Data Protection Guidelines for SAP ERP 6.0 - DSAG

176 Pages·2011·1.87 MB·English

Data Protection Guidelines for SAP ERP 6.0
Deutschsprachige SAP® Anwendergruppe (German-Speaking SAP® User Group)
DSAG WORK GROUP DATA PROTECTION
EDITORIAL DEADLINE: JANUARY 1ST, 2011
Preface
The SAP ERP 6.0 Data Protection Guidelines manual has been written for data protection officials and others
who have the responsibility to install and configure SAP applications in SAP ERP systems. Essential steps
and points to consider are provided which assist in the implementation of SAP systems which are compliant
with current data protection legislation.
This manual is meant to be a “recommendation“, not an obligatory requirement or a standard. All
responsibility for type, extent and results of the implementation of data protection regulations remains thus
with the management of the responsible organization (enterprise/authority).
For the study of this manual basic knowledge of SAP systems, familiarity with commerce and tax
regulations1 , as well as with the German Federal Law for Data Protection (BDSG), are required. The manual
addresses questions which are already contained in the SAP Security Guidelines or in other test manuals of
the DSAG AK-Audit, particularly those questions related to data protection regulations. This version also
deals with some module specific issues, such as those found in HCM (Human Resources).
In SAP ERP the classical ABAP world (ABAP stack) has been supplemented by the JAVA world (JAVA stack).
This manual covers only the ABAP stack. The version for the JAVA stack is in the planning stage. SAP ERP
itself is sold as standard software for an international market. The data protection recommendations in this
manual are based on the European Union guideline 95/46/EG and the German Data Protection Act.
The authors are members of the DATA PROTECTION sub-group in the DSAG Audit Working Group and have
written this manual based on their combined experience.
© COPyRIGHT 2010 By THE AUTHORS:
Mr. T. Barthel † FORBIT GmbH / CArO GmbH, Hamburg
Mr. I. Carlberg BIT e.V., Bochum
Mr. V. Lehnert SAP Deutschland AG & Co.KG, Walldorf
Mr. H. Miller Geberit Deutschland GmbH, Pfullendorf
Mr. T. Müthlein DMC Datenschutz Management & Consulting
GmbH & Co.KG Frechen / GDD e.V. Bonn
Ms. A. Otto SAP Deutschland AG & Co.KG, Walldorf
Mr. S. Pieper Deloitte & Touche GmbH, Frankfurt
Mr. K. Redling SAP Deutschland AG & Co.KG, Walldorf
Mr. A. Reschke Rechtsanwaltskanzlei Reschke, Wiesbaden
Mr. P. Schiefer Bayer AG, Leverkusen
Mr. H.-J. Schwab SAP AG, Walldorf
Mr. G. Siebert Forba Partnerschaft, Berlin
Mr. G. Voogd FORBIT GmbH / CArO GmbH, Hamburg
1 For example, HGB, AO, GDPdU, GoB / GoBS
2
e
g
a
P
e. V.
G
A
S
D
CONTRIBUTORS TO THE 1ST AND/OR 2ND EDITION: ©
Mr. V. Ahrend Bosch Telecom GmbH, Frankfurt 11,
0
2
Mr. R. Anhorn Robert Bosch GmbH, Stuttgart Ry
Ms. C. Bonni Lausitzer Braunkohle AG, Senftenberg UA
N
Mr. W. Kilian RWE Energie Aktiengesellschaft, Essen A
J
Mr. A. Lenz Rheinbraun AG, Köln 1.
0
Mr. S. Dierschke BASF AG-Zok, Ludwigshafen 6.0,
Mr. W. Geesmann KPMG Deutsche Treuhand-Gesellschaft, Düsseldorf RP
E
Mr. R. Glagow PWC Deutsche Revision AG, Düsseldorf P
A
Mr. F. Glaß PWC Deutsche Revision AG, Düsseldorf R S
Mr. T. Glauch KPMG Deutsche Treuhand-Gesellschaft, Düsseldorf FO
S
Mr. J. Heck Brau und Brunnen AG, Dortmund E
N
Mr. G. Hohnhorst KPMG Deutsche Treuhand-Gesellschaft, Düsseldorf LI
E
D
Mr. W. Hornberger SAP AG, Walldorf UI
G
Mr. A. Kirk Ruhrgas AG, Essen N
O
Mr. K. Lorenz Deutsche Bausparkasse Badenia AG, Karlsruhe TI
C
Mr. Dr. Pötschat BASF AG, Ludwigshafen TE
O
Mr. E. Schmidt Philip Morris GmbH, München PR
Mr. A. von der Stein RWE Systems AG, Dortmund ATA
Mr. U. Ueberschar Mannesmann Arcor AG & Co., Eschborn / Köln D
Ms. G. Zibulski SAP AG, Walldorf
The authors carry the responsibility for the contents of this document. The editorial work and layout are
provided by SAP-AG and DSAG.
