How to destruct data and documents with different retention periods in SAP ILM

In some cases, in an SAP ILM project different retention periods may apply for the data and documents stored in the SAP system. This article explains how to deal with different retention periods for the data and documents to be in accordance with the General Data Protection Regulation (GDPR).

Introduction

In an SAP ILM project, we usually think of data destruction, but we should also consider document destruction. In most countries, regulations on data retention and document retention are different, meaning that the law requires different retention periods for the data and documents stored in an EPR system. For e.g., you might have to keep the data for 10 years, but you might need to destroy a document in 5 years in the same archiving object.

How do you deal with this in an SAP system in compliance with GDPR rules? Well, it is possible to apply different retention periods for data and documents. In this article, we will look at several business cases with Q&A and finally share a practical example of the use of the BADI implementation approach where attachments are getting deleted along with the existing main object for one of our clients.

Business cases – Questions and answers

In the following lines, we show different business scenarios and how to solve them with SAP ILM.

1. Can data retention and document retention periods be different?

Yes, it is possible. For example, some organizations can be asked to keep a document such as an invoice for a longer period than the actual data for that invoice. The invoice data can be destroyed, while the invoice is kept for longer. In this case, the document and the data retention periods are different.
Such situations can be handled with the SAP ILM tool, although it is a challenging process that requires an experienced ILM consultant to do the job. At TJC Group we use the Archiving Session Cockpit (ASC), an SAP add-on, certified tool for SAP ECC and S/4HANA that performs ongoing data archiving and data deletion based on a range of variables. You can find out more here:

Similarly, the reverse case may apply where the data retention period may exceed that for document retention. In these situations, the attachments are deleted first before deleting the data that relates to the attachment.

2. When using ArchiveLink, how are documents deleted after the retention period is applied?

ArchiveLink is a service integrated in the SAP Web Application that serves as a connector to display an archive object in SAP system – either SAP S/4HANA, SAP ECC, SAP R3. SAP guarantees permanent access to the documents created in older versions of SAP systems through Archive Link.

There are two main ways documents are deleted:

1. When ILM files are destroyed, or
2. When ILM Data Destruction is carried out using ILM object. This option can be achieved through additional customization and BADI implementation.

3. Can the rules for data retention differ to those for document retention?

Yes, this is possible using ILM object AL_DOCUMENT and configuring it either by inheriting the retention period from a leading ILM object or by defining individual rules for each document type.

The detailed stages to follow are:

1. Step 1: Maintain policy for ILM Object AL_DOCUMENTS
2. Step 2: Set proxy for attachments using transaction ILM_AL_REF (if the same retention as the leading ILM object must be applied)
3. Step 3: Complete attachment destruction using transaction ILM_DESTRUCTION

4. How to destroy archived data with related attachments (e.g. documents)?

In order to destroy the archive files where the retention period is over, we can execute the tcode “ILM_DESTRUCTION” to destroy the expired archive files and related attachment documents.

A. Transaction code – ILM_DESTRUCTION

Attachments related to archived data can be deleted along with the destruction of archive files, provided that the retention period for structured data from archive files has passed. Note the same retention rules can also be applied to linked attachments.

The system identifies links to the relevant attachments via the respective implementations of BADI: Clean Up Activity Before Deleting an Archive File BADI_ILM_PRE_DESTR_FILE_ACTION and deletes them from the link tables (For Archive link table is TOA*).

Note: once the link with attachments has been identified, the main objects retention rule will apply for attachments and this automatically sets the expiration date.

5. How to perform data destructions from a database with related attachments (documents)

It’s possible to delete data from a database using the t-code ILM_DESTRUCTION as shown below:

After running data destruction temporary archive file is created, which is deleted after the successful execution of the delete program. The destruction of attachments is performed via implementations of BADI: Clean Up Activities Prior to Destroying a Data Object with Data Archiving

(BADI_ILM_PRE_DESTR_OBJ_ACTION) that exist for each of the attachment frameworks. The implementations are called during the execution of the delete program. The identification of BOR object types and keys is the same as the one for destroying data from the archive.

Note:After identifying the link with attachments, the main objects retention rule will apply for attachments and this sets the expiration date.

6. How to perform data destruction for attachments with an ILM object

You can also perform data destructions by implementing ILM object AL_DOCUMENTS. SAP’s help resource offers detailed guidance on how to perform this as shown below. This needs a separate ILM policy to be configured for each object type and then a separate retention period needs to be configured as shown below:

As shown in the example, rules are inherited for object type VBRK from the main object SD_VBRK and a data retention can be configured without inheriting the existing rules. You can find out more about this via SAP’s Help Centre: https://help.sap.com/docs/BS_CA/7ce8e5dc89d7407e8baa9de7b775f31f/eeb91dcd1aa444a98ffbba662ecddb9c.html

Practical example

The image below illustrates use of the BADI implementation approach where attachments are getting deleted along with the existing main object for one of our clients. Below is a test performed during the ILM project for the destruction of attachments with the FI_DOCUMNT object.

1. Prior to running Data Destruction, the record in SE16 table BKPF was checked as shown:

2. Corresponding attachments were entered into ARCHIVELINK table TOA01

3. Transaction: FB03 document with the attachments

4. The Data Destruction action was completed using ILM_DESTRUCTION

Now, run Data destruction with ILM_DESTRUCTION

To complete this process, the steps below need to be followed as shown on the two images:

• Step 1. Run the transaction and select the object with option “Data from the database”

• Step 2. Click on the Write button, maintaining variant DATA_DEST_ATCH, using settings as shown above. Then maintain the start date, spool parameters and execute.

The following images shows the final results

Spool Request.

Delete Variant:

Delete Spool:

As shown in the attachments above, the relevant records from the ArchiveLink connection entries or SOFM, SRGBTBREL tables (SAP office related) were deleted with using the data destruction process.

• Step 3. Final checks

The following four images illustrate how to complete a final check for data destruction. The check was performed again in SE16 and no record was found for this Accounting document. The data was successfully deleted.

Table BKPF:

Table: TOA01

Finally in T.code : FB03

A final say

ILM and GPDR projects are challenging, lengthy, and time-consuming. These types of projects require the expertise of senior SAP ILM consultants and there are many players within the company involved in every meeting.

Sometimes such niche skills cannot be found in-house; in that case, the best thing to do is to rely on SAP partners like TJC Group. We are highly experienced in handling large-scale, international ILM projects for large multinationals and our senior consultants have the skills and the knowledge to manage data archiving, data retention, or GDPR projects involving data destruction.

If you want to know more about SAP ILM and GDPR projects, get in touch with us at https://www.tjc-group.com.