Regulation requirement
Data protection law, PCI DSS and ITGC reviews ask for evidence that sensitive values are restricted where they are shown, not only that access to the transaction was approved.
ToggleNow · SAP UI Data Protection Masking
Your roles decide who opens the transaction. Who decides what they see?
Field level masking, blocking, reveal on demand and field access trace across the SAP landscape.
One solution, two modules
UI Data Protection Masking
Prevents exposure at the point of display
UI Data Protection Logging
Accounts for the exposure that is permitted
Masking removes the exposure. Logging accounts for what remains.
How sensitive data leaks
- USD 4.44M
- Global average cost of a data breach in 2025
- 53%
- of breaches involved customer personal data, the most frequently compromised data type
- USD 4.92M
- Average cost where a malicious insider was the vector, the most expensive of all
- 30%
- of breaches involved a third party, double the share of the year before
Source: IBM Cost of a Data Breach Report 2025 (Ponemon Institute); Verizon Data Breach Investigations Report 2025
Every one of those paths ends at a screen.
Before data leaves an organization, it is first displayed to someone who was allowed to open the transaction. At that point the value is already decrypted, already authorized and already rendered, so perimeter controls, encryption at rest and network monitoring no longer act on it. The data most often lost is the data most often displayed.
What changed in ten years
The controls moved from the network to the data.
Ten years ago
- Data sat in a few core systems inside the network perimeter
- Employees on the corporate network touched it
- Protection meant firewalls, segmentation and transaction level authorizations
- The auditor asked whether the access was approved
- Failure carried reputational cost and limited statutory exposure
Today
- Data spans core ERP, cloud systems and services, analytics platforms, AI tools and partner systems
- Shared service centers, managed service partners, offshore support and contractors touch it too
- Protection means data level control: classification, field level masking, access logging and evidence
- The auditor asks who saw which value, when, and on what basis
- Non-compliance can result in penalties of up to 250 crore rupees under India's DPDP Act and turnover based fines under GDPR
Source: Digital Personal Data Protection Act, 2023 (Sections 8(5), 33 and Schedule); GDPR (EU) 2016/679, Article 83
Field level protection is the layer that moved last, and the layer most SAP landscapes still lack.
Why field level protection is on the agenda
Access has widened
Shared service centers, managed service partners, support teams and contractors all hold legitimate transaction access, and with it full sight of every value on the screen.
Beyond authorizations
Roles decide which transactions and objects open. They cannot decide which values inside an approved screen are readable, so bank details, identifiers, compensation and pricing stay exposed.
Evidence, not intent
Investigations and audits ask who saw a specific value and when. Standard authorization logs record that a transaction ran, not what data it displayed.
Role redesign narrows who reaches a transaction. It cannot narrow what a legitimate user sees inside it. SAP UI Data Protection closes that remaining gap without changing the underlying applications.
One solution, two modules
Masking removes the exposure. Logging accounts for what remains.
1. UI Data Protection Masking
Prevents exposure at the point of display.
- Mask, clear or disable field content, per field and per UI channel
- Block access to specific sensitive records and fields
- Reveal on demand, with a reason code captured at the moment of reveal
- Role based and attribute based decisions, using context such as company code, country or plant
2. UI Data Protection Logging
Accounts for the exposure that is permitted.
- Consistent logging of the data displayed to and entered by users
- Answers who saw which value, in which context, and when
- Configurable scope, so logging stays targeted rather than landscape wide
- Supports investigation, breach response and audit evidence
- SAP GUI transactions and standard reports
- Web Dynpro ABAP
- SAPUI5 and SAP Fiori
- Web Client UI including CRM
- Table display via standard data browser
Channels covered, on S/4HANA on premise and private cloud editions.
Why ToggleNow
1
Specialists, not generalists
An SAP Silver Partner built around SAP security and GRC, with delivery teams that work in the authorization layer every day.
2
Published practitioners
Authors of SAP PRESS titles on SAP Access Control, SAP Process Control and SAP Cloud Identity Access Governance.
3
Scoped against real access
Masking is designed alongside role and usage analysis, so protection lands where access exists rather than where it is assumed to exist.
Optional accelerator: one click PII discovery
A ToggleNow tool scans the SAP database and returns a candidate list of fields holding personal and sensitive data. The tool is optional and licensed separately. Your team runs the scan, reviews the output and maintains the inventory going forward. Discovery and ongoing maintenance of the field list sit outside this engagement.
Next steps
- 1
Confirm the systems, UI channels and functional modules in scope, and the regulatory driver behind the initiative.
- 2
Run a two-day scoping workshop to build the sensitive field inventory and measure the custom screen ratio.
- 3
Convert the indicative model into a fixed effort baseline and a delivery plan against the confirmed tier.
- 4
Issue commercials against that baseline. Pricing is contract specific and confirmed in the engagement agreement.