DISCLAIMER:
This publication is protected by copyright. All rights, unless expressly marked otherwise, are owned by:
Deutschsprachige SAP-Anwendergruppe e. V. (German-Speaking SAP User Group)
Altrottstraße 34a
69190 Walldorf
Germany
No unauthorised use whatsoever is permitted. This applies in particular for duplication,
distribution, translation or use in electronic systems/digital media.
e 3
g
a
P
To: Fax: [phone]
Data Protection Working Group
DSAG-Geschäftsstelle
Altrottstr. 34a
69190 Walldorf
Germany
E-Mail: [email protected]
SENDER
Name
Position
Department
Company
Address
Telephone Fax
READER CONTRIBUTION/SUGGESTIONS FOR THE SAP ERP DATA PROTECTION
GUIDELINES
My contribution/suggestion relates to the following topic(s)
( ) Critical tables/Customizing, Settings
( ) Critical objects
( ) Critical SAP facts
( ) Examples for concrete implementation measures and testing methods
( ) Other
I AM REFERRING TO...
SAP ERP Data Protection Guidelines, Chapter:............................................................................................................
SAP ERP, Release:...........................................................................................................................................................
My CONTRIBUTION/SUGGESTION:
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
............................................................................................................................................................................................
I AM PROVIDING ADDITIONAL INFORMATION IN AN ATTACHMENT (PLEASE CHECK
yES OR NO):
( ) yes
( ) No
4
e
g
a
P
Table of Contents e. V.
G
A
S
D
1 INTRODUCTION: DATA PRIVACy AND SAP ERP 10 ©
1.1 BDSG Requirements for SAP ERP 10 11,
0
2
1.1.1 Collection, processing or use of personal data 10 Ry
1.1.2 Transfer of personal data 11 UA
N
1.1.3 Retrieval procedures 11 A
J
1.1.4 Special appropriation 11 1.
0
1.1.5 Processing by contractors (service providers) 11 6.0,
1.1.6 Notification of the data subject 12 RP
E
1.1.7 Rights of the data subject 12 P
A
1.1.8 Public demand for information 12 R S
1.1.9 Obligation to notify authorities 12 FO
S
1.1.10 Obligation to report loss of data 13 E
N
1.1.11 Data processing employees and confidentiality 13 LI
E
D
1.1.12 Training 13 UI
G
1.1.13 Data protection measures 13 N
O
1.1.14 Overview of BDSG sections 4e, 4g and 18 (§2) 13 TI
C
1.1.15 Prior checking of the processing procedures 14 TE
O
1.2 Role of the data protection officer in the implementation of SAP ERP 15 PR
1.2.1 Data protection officer – member of the SAP project team 15 ATA
1.2.2 The data protection officer and project milestones 15 D
1.2.3 Information sources for the data protection officer 16
1.3 SAP Facts 16
1.3.1 Customizing and ASAP - Procedure Models 16
1.3.2 Authorization concept 18
1.3.3 Change Transport System / Change Transport Organizer (CTS / CTO) 19
1.3.4 Interface processing 19
1.3.4.1 Data transfer 19
1.3.4.2 PC Processing 20
1.3.4.3 Communication interfaces 20
1.3.4.4 SAP Automation 20
1.3.5 Job request procedure and job documentation 20
