LGPD and SAP: How to apply Brazil’s data privacy law

Author: Thierry Julien, CEO of TJC Group

SAP systems can hold years of personal information across customers, suppliers, employees and transactional records. Protecting that information is only one part of complying with Brazil’s data privacy law, Lei Geral de Proteção de Dados Pessoais (LGPD)

Introduction

Organisations also need to understand why personal data is being retained, how long it should remain available, when another legal requirement prevents its destruction, and what happens once there is no longer a valid reason to keep it. That is where Brazil’s LGPD becomes an SAP data-lifecycle issue.

The LGPD establishes rules for processing personal data and gives individuals rights over how their information is collected, used, retained and shared. Its main provisions came into force in September 2020, with administrative sanctions becoming applicable in 2021.

For SAP customers, meeting those requirements involves more than publishing a privacy policy. Retention, legal holds, destruction and anonymisation need to become controlled processes across live and archived information.

Key takeaways

• LGPD is Brazil’s comprehensive personal-data protection law and can apply to organisations outside Brazil in certain circumstances.
• SAP environments can contain personal information across business-partner, employee, supplier, transactional and historical records.
• LGPD does not prescribe one universal retention period for every category of personal data.
• Organisations will have to balance deletion requirements with legal, regulatory and business obligations that may justify continued retention.
• Anonymisation and deletion are different lifecycle outcomes.
• SAP Information Lifecycle Management provides capabilities for retention rules, legal holds and controlled destruction.
• TJC Group’s Archiving Sessions Cockpit (ASC) can help automate SAP-standard archiving and destruction processes.

What is Brazil’s LGPD?

The Lei Geral de Proteção de Dados Pessoais, or LGPD, is Brazil’s general data protection law. It regulates the processing of personal data by public and private organisations and establishes rights for individuals whose information is being processed.

LGPD shares several principles with the EU GDPR, but the two regulations should not be treated as identical. Brazil has its own legal bases, terminology, territorial rules and enforcement framework.

The Agência Nacional de Proteção de Dados (ANPD) is the Brazilian authority responsible for regulating, interpreting and supervising compliance with the LGPD.

Who does LGPD apply to?

LGPD is not limited to organisations headquartered in Brazil. It can apply when personal-data processing takes place in Brazil, when processing relates to individuals located in Brazil, or when the personal data was collected in Brazilian territory. For multinational businesses, this means a central SAP environment operated outside Brazil may still contain information that falls within the scope of LGPD.

Legal bases and individual rights

LGPD provides several legal bases for processing personal data. These include consent, compliance with legal or regulatory obligations, contractual requirements and legitimate interests where the conditions of the law are met.

The applicable legal basis influences why an organisation may process information and how long that processing remains justified. Individuals also have rights relating to their personal data, including access, correction and, in relevant circumstances, anonymisation, blocking or deletion.

These requirements make lifecycle management particularly important. An organisation needs to understand not only where personal data sits in SAP, but also why it remains there.

What are the penalties for non-compliance?

LGPD gives the Brazilian authorities a range of enforcement measures:

• Financial penalties can reach 2% of relevant revenue in Brazil, subject to a maximum of R$50 million per infringement.
• Other sanctions can include warnings, public disclosure of an infringement, blocking or deletion of affected personal data and restrictions on processing activities.

The potential impact therefore extends beyond a financial penalty. Poor data-management practices can also create operational disruption and reputational risk.

Other organisations have previously been fined in other countries, as they were found to be breaching data privacy laws. TJC Group wrote about these challenges in the article how SAP users can minimise non-compliance risk in SAP systems.

What LGPD means for data held in SAP systems

Personal data is widely spread across SAP systems. These are examples, to name a few:

• Customer and business partner records may contain names, addresses and contact details.
• HR applications can contain employee information.
• Supplier records, invoices, service transactions and historical documents may also include information associated with identifiable individuals.

The challenge is not simply finding that information. Organisations need to establish:

• why it is being retained;
• which legal or business requirements apply;
• how long those requirements remain valid;
• whether a legal hold prevents destruction; and
• what should happen when continued retention is no longer justified.

These questions must be answered across both active and historical SAP information.

TJC Group has explored similar lifecycle challenges in its guidance on reducing data privacy non-compliance risk in SAP systems. The regulatory requirements differ between jurisdictions, but the SAP challenge remains similar: legal policies need to become practical data-lifecycle controls.

TJC Group has covered the most important data privacy regulations in the world in a data privacy series, including EU GDPR, Law 25 in Quebec, CCPA in California, South Korea PIPA, APPI in Japan, Argentina’s PDPA and more. We are helping customers worldwide enforce compliance on SAP systems. Have a look at the Data Privacy Series to learn more.

