DEEPSCAN - GDPR

What is GDPR?

The General Data Protection Regulation (GDPR) is a regulation approved by the EU Parliament on 14th April 2016. Any organization that works with EU residents’ personal data, irrespective of the organization’s location, must meet these obligations.

What is Personal Data?

Any information relating to an identified or identifiable natural person (‘data subject’) - GDPR Article 4. The person can be identified either directly or indirectly by identifiers such as Name, Social Security Number (SSN), Email Address, Location, Bank Details, etc.

Where can we find Personal Data in SAP?

What happens if a company or organization is not GDPR compliant?

There are two tiers of administrative fines that can be levied as penalties for non-compliance:

• Up to €10 million, or 2% annual global turnover - whichever is higher.
• Up to €20 million, or 4% annual global turnover - whichever is higher.

How can a company or organization be GDPR compliant?

1. With help of ABAP Dictionary Tables

1. DD04T – Identify the relevant data elements for each GDPR attribute based on the description or text
2. DD03L - Identify the fieldnames based on the data elements
3. DD02L – Identify relevant tables based on the fieldnames and data elements
   (Note – Only transparent tables and fieldnames of CHAR Data type are considered)

2. Using the below keywords, initial set of data elements has been filtered from the total of 4+ Million data elements in DD04T For Name & User Id -

"user, first, last, display, person, business, legal, second, associate, birth, middle, surname, full, family, forename, employee, sponsor, dependent, maternal, father, mother, child, paternal, enterer, signer, translator, physician, format, consult, provident, pension, supervisor, doctor, initiator, Author, representative, lawyer, writer, reporter, responsible, inspector, name1, name2, name3, by, witness, creator, delete, account, patient, examiner, injured, personnel, doctor, liable, bank,
physician, recipient, beneficiary, payee, payer, passenger, nickname, initials, short name, authorized, authorized, contact, participant, full, partner, Business Partner, creditor, debtor, third party, 3rd, party, 3, auditor, instructor, tenant, grantee, guardian, guarantor, vendor, supplier, consumer, producer, customer, owner, who, chief, manager, sender, receiver, signed, signature, correspondence, participant, insured, child, payer, payee, driver, member, contact, applicant, spouse, wife, parents, sender, receiver, title, trustee"

3. For Email Address -

"Mail"
For SSN - "Employee Identification Number (EIN), identification, pin, number, SSN, social, security, customer number, personnel number, personal id, account number, Personnel no. Pers.no., tax number"
Using the below queries, the data elements are searched for each keyword.

SELECT
ROLLNAME, DDTEXT, REPTEXT, SCRTEXT_L, SCRTEXT_M, SCRTEXT_S
FROM DD04T WHERE DDLANGUAGE = 'E' AND
(UPPER(DDTEXT) LIKE '%NAME%' OR UPPER(REPTEXT) LIKE '%NAME%' OR UPPER(SCRTEXT_S) LIKE '%NAME%'
OR UPPER(SCRTEXT_M) LIKE '%NAME%' OR UPPER(SCRTEXT_L) LIKE '%NAME%')

3. The data elements are further filtered out by going through the description/text, data type and length one by one and only relevant data elements is considered.
4. From the final list of data elements, only the relevant fieldname and tables are considered.

SELECT TABNAME, FIELDNAME, ROLLNAME, DOMNAME, DATATYPE, LENG
FROM DD03L WHERE TABNAME IN (
SELECT DISTINCT TABNAME FROM DD02L WHERE TAB class = 'TRANSP') AND DATATYPE = 'CHAR' AND
ROLLNAME IN (LIST OF DATA ELEMENTS FILTERD OUT USING THE ABOVE KEYWORDS))