1.4 Risks 21
1.4.1 Absence of the data protection officer and/or the employee representative 21
1.4.2 Non-compliance with SAP recommendations 21
1.4.3 Omission or late implementation of the authorization concept 21
1.4.4 Improper use of data processing programs 22
1.5 Audit checklist for data protection implementation compliance 22
2 RESPONSIBILITIES OF THE DATA PROTECTION OFFICER 24
2.1 Monitoring the legal usage of data processing applications 25
2.1.1 Inclusion of the DPO in program development and system adjustments 26
2.1.2 Checking the legality of data acquisition and data use 26
2.1.3 Evaluation of logging 26
2.1.4 Examination of the procedure documentation 26
2.1.5 Issues related to the definition and auditing of the authorization concept 27
2.1.6 DPO Role in defining the operations concept and organization 28
2.1.7 Development of a data protection guide for users (Privacy Statement) 29
e 5
g
a
P
Table of Contents
2.1.8 Monitoring of the Change & Transport System in SAP ERP 30
2.1.9 Routine and random checks of system operations 30
2.2 Special training for employees who work with personal data (§§ 4G and 5 BDSG) 30
2.2.1 Employee subgroups with data privacy obligations 30
2.2.2 Contents of the data privacy training for users 31
2.2.3 User training in the SAP system 31
2.2.3.1 User training for infotypes “COMPANy INSTRUCTIONS“ or “QUALIFICATIONS” 31
2.2.3.2 User training for “TRAINING AND EVENT MANAGEMENT“ 32
2.3 Management of the data protection documentation (BDSG Sections 4G-2, 18-2) 32
2.3.1 Information for the controller 36
2.3.2 Purposes of the data acquisition, processing or usage 36
2.3.3 Description of the data subject groups and relevant data or data categories 37
2.3.4 Recipients or categories of recipients 39
2.3.5 Deletion regulations 40
2.3.6 Planned transmission to third countries 47
2.3.7 Measures for the guarantee of security 48
2.3.8 Access authorized persons 48
2.3.9 Example registration form 49
2.4 System support 51
2.4.1 Evaluation of personal data in tables and fields 52
2.4.2 Techniques for finding personal data 54
2.4.3 Audit of the access authorizations 56
3 RIGHTS OF THE DATA SUBJECT AND OF THE GENERAL PUBLIC 58
3.1 Notification and information 58
3.1.1 Legal requirements 58
3.1.2 SAP Facts 59
3.1.3 Requirements for the organization of data protection 59
3.2 Correction, deletion and locking 61
3.2.1 Legal requirements 61
3.2.2 SAP Facts 62
3.2.3 Organizational requirements related to data protection 62
4 IMPLEMENTING THE REQUIREMENTS OF BDSG SECTION 9 AND ITS APPENDIX:
TECHNICAL AND ORGANIZATIONAL MEASURES 64
4.1 Requirements 64
4.1.1 Statutory Requirements in Article 9 of the German Federal Data Protection Act 64
4.1.2 SAP Solutions for Compliance with the Statutory Requirements 65
4.2 SAP Facts, Risks, and Measures 68
4.2.1 ABAP Facts; Risks and Measures 69
4.2.1.1 Identification and Authentication 69
4.2.1.1.1 SAP Facts 69
4.2.1.1.2 Risks and Measures to be taken 73
4.2.1.2 Standard Users 74
4.2.1.2.1 SAP* 74
4.2.1.2.2 SAPCPIC 74
4.2.1.2.3 DDIC 75
4.2.1.2.4 EarlyWatch 75
6
e
g
a
P
e. V.
