SAP experience Day Pronti per il GDPR? - 15 febbraio 2018

Transcription

1 SAP experience Day Pronti per il GDPR? - 15 febbraio 2018 GDPR: sfide e opportunità. Gli strumenti EIM e GRC, essenziali per operare con successo nell era post-gdpr Silvio Arcangeli, Senior Director, Platform Integration, SAP EMEA South Daniela D Amore, SAP Finance and Risk Management Presales, SAP Italia Uri Bahar, Director, Solution Architecture EMEA, Gigya an SAP Company

2 GDPR at a glance Protects fundamental rights related to the processing of personal data EU and non-eu Controllers Processors Transfer of data Accountability Data protection officer Privacy by design Privacy impact assessments Evidence of compliance Evidence of compliance Individual rights Breach notification Codes of conduct to be informed of access to rectification to erasure Response time ISO to restrict processing to data portability to object Auto. decisions and profiling Penalties Lawful processing always requires legal permission Consent Contract Legal obligation Vital interest Public interest Legitimate interest Personal data Sensitive personal data 2

3 Governance How SAP helps customers address GDPR requirements SAP s integrated and industry-leading solutions are highly relevant for meeting end-to-end GDPR requirements. Enterprise-grade solutions cover SAP and non-sap systems and work with existing infrastructure investments. SAP Process Control Governance, risk, compliance, and security solutions SAP Access Control Business systems Apply a risk based approach to data privacy 3

4 Your journey through GDPR with SAP Which processes touch personal data Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Which processes touch personal data? Evidence of compliance Accountability Codes of conduct ISO Data protection officer Privacy by design Privacy impact assessments Evidence of compliance 4

5 SAP Process Control Overview REPORT e.g. Sign-Off MONITOR Perform automated, exceptionbased monitoring of ERP systems DOCUMENT Document processes, controls, regulations and policies SCOPE Plan assessments Add intelligence to reduce compliance costs EVALUATE Evaluate control design and effectiveness; raise and remediate issues 5

6 SAP Process Control & Risk Management Art. 30 and Art. 35 Here an example of record of the processing activity (Art. 30) built through the assessment features Analogously, Data Protection Impact Assessment (Art. 35) can be managed through the GRC assessment capabilities Speakers idea of an approach and types of information to report and/or manage. It is not intended to represent a current or future product 6

7 SAP Process Control & Risk Management Evidence of compliance Document risks, processes, controls and map key regulations in a central unique repository Distribute accountability within the organization Central controls repository collates data for subsequent audit and review Schedule recurring assessment of controls Provide ongoing reporting of GDPR compliance to the DPO and stakeholders Support sign-off process 7

8 Your journey through GDPR with SAP Who could access personal data Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Who could access personal data? Accountability Privacy by design Evidence of compliance 8

9 SAP Access Control Overview MONITOR PRIVILEGES Monitor emergency access ANALYZE RISK SoD risk analysis and mitigation/remediation CERTIFY AUTHORIZATIONS Users and roles review MANAGE ACCESS Access provisioning MAINTAIN ROLES Roles provisioning 9

10 SAP Access Control Risk Analysis Define sensitive/critical access risks for GDPR Monitor and periodically review the access defined for GDPR Schedule reporting to DPO Sample of SoD Risk 10

11 SAP Access Control User Access Provisioning Example of template based request Create access request on behalf of another user using Request Template Review the request Approve the request (risk exists) Assign mitigation controls and approve request with risks Example of business role provisioning Auto provision Create access request Review the request Approve the request (no risk) Leverage workflow escalation where GDPR relevant access is included (provisioning process) Define and categorize security roles for personal data management Legenda End User Accounts Payable Clerk Accounts Payable Manager & BP Owner Security Owner 11

12 Operations How SAP helps customers address GDPR requirements SAP s integrated and industry-leading solutions are highly relevant for meeting end-to-end GDPR requirements. Enterprise-grade solutions cover SAP and non-sap systems and work with existing infrastructure investments. Recognize information as a strategic key asset in the Digital Economy Business systems Database and data management solutions SAP Information Lifecycle Management SAP Extended Enterprise Content Management by OpenText SAP Data Services software and SAP Information Steward SAP Process Mining by Celonis 12

13 GDPR seen from your customer Employee contract Working student ( ) Address 14 Newnham Rd, Cambridge CB3 9EX Payment details Perfect Bank IBAN: DE Purchased Goods: eieiphone + Maintenance agreement (3.2015) ebooks Contract for services: Targeted marketing with Beacons and Geofencing ( ) Communication Phone: Portal Account: CarCust 13

