The right to erasure in SAP: how SAP ILM enables GDPR-compliant data destruction

Introduction

In February 2026, the European Data Protection Board (EDPB) published a landmark report identifying seven recurring challenges that organisations face when implementing the right to erasure under Article 17 of the GDPR. The coordinated action involved 32 Data Protection Authorities across Europe, with 764 controllers participating. The findings were clear: many organisations still lack appropriate internal procedures for handling erasure requests and rely on inefficient techniques instead of proper data destruction.

For SAP customers, these findings carry particular significance. Personal data is embedded throughout SAP modules, from HR and finance to sales and procurement. Implementing the right to erasure in SAP environments requires a systematic approach that balances privacy obligations with tax, audit, and legal retention requirements. SAP ILM data destruction provides exactly this capability.

Understanding the right to erasure in SAP environments

The right to erasure (Article 17 GDPR) grants individuals the right to request that their personal data be erased when it is no longer necessary for the purpose for which it was collected. However, this right is not absolute; organisations may retain data where legal obligations (such as tax retention periods) override the erasure request.

Why SAP environments are uniquely complex

Personal data in SAP systems does not reside in a single location. A customer's personal information may appear in sales orders, invoices, delivery documents, payment records, and correspondence, spanning multiple modules and database tables. Simply removing a record from one table does not constitute compliant erasure if that data persists elsewhere in the system.

The difference between archiving and destruction

It is essential to distinguish between data archiving and data destruction. Archiving moves data from the production database to archive files whilst preserving access. Destruction, by contrast, permanently removes data so that it can no longer be retrieved. For the right to erasure in SAP, both processes play complementary roles: data is first archived according to retention rules, then destroyed once the retention period expires.

How SAP ILM enables compliant data destruction

SAP Information Lifecycle Management (ILM) is SAP's standard solution for managing data throughout its complete lifecycle, from creation through retention to eventual destruction.

Defining retention and destruction rules

SAP ILM allows organisations to define retention periods based on the purpose for which personal data was collected. For example, employee payroll data may require retention for seven years under tax law, whilst marketing consent records may have a shorter retention period. Once the defined retention period expires, SAP ILM data destruction processes can be triggered automatically.

The ILM retention management process

The SAP ILM process follows a structured sequence. First, organisations identify where personal data resides in the system and classify it by purpose. Second, retention rules are defined, specifying how long each category of data must be retained. Third, blocking rules prevent the data from being used in business processes once it is no longer needed operationally. Finally, when the retention period expires and no legal hold applies, the data is destroyed through SAP ILM's standard destruction mechanisms.

Handling the balance between privacy and compliance

One of the most challenging aspects of implementing the right to erasure in SAP is balancing privacy obligations with tax and audit retention requirements. SAP ILM addresses this by supporting legal holds, which pause the destruction process for specific data sets that are subject to ongoing legal proceedings or audit inquiries. This ensures that organisations do not destroy data that may be required for compliance purposes.

Common pitfalls in SAP data destruction

The EDPB's 2026 report highlighted several recurring issues that SAP customers should be aware of.

Relying on anonymisation instead of destruction

Some organisations attempt to satisfy erasure requests by anonymising data rather than destroying it. However, anonymisation techniques must be robust enough to prevent re-identification. The EDPB found that many controllers relied on inefficient anonymisation methods that did not meet GDPR standards. SAP ILM data destruction provides a more reliable approach by permanently removing the data from the system.

Inconsistent retention periods across modules

Personal data in SAP often spans multiple modules with different retention requirements. Without a centralised approach to retention management, organisations risk retaining data beyond its permitted period in some modules whilst destroying it prematurely in others. SAP ILM provides a unified framework for managing retention periods consistently across the entire SAP landscape.

Failing to address backup systems

Data destruction must extend beyond the production database to include backup systems and archived copies. Organisations that destroy data in production but retain it indefinitely in backups may still be non-compliant with the right to erasure in SAP environments.

Best practices for implementing SAP ILM data destruction

Organisations seeking to implement compliant data destruction should follow these established practices.

Map personal data across all SAP modules

Begin by conducting a comprehensive data mapping exercise to identify where personal data resides across the SAP landscape. This includes production systems, archived data, and any connected non-SAP applications.

Define clear retention policies with business stakeholders

Retention periods should be defined collaboratively between IT, legal, tax, and HR departments. Each stakeholder brings essential knowledge about regulatory requirements and business needs that must be reflected in the ILM configuration.

Automate the destruction process

Manual data destruction is error-prone and unsustainable at scale. Automating SAP ILM data destruction ensures that retention periods are consistently enforced, destruction runs are executed on schedule, and full traceability logs are maintained for regulatory evidence.

Conclusion

The right to erasure in SAP environments demands a structured, automated approach that balances privacy obligations with legal retention requirements. SAP ILM data destruction provides the standard framework for achieving this balance, enabling organisations to define retention rules, manage blocking periods, and execute compliant destruction processes. With the EDPB intensifying its enforcement focus in 2026, organisations that have not yet implemented SAP ILM should treat this as an urgent priority.

TJC Group’s reference material on SAP ILM for GDPR covers retention rules, blocking periods and destruction runs in more depth.

Frequently asked questions

What is the right to erasure under GDPR?

The right to erasure (Article 17) allows individuals to request that organisations erase their personal data when it is no longer necessary for the purpose for which it was collected. However, this right is not absolute and can be overridden by legal retention obligations.

How does SAP ILM support GDPR-compliant data destruction?

SAP ILM enables organisations to define retention periods, implement blocking rules, and automate destruction processes. It ensures that personal data is retained only for as long as legally required and is destroyed systematically once retention periods expire.

Can organisations use anonymisation instead of data destruction?

Anonymisation may be acceptable if it is robust enough to prevent re-identification. However, the EDPB has found that many organisations use inefficient techniques. SAP ILM data destruction provides a more reliable and auditable approach to meeting erasure obligations.

What is a legal hold in the context of SAP ILM?

A legal hold pauses the destruction process for specific data sets that are subject to ongoing legal proceedings, audits, or regulatory inquiries. It ensures that organisations do not destroy data that may be required for compliance purposes.

How often should SAP ILM destruction processes run?

Destruction processes should run regularly, typically on a scheduled basis aligned with the organisation's retention management calendar. Automated execution ensures consistency and eliminates the risk of manual errors or missed destruction cycles.