs from the CAP framing of annotations on a model and the ABAP framing of anonymising non-production copies."},{"date":"2026-09-27","field":"core_coverage","from":"without the page","to":"cites the page","reason":"capire audit 2026-09-27: a page this capability owns was cited nowhere."},{"date":"2026-09-27","field":"core_coverage","from":"without the page","to":"cites the page","reason":"capire audit 2026-09-27, link-only pass: the Data Privacy Overview and Personal Data Management pages were cited nowhere; the overview carries SAP's disclaimer, which belongs in where it stops."},{"date":"2026-09-27","field":"core_coverage.sources","from":"without the security index","to":"cites its data protection versus data privacy table","reason":"capire audit 2026-09-27, judgement pages read a fifth time: the description says data privacy is doing what the law requires, and the security index's table calls data privacy a legal concept and data protection a suite of security measures; the row is quotable as written."}],"coverage_by_ecosystem":{"abap":{"state":"core-and-community","assessed_at":"2026-09-14","what_core_does":"SAP Test Data Migration Server scrambles confidential data so that it is anonymous in a non-production system, either in one system on its own or while data is transferred to another.","where_it_stops":"At test data. Scrambling makes a non-production copy anonymous; it does not mark which fields in production are personal or answer a data subject's request about them.","note":"SAP Information Lifecycle Management, which blocks and deletes personal data in production, is not covered here: no page describing it could be retrieved, so what_core_does is limited to scrambling.","sources":[{"url":"https://help.sap.com/doc/saphelp_tdm40/4.0.11/en-US/29/8968dd11174a8fa3673d9fc142b992/content.htm?no_cache=true","title":"SAP Help — Data Scrambling (SAP TDMS)","checked":"2026-09-14","quote":"Data scrambling in SAP TDMS is designed to protect confidential and sensitive data from unauthorized users by making the data anonymous in the non-production system."}],"relationship":"unassessed"},"btp":{"state":"core-only","assessed_at":"2026-09-15","what_core_does":"SAP ships data privacy on BTP as services an application consumes: [SAP Data Privacy Integration](artifact:btp-data-privacy-integration) keeps retention rules and triggers deletion at end of purpose, reports the personal data stored with export, correction and deletion, and anonymises free text, text files and images. [SAP Personal Data Manager](artifact:btp-personal-data-manager) and [SAP Data Retention Manager](artifact:btp-data-retention-manager) are each \"scheduled to be removed from the list of Eligible Cloud Services\", as of September 15, 2026 and September 16, 2026, and their notices name the SAP Data Privacy Integration Enterprise service plan instead, which now includes their features.","where_it_stops":"At the applications that consume it: SAP Data Privacy Integration's privacy functions are a set of APIs, which applications call to support their customers' GDPR/DPP compliance.","sources":[{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/d7c9e7ba-8d88-4ad7-a25c-e86a0aeb9b23","title":"SAP Discovery Center — SAP Data Privacy Integration","checked":"2026-09-15","quote":"The service can be consumed by applications to leverage some of the key data privacy features. Through its interface, the service provides a set of APIs which can be consumed to support the GDPR/DPP compliance of customers."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/d7c9e7ba-8d88-4ad7-a25c-e86a0aeb9b23","title":"SAP Discovery Center — SAP Data Privacy Integration","checked":"2026-09-15","quote":"Maintain rules and trigger deletion of data that have reached the end of purpose."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/d7c9e7ba-8d88-4ad7-a25c-e86a0aeb9b23","title":"SAP Discovery Center — SAP Data Privacy Integration","checked":"2026-09-15","quote":"Generate reports showing the personal data stored. Provides export capability and the ability to trigger correction and deletion of the data."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/d7c9e7ba-8d88-4ad7-a25c-e86a0aeb9b23","title":"SAP Discovery Center — SAP Data Privacy Integration","checked":"2026-09-15","quote":"Anonymization and pseudonymization of unstructured data for free text, text files, and images."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/136d6ce9-8742-44a4-9b4c-c8250c307cdf","title":"SAP Discovery Center — SAP Personal Data Manager","checked":"2026-09-15","quote":"This service is scheduled to be removed from the list of Eligible Cloud Services as of September 15, 2026. It will be available until the end of the current subscription term. It will not be available for renewal terms that begin after the removal date."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/136d6ce9-8742-44a4-9b4c-c8250c307cdf","title":"SAP Discovery Center — SAP Personal Data Manager","checked":"2026-09-15","quote":"You can use SAP Data Privacy Integration \"enterprise\" service plan instead, which now includes the features of SAP Personal Data Manager."