14 Your journey through GDPR with SAP What personal data are we storing and where What personal data are we storing and where? Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Personal data Individual rights Sensitive personal data to data portability to rectification to erasure 14

15 SAP Information Steward Profile, Assess, Monitor and Manage Data Compliance & Quality Across the Enterprise SAP Business Suite SAP BW Business Databases SAP HANA SAP Information Steward 1.Discover Hadoop 5.Analyze 2.Define BI systems IT ETL tools 4.Monitor 3.Workflow Delimited Files Data Modeling tools Sources Data Discovery & Stewardship 15

16 SAP Information Steward demo IS in action for discovery of personal data 16

17 Your journey through GDPR with SAP Which process flows are actually touching personal data Which process flows are actually touching personal data? Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Accountability Privacy by design 17

18 How can you discover your actual data flows? SAP Process Mining by Celonis Digital footprints from any IT system Visualization of actual processes and proactive improvement insights Discover how compliant your processes are Find out where to include Consent Logic Help define Information Retrieval for GDPR SAR Discover Process Inefficiencies and opportunities for improvement Data-based process discovery Intuitive, graphical visual representations of as-is processes Ability to evaluate non-compliant flows and detect inefficiencies 18

19 SAP Process Mining by Celonis A live example ADD VIDEO - SILVIO 19

20 Your journey through GDPR with SAP Data archiving and deletion Manage and design rules for personal data archiving and deletion Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Individual rights to erasure 20

21 SAP Information Lifecycle Management Use cases SAP Information Lifecycle Mgt Data Archiving Retention Data Archiving Management Retention Management System Decommissioning Analyze data volumes Securely move data from the database to the archive Comfortably access archived data Manage and enforce retention policies across the enterprise Manage the responsible destruction of data based on policies Perform e-discovery and set legal holds Decommission legacy systems Enforce retention policies on data from shut-down system Benefit from independently understandable archive DB Volume Management DB Volume Management End-of-life Data End-of-Life End-of-life End-of-Life System Data System 21

22 Open Text Retention and Deletion management Retention Policy Management Manage and enforce retention policies Set policies for automatic data retention and subsequent destruction Retain data according to set policy Responsibly destroy data when expiration date has been reached Maintain Separate Archives per Retention Period Create multiple data archives for each data expiration date Perform e-discovery Search for information in response to legal requests Apply Hold on Data Automatically prevent data deletion or destruction Apply holds to archives and current database 22

23 Additional solutions from SAP Strengthening GDPR governance and more Three lines of defense Access governance & identity mgt Cybersecurity risk and governance Database and data management SAP Risk Management SAP Audit Management SAP Business Integrity Screening SAP Dynamic Authorization Management by NextLabs SAP Identity Management SAP Cloud Identity Access Governance software Gigya SAP Enterprise Threat Detection SAP Enterprise Digital Rights Management by NextLabs UI field masking solutions UI logging solutions SAP Extended Enterprise Content Management by OpenText SAP PowerDesigner SAP Master Data Governance SAP Process Mining by Celonis 23

24 Your journey through GDPR with SAP Focus on cyber security Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Focus on cyber security Breach notification Response time Penalties 24

25 SAP Enterprise Threat Detection A big-data solution to a serious security challenge Protect the integrity of business processes and prevent theft or manipulation of business data BIG DATA ACQUIRE ANALYZE ACT REAL RESULTS Vast amount of log data scattered across the landscape Bring data together in one place with a common format Evaluate attack detection patterns. Browse & analyze Lock user account, cut off connection, Detect attacks early and prevent harm REAL TIME 25

26 SAP Enterprise Threat Detection Monitor, fields of attention, and forensic lab Alerts Initial analysis Further analysis and derive new patterns Delivered ETD Patterns ~ 70 26

27 Your journey through GDPR with SAP Consent management, Customer data control, Social compliance Data Privacy Impact Assessment Active Data Archive Delete Personal Data Lifecycle Consent management, Customer data control, Social compliance Lawful processing always requires legal permission Individual rights Consent to restrict of access to rectification to erasure processing 27