G
A
S
D
4.2.1.2.5 Batch User 75 ©
4.2.1.2.6 Risks and Measures to be taken 75 11,
0
2
4.2.1.3 User Authorization Concept: Selected Authorization Objects 76 Ry
4.2.1.3.1 Authorization Objects in the HCM 76 UA
N
4.2.1.3.2 Authorization Object P_ABAP 77 A
J
4.2.1.3.3 Authorization Object P_TCODE 77 1.
0
4.2.1.3.4 Authorization Object S_TCODE 78 6.0,
4.2.1.3.5 Table TSTCA 78 RP
E
4.2.1.3.6 Converting Reports to Transactions 78 P
A
4.2.1.3.7 Authorization Objects S_TABU_DIS, S_TABU_CLI and S_TABU_LIN 79 R S
4.2.1.3.8 Authorization Object S_TOOLS_EX 80 FO
S
4.2.1.3.9 Authorization Object S_SCD0 80 E
N
4.2.1.3.10 Objects for User and Authorization Maintenance (S_USER_xxx) 80 LI
E
D
4.2.1.3.11 Authorization Object S_GUI and XXL List Viewer 80 UI
G
4.2.1.3.12 Authorization Object S_SPO_DEV 81 N
O
4.2.1.3.13 Risks and Measures to be taken 81 TI
C
4.2.1.4 User Authorization Concept: Selected Profiles 82 TE
O
4.2.1.4.1 SAP_ALL Profile 82 PR
4.2.1.4.2 SAP_NEW Profile 82 ATA
4.2.1.4.3 P_BAS_ALL Profile 82 D
4.2.1.4.4 Other S_xxx Profiles 82
4.2.1.4.5 Roles with critical authorizations 83
4.2.1.4.6 Risks and Measures to be taken 83
4.2.1.5 Special Features of the Authorization Check 84
4.2.1.5.1 Deactivating and Modifying Authorization Checks 84
4.2.1.5.2 Authority Check for ABAP Programs
(Standard SAP programs or customer developed) 85
4.2.1.5.3 HR Authorization Switch (Table T77S0; GRPID “AUTSW”) 85
4.2.1.5.4 Report Authorization Groups 86
4.2.1.5.5 Risks and Measures to be taken 86
4.2.1.6 User Administration 87
4.2.1.6.1 Central User Administration Concept 87
4.2.1.6.2 Local User Administration Concept 88
4.2.1.6.3 User Administration with the Profile Generator 88
4.2.1.6.4 Out-of date User Administration with Profiles 88
4.2.1.6.5 Risks and Measures to be taken 88
4.2.1.7 Changes to the Production System 89
4.2.1.7.1 Change and Transport System 89
4.2.1.7.2 Table Logging / Customizing 90
4.2.1.7.3 System Change Option 90
4.2.1.7.4 Logs 91
4.2.1.7.5 Protecting Table T000: Clients 91
4.2.1.7.6 Risks and Measures to be taken 91
4.2.1.8 System Interfaces 91
4.2.1.8.1 Batch Input 92
4.2.1.8.2 RFC, ALE, BAPI 92
4.2.1.8.3 PC Download 92
e 7
g
a
P
Table of Contents
4.2.1.8.4 ABAP List Viewer (ALV) 92
4.2.1.8.5 Risks and Measures to be taken 93
4.2.1.9 Auditing and Logging 94
4.2.1.9.1 Security Audit Log 94
4.2.1.9.2 System Log 95
4.2.1.9.3 Transaction Logging STAD (CCMS) 96
4.2.1.9.4 Workflow Logging 96
4.2.1.9.5 Report Logging in HCM 96
4.2.1.9.6 Ad-hoc query logging related to “limited usage” 96
4.2.1.9.7 Risks and the Measures to be Taken 97
4.2.1.10 Complex Search Help 97
4.2.1.11 Summary of the Key Risks 98
4.3 Summary of the check procedures 99
5 ORDER DATA PROCESSING AND INTERNAL CORPORATE DATA EXCHANGE 102
5.1 Restrictions on outsourcing and data protection 102
5.2 Drafting of contracts between service providers and customers 104
5.2.1 Obligations of customers and service providers 104
5.2.2 Scope of the data processing/instructions 105
5.2.3 Technical and organizational measures 107
5.2.4 Protecting the rights of the data subject 108
5.2.5 Duties of the contractor described in BDSG, Section 11-4 (required inspections) 108
5.2.6 Compliance checks performed by the customer 109
5.2.7 Sub-contractors 110
5.2.8 Service-provider violations which must be reported 110
5.2.9 Return of data media after processing 111
5.2.10 Processing abroad 111
5.2.11 Maintenance and Servicing 112
5.3 SAP Facts 113
5.3.1 Initial/Starting Situation 113
5.3.2 SAP Administration 114
5.3.3 SAP Specific Measures 115
5.3.3.1 System Administration 115
5.3.3.2 Change and Transport Organizer (CTO / CTS) 115
5.3.3.3 Remote Maintenance und Services 116
5.3.3.4 RFC and ALE 116
5.3.3.5 Job Handling 116
5.3.3.6 PC-Download 117
5.3.3.7 Database and LAN Environment 117
5.3.3.8 Cross-client functions 117
5.3.3.9 SAP Logs 117
5.4 Risks 118
6 SPECIAL TOPICS 120
6.1 Audit tools: Audit Information System and User Information System 120
6.1.1 Audit Information System (AIS) 120
6.1.2 User Information System (SUIM) 121
6.2 SOS-Report (Security Optimization Service) 122
8
e
g
a
P
e. V.
