According to the GDPR Article 17 (Right to erasure or right to be forgotten) individuals have the right to have their collected personal data erased when the company no longer holds a legal reason to keep it. Deletion of personal data is one of the more challenging requirements to come out of GDPR and many companies are still not prepared to handle data deletion.

1. Webinar: GDPR – SAP
HR Data Deletion
w w w . 2 b m . c o m

2. Data Deletion
Why Deleting Data?
GDPR Article 17 – Right to erasure ('right to be forgotten')
According to the GDPR, individuals have the right to have personal
data erased the information, that are gathered about them.
The right is not absolute and only applies in certain circumstances.
When does the right to erasure apply?
When does the right to erasure not apply?
Individuals can make a request for erasure verbally or in writing.

3. Data Deletion
Personal data in SAP system and GDPR data categorization.
Regular Personal Data Sensitive Personal Data
Criminal Records
Name
License Plates
Social Security #Social Issues
Birth Date
Location Data
Gender
Address
Email
Unique Device IDPassport
Salary Credit Card
Order History
Ethnicity
Health Records
Sexuality
Political Beliefs
Union Membership
Religion
Genetic and Biometric
Information

4. Data Deletion
The deletion lifecycle.
Hiring Period Residence Period Retention Period
Deletion /
Destruction
Termination End of Purpose End of Retention
The period in which the
data is still needed for
business activities.
Process examples:
• Payroll slips
• Vacation calculation
• Bonus calculation
The period in which the data
is only accessible for audit.
E.g. Accounting
DK 5 years
SE 7 years
Access:
Project managers
Managers
Administrators FI/HR etc.
Access:
Administrators FI/HR etc.
Legal hold

5. Data Deletion
Retention ruleset linked to HR details.
Employee Groups Empl.
Group
Empl.
Subgroup
Personnel
Area
Personnel
Subarea
Retention Period Business Requirements
A – Employee / Regular X N/A N/A N/A Current year -5 years from
termination date
Work-related injury reported
before termination date –
Deletion deadline extended to 45
years.
B – Employee / Union
member
X XX XXX N/A Current year -6 years from
termination date
If legal deispute – Do not delete
until end of legal decisions.
C - External Consultants X XX XXX N/A Immediate at termination date If external consultant has a long-
term authority XX certification –
Deletion extended to required
industry standard.

6. Data Deletion
Overall SAP deletion methods.
AnonymizationDeletion programs
(RPUDELPP / 2BM Employee Deletion)
SAP ILM

7. Data Deletion
ILM vs. Deletion programs.
SAP System Version Partial Deletion
Deletion Programs All No
SAP ILM New Yes

8. HR Data Deletion
2BM’s experiences from customer SAP GDPR projects.
• All customers want to implement deletion with the lowest cost as possible.
• Most customers have a risk-based approach.
• Deleting data is a new mindset, which takes time to understand the implications.
• When the deletion has to be performed on the production system, can new test requirements
come up, as insecurity arises around if the test was adequate.
• There are many complex residence/retention rules which can prolong the discussions.
• In most cases are accounting law (5-10 years depending on country) the general
residence/retention rule.

9. Data Deletion
SAP standard deletion program RPUDELPP.
Functionality
The program runs in 2 steps.
1. Request Deletion
2. Perform Destruction
Own developed tables are not deleted as standard
Can be extended by Business Add Ins (BADIs)
Runs 1 employee deletion at a Time
Can be extended by LSMW to delete a set of employees
In some cases - needs for manual deletion or z-programming
Process
1. List of all employees to be deleted
2. List of all Z tables that are deleted by RPUDELPP – Manuel deletion or BADIs
3. Start deleting Employees

10. SUBJECT
ACCESS REPORT
EMPLOYEE
DELETION
SECURITY
ANALYZER
DATA
DISCOVERY
2BM GDPR Suite

11. 2BM Employee Deletion Tool
All relevant data needs to be deleted.

12. CONTACT
Troels Lindgaard
Compliance Principal
tli@2bm.com
+45 53635787
Thomas Bladh
Compliance Principal
tbl@2bm.com
+46 (0) 705504913
Donnie Mark Lund
Compliance Principal
dml@2bm.com
+45 41108909
www.2bm.com
info@2bm.com
2BM A/S
Livjægergade 17
2100 København Ø
2BM Aarhus
Åbogade 15
8200 AarhusN
2BM Malmø
Jungmansgatan 12
211 19 Malmö
Stefan Sønderup
Compliance Principal
sas@2bm.com
+45 51407958
https://2bm.com/2bm-gdpr-suite/
Sarmad Reda
Compliance Principal
sar@2bm.com
+45 52195118