The right to erasure in SAP: how SAP ILM enables GDPR-compliant data destruction

Introduction

In February 2026, the European Data Protection Board (EDPB) published a landmark report identifying seven recurring challenges that organisations face when implementing the right to erasure under Article 17 of the GDPR. The coordinated action involved 32 Data Protection Authorities across Europe, with 764 controllers participating. The findings were clear: many organisations still lack appropriate internal procedures for handling erasure requests and rely on inefficient techniques instead of proper data destruction.

For SAP customers, these findings carry particular significance. Personal data is embedded throughout SAP modules, from HR and finance to sales and procurement. Implementing the right to erasure in SAP environments requires a systematic approach that balances privacy obligations with tax, audit, and legal retention requirements. SAP ILM data destruction provides exactly this capability.

Understanding the right to erasure in SAP environments

The right to erasure (Article 17 GDPR) grants individuals the right to request that their personal data be erased when it is no longer necessary for the purpose for which it was collected. However, this right is not absolute; organisations may retain data where legal obligations (such as tax retention periods) override the erasure request.

Why SAP environments are uniquely complex

Personal data in SAP systems does not reside in a single location. A customer's personal information may appear in sales orders, invoices, delivery documents, payment records, and correspondence, spanning multiple modules and database tables. Simply removing a record from one table does not constitute compliant erasure if that data persists elsewhere in the system.

The difference between archiving and destruction

It is essential to distinguish between data archiving and data destruction. Archiving moves data from the production database to archive files whilst preserving access. Destruction, by contrast, permanently removes data so that it can no longer be retrieved. For the right to erasure in SAP, both processes play complementary roles: data is first archived according to retention rules, then destroyed once the retention period expires.

How SAP ILM enables compliant data destruction

SAP Information Lifecycle Management (ILM) is SAP's standard solution for managing data throughout its complete lifecycle, from creation through retention to eventual destruction.

Defining retention and destruction rules

SAP ILM allows organisations to define retention periods based on the purpose for which personal data was collected. For example, employee payroll data may require retention for seven years under tax law, whilst marketing consent records may have a shorter retention period. Once the defined retention period expires, SAP ILM data destruction processes can be triggered automatically.

The ILM retention management process

The SAP ILM process follows a structured sequence. First, organisations identify where personal data resides in the system and classify it by purpose. Second, retention rules are defined, specifying how long each category of data must be retained. Third, blocking rules prevent the data from being used in business processes once it is no longer needed operationally. Finally, when the retention period expires and no legal hold applies, the data is destroyed through SAP ILM's standard destruction mechanisms.

Handling the balance between privacy and compliance

One of the most challenging aspects of implementing the right to erasure in SAP is balancing privacy obligations with tax and audit retention requirements. SAP ILM addresses this by supporting legal holds, which pause the destruction process for specific data sets that are subject to ongoing legal proceedings or audit inquiries. This ensures that organisations do not destroy data that may be required for compliance purposes.

Common pitfalls in SAP data destruction

The EDPB's 2026 report highlighted several recurring issues that SAP customers should be aware of.

Relying on anonymisation instead of destruction

Some organisations attempt to satisfy erasure requests by anonymising data rather than destroying it. However, anonymisation techniques must be robust enough to prevent re-identification. The EDPB found that many controllers relied on inefficient anonymisation methods that did not meet GDPR standards. SAP ILM data destruction provides a more reliable approach by permanently removing the data from the system.

Inconsistent retention periods across modules

Personal data in SAP often spans multiple modules with different retention requirements. Without a centralised approach to retention management, organisations risk retaining data beyond its permitted period in some modules whilst destroying it prematurely in others. SAP ILM provides a unified framework for managing retention periods consistently across the entire SAP landscape.

Failing to address backup systems