G
A
S
D
6.3 SAP GRC (Governance, Risk and Compliance) 123 ©
6.3.1 SAP GRC Access Control 124 11,
0
2
6.3.1.1 Risk Analysis and Remediation (previously “Compliance Calibrator”) 125 Ry
6.3.1.2 Enterprise Role Management (previously “Virsa Role Expert”) 125 UA
N
6.3.1.3 Superuser Privilege Management (previously “Virsa FireFighter for SAP”) 126 A
J
6.3.1.4 Compliant User Provisioning (previously “Virsa Access Enforcer”) 126 1.
0
6.3.2 SAP GRC Process Control 127 6.0,
P
7 SAP WEBSITES 128 ER
P
A
8 APPENDIX 130 S
R
8.1 Data Confidentiality Obligation – Form Letter 130 FO
S
8.2 Excerpt from the Federal Law for Data Protection 131 E
N
§ 5 Data Confidentiality 131 LI
E
D
§ 43 Administrative Offences 131 UI
G
§ 44 Criminal Offences 131 N
O
8.3 Handling Personal Data – Recommendations for Employees 132 TI
C
8.4 Software Application Registration Form – (processing personal data) 133 TE
O
8.5 Role of the Data Protection Officer in the ASAP Procedures Model 143 PR
8.6 Checklist of auditability requirements 154 ATA
8.6.1 Requirements for auditability 154 D
8.6.1.0 Is the JAVA stack active? 154
8.6.1.1 Hardware 154
8.6.1.2 Operating system and low-level software 155
8.6.1.3 Programming techniques 156
Testing programs and customizing settings 157
Program documentation 158
Release procedures 160
Application development 161
User service/system administration 161
Computer center operations 162
8.6.1.4 Additional check procedures 163
8.6.2 Check of special regulations which take precedence 163
User authorizations appendix 163
8.6.3 Additional check procedures 164
8.6.3.1 Item 1: Access control (Physical Access) 164
8.6.3.2 Item 2: Access control (System Access) 164
8.6.3.3 Item 3: Access control (Data Access) 167
8.6.3.4 Item 4: Transfer Control 169
8.6.3.5 Item 5: Input Control 171
8.6.3.6 Item 6: Order Control 172
8.6.3.7 Item 7: Availability Control 173
8.6.3.8 Item 8: Data usage restrictions 173
8.6.3.9 Miscellaneous checks 174
9
e
g
a
P
1 Introduction: Data privacy and SAP ERP
An SAP ERP2 installation specifically complies, in all its modules, with the requirements of the BDSG
(German Federal Data Protection Act – see Sections 1, 12, and 27) with regard to automated handling of
personal data by government organizations. This does not automatically apply to all data protection
regulations for the Federal Republic and its Laender (states). Additional data protection regulations enacted
by individual German Laender (states) are not referenced in this document.
This guide is appropriate for both public and private organizations.
Because SAP ERP has been designed as standard software for international business processes it can not
be assumed by customers that every individual data field available is “compliant” with the German data
protection regulations. Therefore, it is necessary that the (German) customer confirms that their SAP ERP
installation meets all requirements of the BDSG, as well as local data protection regulations if they exist.
Both the data protection officer (DPO) and the works council or employee representative are therefore to be
included in the project work. The responsibility for legally compliant implementation of SAP ERP lies with
the organization’s project manager.
Although the BDSG mirrors the requirements of the harmonized EU data protection rights, the local
exceptions and additions of the individual EU member countries and regions must be taken into consideration.
1.1 BDSG REQUIREMENTS FOR SAP ERP
The BDSG fundamentally prohibits the collection, processing, and use of personal data and only allows data
processing of personal data when specific conditions defined in the BDSG are met. In order to incorporate this
basic principle correctly in an SAP ERP installation, it is necessary to determine whether the BDSG
requirements, and other regulations, have been appropriately implemented. The same principles and
conditions apply to systems throughout their life-cycle.
1.1.1 COLLECTION, PROCESSING OR USE OF PERSONAL DATA
The collection, processing or use of personal data is expressly forbidden as described in section 4 of the
BDSG, unless:
> the BDSG allows and/or demands the processing, or
> a regulation with higher precedence allows and/or requires the processing, or
> written consent from the data subject exists.
The admissibility criteria for the collection, processing or use of personal data are derived from section 4
BDSG with reference to:
> sections13 and 14 BDSG for public bodies, and
> sections 28 through 32 BDSG for private and non-profit organizations.
The burden of proof for admissibility lies with the controller (controller).
The concepts of “data reduction” and “data economy” must be taken into account. These are defined in
section 3a BDSG. Their general objectives are “to collect and use as little personal data as possible.”
The implementation of the data reduction and data economy principles in SAP ERP must incorporate the
following points:
2 For the purposes of this document, the term “SAP ERP“ includes the ABAP component and SAP NetWeaver.
0
e 1
g
a
P