Lesson 4 of 5
Blocking and data privacy
9 min
Two different things are called "blocking" in BP maintenance, and confusing them causes real problems. Business blocks stop transactions with a partner: no more orders, deliveries, invoices, postings or payments. Data privacy blocking restricts access to a person's data once the business purpose for holding it has ended. They are set for different reasons, by different people, and they are tested differently.
Business blocks
| Block | Typical level | Effect | Contoso example |
|---|---|---|---|
| Central block | Whole BP | Blocks the partner across processes as configured | Supplier under investigation for fraud |
| Posting block | Company code | No postings to the account in that company code | Customer in a legal dispute in company code 1710 |
| Purchasing block | Purchasing organization or all | No new purchase orders | Supplier failed quality audits |
| Order, delivery or billing block | Sales area or all | Stops sales orders, deliveries or billing | Fleet customer over credit, deliveries held |
| Payment block | Company code | Open items are not paid by the payment run | Supplier bank change awaiting confirmation |
- Should nothing at all happen with this partner?Yes → central block · No → continue
- Should only buying stop?Yes → purchasing block for the relevant purchasing organization · No → continue
- Should only selling, shipping or billing stop?Yes → order, delivery or billing block for the sales area · No → continue
- Should money stop moving but documents continue?Yes → payment block (or posting block if postings must stop) · No → no block needed
Blocks need a reason and an owner. A block set "temporarily" and forgotten can stop a supply line months later; one removed without approval can let a fraudulent supplier be paid. Record who set each block, why and when it should be reviewed. Blocks on suppliers with open purchase orders or customers with open orders also need a decision on the open documents.
Personal data and privacy
Many BPs contain personal data: sole traders, contact persons, individual customers, employees who are also suppliers for expenses. Privacy law such as the EU General Data Protection Regulation (and comparable laws elsewhere) requires that personal data is processed only for a purpose and kept no longer than necessary, subject to legal retention obligations such as tax and commercial record keeping. SAP S/4HANA supports this with an end of purpose check: once all business with a partner is complete and the configured residence period has passed, the BP's personal data can be blocked so normal users can no longer see or use it, and later deleted or destroyed, typically using SAP Information Lifecycle Management, when retention periods end.
- ActiveBusiness in progressOrders, invoices and payments with the partner; data fully visible
- End of businessLast activity completeAll documents closed in every application; the residence period starts
- End of purposeBlockedPersonal data restricted to specially authorized users, for example auditors
- End of retentionDeletedData destroyed once legal retention periods expire
For testing, privacy functions need their own scenarios and test data. Use a test BP that represents a person, complete its business, run the end of purpose check and confirm that a normal user can no longer display the personal data while a specially authorized user can. Never use copies of real personal data for these tests unless the privacy office has approved it, and record the test outcome as evidence for the privacy office as well as the process owner.
What would you do?
A former sole-trader supplier asks Contoso to delete all their personal data. Their last invoice was paid eight months ago. What is the right first step?
- Business blocks stop transactions; privacy blocking restricts access to personal data after end of purpose.
- Choose the narrowest business block that achieves the goal, and record reason, owner and review date.
- End of purpose leads to blocking; end of retention leads to deletion, often via SAP Information Lifecycle Management.
- Retention and privacy decisions belong to the privacy office.
Check your understanding · not graded
Lesson check
1. A supplier failed quality audits, but open invoices must still be paid. Which block fits?
2. What does data privacy blocking do?
3. Who should decide BP retention periods?
4. What should be recorded when a business block is set?