Applying LGPD requirements across the SAP data lifecycle

Define appropriate retention periods

LGPD does not specify one universal period for retaining all personal data. The appropriate period depends on why the information is being processed and whether another legal, regulatory or contractual requirement requires it to remain available.

For an SAP environment, this means retention rules may vary according to the type of information, legal entity, business process and applicable legislation. An employee record, for example, may have a different lifecycle from a customer contact or personal information contained within an accounting document.

The objective is not to delete data as quickly as possible. It is to avoid keeping personal information indefinitely when there is no longer a valid reason to retain it.

Legal holds can override normal destruction

Reaching the end of a standard retention period does not always mean a record can immediately be destroyed. For example, some information may need to remain available because of litigation, an investigation, an audit or another legal requirement.

A legal hold prevents information relevant to such a matter from being destroyed while that obligation remains active.

The lifecycle therefore needs to account for both rules: the normal retention period determines when information becomes eligible for destruction, while a valid legal hold can prevent that destruction from taking place.

This becomes particularly important in large SAP environments where the same information may be subject to privacy, tax, audit and litigation requirements.

Destroy data when continued retention may no longer be justified

Once the applicable retention requirements have expired and no valid hold remains, personal information may become data you must remove from your system, through ILM destruction.

In SAP, the method depends partly on where the information sits. You may delete online and already archived data using SAP ILM. Both processes exist.

Archived information may be destroyed through controlled lifecycle processes once the relevant conditions have been met. If necessary, archive files will be split by destruction date.

When data to be deleted remains in the live database and when SAP provides the appropriate ILM-supported destruction object, it can be removed through a controlled destruction process rather than first being archived. Custom data may be deleted through custom ILM objects.

This is different from manually deleting database records. SAP data often has dependencies across business objects, documents and related information, so destruction needs to follow supported application processes in order to guarantee database integrity and business processes continuity.

TJC Group covers these scenarios in more detail in its guide to destroying SAP data and documents with different retention periods.

Anonymisation is different from deletion

Anonymisation provides another possible lifecycle outcome. Deletion removes information. That is, anonymised data cannot be displayed, but it remains available to some users. Deleted data is destroyed and no longer available to anyone.

Anonymisation should not, however, be treated as an automatic alternative to deletion. The appropriate approach depends on the purpose for keeping the information and the legal requirements that apply.

It also needs particular care in SAP. Changing identifying information in one location can affect relationships with transactions, documents and other business objects. Anonymisation, masking and pseudonymisation should therefore not be treated as interchangeable techniques. Beware that anonymisation may also breach S/4HANA clean code practices.

How SAP ILM supports data privacy controls

SAP Information Lifecycle Management provides a framework for applying lifecycle rules to SAP information. Rather than treating retention and destruction as isolated technical activities, SAP ILM allows organisations to manage information according to policies covering its lifecycle.

A simplified view looks like this:

The decision to retain or delete specific data is down to the responsible decision-makers within the organisation. Privacy, legal, tax and business stakeholders first need to establish the applicable policy. SAP ILM then provides mechanisms for applying those decisions.

For a broader explanation of the technology, TJC Group’s guide to SAP Information Lifecycle Management covers the main components and common misconceptions.

Automating SAP lifecycle management with ASC

Archiving and destruction are recurring operational activities. Large SAP environments can involve many archiving objects, organisational units, retention periods and scheduled runs. Managing all of these manually introduces additional work and increases the opportunity for configuration or execution errors.

TJC Group’s Archiving Sessions Cockpit (ASC) is designed to automate SAP data archiving and destruction processes. The ASC is based on SAP-standard ADK principles and works with established SAP archiving processes. The ASC ILM Edition extends its core archiving capabilities with data-destruction functionality.

Automation does not decide which data should be retained or destroyed. That decision still depends on the organisation’s legal and business requirements. Its role is to help execute those rules more consistently.

“Before GDPR came into operation, we never needed to delete data within SAP but now times have changed and there are specific situations where data deletion is necessary. We needed this process to be 100% accurate because of the risks of non-compliance and TJC Group’s service has been invaluable. Thanks to the ASC (Archiving Sessions Cockpit) software all the data dependencies could be managed and automated for the future.”

Rudolf Strauss, Commercial & Operations Division IT Manager for Dürr Group

Where manual lifecycle management creates risk

The complexity of SAP lifecycle management can make heavily manual processes difficult to operate consistently. For example, an incorrect selection variant may target the wrong information. Missing retention logic may allow information to be destroyed too early, while missed destruction runs can leave data in the system longer than intended.