28 From Anonymous To Known: Building Identity Progressively Building rich profiles along the customer journey with privacy at the forefront Anonymous Known Awareness Consideration Conversion Retention Advocacy KEY CAPABILITIES Anonymous Interactions Lite Registration Full Registration Progressive Profiling Enriching Customer Profiles Consent Management Customer & Social Profile Data Profile and Preference Management Authentication and Authorization 28

29 GDPR Is About Putting The Customer In Control Of Their Data CUSTOMER DATA INDIVIDUAL RIGHTS Profile Data The right to be informed Connections Likes & Interests Social Data Location Data VS. The right of access The right to rectification The right to erasure The right to restrict processing The right to data portability Behavioral Data Registration Data Device Data The right to object Rights in relation to automated decision making and profiling 29

30 Managing preferences & consent throughout the lifecycle of the customer USERS CONTROL PREFERENCES & CONSENT View profile, preferences & consent Add and modify profile, preferences and consent information Withdraw consent Download user data Preference & Consent Capture PRESENT POLICIES Terms of Service (ToS) Privacy Policies Cookie Consent Consent for marketing and custom activities Self-Service Preference Center Version Control ENFORCES CONSENT Synchronize preferences, consent and profile data to downstream marketing, sales, and services applications Audit-Ready Vault Accurate and Enforced Records MAINTAINS ACCURATE CONSENT Trigger consent renewals Record consent at renewal Track consent history Audit consent 30

31 IDENTITY Consent Preference & Consent Capture Registration, Login and Auto-Login Consent Collection Use-Cases Consent for new registrations: 1 Registration Brand A CIAM EPM Preference & Consent Capture Add user preferences: 2 Login Brand A Register Consent Collection Re-consent after changes to terms: 3 Login Brand A Login Preference Center Records Cross-brand SSO and consent: 4 Auto Login (SSO) Brand B Login with Reconsent Consent Renewal Collection Audit-Ready Vault Consent Collection 31

32 Consent Version Control Earning Customer Trust with Triggered Consent Renewals Gains Loyal Customers Version Control

33 Consent Accurate and Enforced Records Synchronize preferences, consent and profile data to downstream marketing, sales, and services applications Accurate and Enforced Records 33

34 IDENTITY Consent Self-Service Preference Center Preference Center Consent Use-Cases Self-Service Preference Center (Pre) registered user Opt-Out: Preference Center EPM Opt-out Registered User Consent Withdraw: Preference Center Acceptance Withdraw Registered User Consent Expiration: Preference Center Audit-Ready Vault Automatic Revocation 34

35 Gigya integrates with SAP Hybris Commerce and SAP Hybris Marketing Enables Better B2C Experiences Enables Real-time Customer Journeys 35

36 Gigya and SAP Hybris Commerce 36

37 Gigya and SAP Hybris Marketing 37

38 Get started quickly while enabling a sustainable GDPR program Ready to dialog with the regulator What you have Monitor Assess Execute on your plan Find gaps and plan solutions Respond Plan 38

39 Create Value with SAP TrUst and BranD TraNspaRency with StakehOlderS InforMation as a StratEgic key asset in the DigiTal EconOmy Create a unique customer experience CyBer SecuRity and Real-Time detection Best-of-Breed TecHnolOgy Multi-ComPliancE DisTribute AccOuntaBilitY RedUce compliance costs UniQue corporate CompLIance repository 39

40 Thank you

41 Legal Disclaimer The information in this presentation is confidential and proprietary to SAP and may not be disclosed without the permission of SAP. This presentation is not subject to your license agreement or any other service or subscription agreement with SAP. SAP has no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation and SAP's strategy and possible future developments, products and/or platforms directions and functionality are all subject to change and may be changed by SAP at any time for any reason without notice. The information on this document is not a commitment, promise or legal obligation to deliver any material, code or functionality. This document is provided without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or noninfringement. This document is for informational purposes and may not be incorporated into a contract. SAP assumes no responsibility for errors or omissions in this document, and shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of this document. This limitation shall not apply in cases of intent or gross negligence. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions. NOTE: The information contained in this presentation is for general guidance only and provided on the understanding that SAP is not herein engaged in rendering legal advice. As such, it should not be used as a substitute for legal consultation. SAP SE accepts no liability for any actions taken as response hereto. It is the customer s responsibility to adopt measures that the customer deems appropriate to achieve GDPR compliance. 41

42 2018 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE s or its affiliated companies strategy and possible future developments, products, and/or platforms, directions, and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, and they should not be relied upon in making purchasing decisions. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. See for additional trademark information and notices.