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/f8818c3d-deb4-4a52-8d3f-a7d863d9c9c6","title":"SAP Discovery Center — SAP Data Retention Manager","checked":"2026-09-15","quote":"This service is scheduled to be removed from the list of Eligible Cloud Services as of September 16, 2026. It will be available until the end of the current subscription term. It will not be available for renewal terms that begin after the removal date."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/f8818c3d-deb4-4a52-8d3f-a7d863d9c9c6","title":"SAP Discovery Center — SAP Data Retention Manager","checked":"2026-09-15","quote":"You can use SAP Data Privacy Integration \"Enterprise\" service plan instead, which now includes the features of SAP Data Retention Manager."}]}},"framing_by_ecosystem":{"abap":{"description":"On an ABAP system part of this concern sits in non-production systems that hold real personal data, such as contact names, personal email addresses and bank account details, which have to be made irreversibly anonymous before anyone works with them."},"btp":{"description":"On BTP data privacy is a platform service an application calls: [SAP Data Privacy Integration](artifact:btp-data-privacy-integration) holds the retention rules, reports a data subject's personal data and anonymises unstructured data, and its Enterprise plan now includes the features of [SAP Personal Data Manager](artifact:btp-personal-data-manager) and [SAP Data Retention Manager](artifact:btp-data-retention-manager)."}},"drafted_with_ai":true},"sap_delivery":{"door":"cap","all":{"built_in":[],"documented_pattern":[],"announced":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json","note":"A documentation page exists and says under construction or planned. Nothing to install."}],"packages":[{"ref":"artifact:cap-js-data-privacy","name":"@cap-js/data-privacy","json":"/artifacts/cap-js-data-privacy.json"}]},"by_flavor":{"node":{"built_in":[],"documented_pattern":[],"announced":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json","note":"A documentation page exists and says under construction or planned. Nothing to install."}],"packages":[{"ref":"artifact:cap-js-data-privacy","name":"@cap-js/data-privacy","json":"/artifacts/cap-js-data-privacy.json"}]},"java":null}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:cap-js-data-privacy","name":"@cap-js/data-privacy","json":"/artifacts/cap-js-data-privacy.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:vlutsas-dst","name":"DST","json":"/artifacts/vlutsas-dst.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:btp-customer-identity-and-access-management","name":"SAP Customer Identity and Access Management for B2C","json":"/artifacts/btp-customer-identity-and-access-management.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-data-privacy-integration","name":"SAP Data Privacy Integration","json":"/artifacts/btp-data-privacy-integration.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-data-retention-manager","name":"SAP Data Retention Manager","json":"/artifacts/btp-data-retention-manager.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-personal-data-manager","name":"SAP Personal Data Manager","json":"/artifacts/btp-personal-data-manager.json","ecosystem":"btp","origin_ring":"sap-official"}],"samples":[],"explained_by":[{"ref":"content:sap-cloud-integration-ci-cpi-reusable-script-collection-pattern-for-sensitive-da","name":"SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data Masking","json":"/content/sap-cloud-integration-ci-cpi-reusable-script-collection-pattern-for-sensitive-da.json"},{"ref":"content:what-happens-to-your-data-when-you-enable-sap-s-ai-features","name":"What Happens to Your Data When You Enable SAP's AI Features?","json":"/content/what-happens-to-your-data-when-you-enable-sap-s-ai-features.json"},{"ref":"content:elevating-data-privacy-in-cap-genai-applications-with-cap-llm-plugin","name":"Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM Plugin","json":"/content/elevating-data-privacy-in-cap-genai-applications-with-cap-llm-plugin.json"},{"ref":"content:sapcap-win-customer-trust-using-data-privacy-and-protection-services-on-btp-part-2","name":"#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3","json":"/content/sapcap-win-customer-trust-using-data-privacy-and-protection-services-on-btp-part-2.json"},{"ref":"content:sapcap-win-customer-trust-using-data-privacy-and-protection-services-on-btp-part-3","name":"#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1","json":"/content/sapcap-win-customer-trust-using-data-privacy-and-protection-services-on-btp-part-3.json"},{"ref":"content:sapcap-win-customer-trust-using-data-privacy-and-protection-services-on-btp-part","name":"#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2","json":"/content/sapcap-win-customer-trust-using-data-privacy-and-protection-services-on-btp-part.json"}],"normative_context":[]}}