Incomplete records of destruction can also create problems later if an organisation needs to demonstrate what information was removed, when the action occurred and which policy authorised it.

The Archiving Sessions Cockpit for ILM automates execution and reduces the risk of errors. Once configured to reflect all applicable ILM rules, it runs the process consistently without repeated manual intervention.

Benefits of a robust SAP information lifecycle strategy

A well-designed lifecycle strategy supports privacy compliance while improving the wider management of SAP information.

Keep information for a defined reason

Clear retention rules help organisations move away from keeping data indefinitely simply because storage is available.

Reduce unnecessary exposure

Personal information that no longer needs to remain in operational systems does not continue adding avoidable privacy and security exposure.

Balance different legal requirements

Privacy obligations do not exist in isolation. Tax, audit, contractual and litigation requirements may all affect when information can be destroyed. Retention policies and legal holds help those requirements coexist within the same lifecycle.

Improve auditability

Controlled lifecycle processes provide clearer evidence of how retention, holds and destruction have been applied.

Control unnecessary data growth

Removing information that has reached the end of its required lifecycle can also reduce unnecessary data volumes and the complexity associated with maintaining them.

How TJC Group supports SAP data privacy programmes

Applying LGPD requirements in SAP involves connecting privacy policy with SAP objects, retention rules, archive processes and destruction procedures.

TJC Group supports organisations with SAP data privacy and Information Lifecycle Management expertise, including senior SAP ILM consultants who can help translate retention requirements into SAP lifecycle processes. ASC provides an additional automation layer for recurring archiving and destruction activities.

“Your knowledge of the SAP ILM solution was invaluable to the success of the project. Your team’s willingness to step into the project after it had begun, make the necessary changes to the delivery timelines and your ability to work with the customer during the transition was one of the main reasons why the project stayed on track. Your structured approach and ability to manage the deliverables allowed us to finish the project with a high-quality solution. It was a pleasure working with you and I hope we can do it again in the future.”

VP of delivery – Global Software company, Canadian Banking Customer

Neither SAP ILM nor ASC makes an organisation automatically compliant with LGPD. Compliance depends on the organisation establishing the appropriate policies, legal bases and retention requirements. The role of the technology is to help turn those approved requirements into controlled and repeatable SAP processes.

TJC Group offers alternatives to costly, technically driven ILM projects that may involve over 100 archiving and ILM objects. Our business-led approach focuses on deleting customer, vendor and business partner data to reduce project scope and costs. It is supported by ASC Scenarios, which builds on ASC for ILM.

We also offer options for intermediate and definitive archives beyond standard ILM processes. These allow you to delete personal data while retaining other data for continued processing and analytics in SAP BDC or other solutions.

Conclusion

LGPD compliance in SAP extends beyond protecting personal information from unauthorised access. Organisations also need to understand why information is being retained, how long that reason remains valid, when another legal requirement prevents destruction and what should happen when the data reaches the end of its lifecycle.

That makes retention, legal holds, controlled destruction and anonymisation important parts of a wider SAP privacy strategy.

SAP ILM provides the lifecycle-management framework needed to apply those rules to supported SAP information. ASC can help automate the recurring archiving and destruction processes required to execute them consistently.

For multinational organisations, this becomes even more important because LGPD may operate alongside GDPR and other national privacy laws.

A governed information lifecycle gives organisations a more practical way to apply those requirements across complex SAP landscapes.

Data privacy series

This article is part of the data privacy series. The following articles relate to other data privacy laws around the world:

• Quebec’s Data Privacy Law 25: What is it and how to comply with it
• Decrypting the Digital Personal Data Protection (DPDP) Act, 2023
• GDPR in the EU | A comprehensive guide to knowing all about it
• Data protection law in Japan: a guide to understand APPI
• Data protection laws in Argentina
• The data privacy law of New Zealand
• All about South Korea data protection law (PIPA): Everything you need to know
• Data privacy law: Everything you need to know about Virginia’s CDPA
• Data privacy law: A-Z about the California Consumer Privacy Act, CCPA of 2020
• Understanding the NJDPA – New Jersey’s data privacy law in detail

Sources of information

Brazilian legal and regulatory sources

• Lei nº 13.709/2018: Lei Geral de Proteção de Dados Pessoais
• ANPD: LGPD frequently asked questions
• ANPD: Administrative sanctions under LGPD
• ANPD: Technical study on anonymisation under LGPD

SAP sources

• SAP Help: Information Lifecycle Management
• SAP Help: Retention management
• SAP Help: Data destruction in a live application system