User Consent

User Consent is the action of the data subject confirming that the usage of his or her personal data shall be allowed for a given purpose.

SAP Rural Sourcing Management is not providing functionality to collect the consent directly from the user, i.e., there is no self-service registration. Most persons processed in the system are not actual users logging into the system anyway. As defined in the terms and conditions, customers are responsible to collect consent of all persons who will be processed in SAP Rural Sourcing Management, and to maintain the consent status for all affected persons electronically in our system. This status is a mandatory field for all person entities:
  • In the WebUI master data upload, the user must check a consent checkbox to confirm that consent of all persons in the master data upload has been provided.
  • In the WebUI person/user creation screens, the user must check a consent checkbox to confirm that the person/user has provided consent.
  • In the Mobile app producer registration process, the user must check a consent checkbox to confirm that he collected the consent of the person he is registering.

Revoking a Person's Consent

A person’s consent can be revoked at any time. When consent is revoked, their data is invisible in the system for the length of the set retention period (see Deletion of Personal Data for details.

After the retention period is over, the system will anonymize their data (the data is no longer attached to their name). After the retention period has elapsed, the person’s data cannot be recovered and reattached to their name again.

An administrator with the appropriate permissions in the administrator system can revoke a person’s consent and deactivate them in the system using the following steps:
  1. Select the Master Data tab on the left side of the screen.
  2. Select the Persons page.
  3. Click on the person in the list for which you want to revoke consent.
  4. Click Edit in the top right of the Persons page.
  5. Change the person’s consent from consenting (green check mark) to not consenting (red "x").
  6. Click Save.
  7. Read the warning about revoking consent for the person.
    1. Click Continue to revoke their consent and deactivate them from the system.
    2. Click Cancel if you do not want to revoke their consent.

Undo Revoking of a Person's Consent and Reactivating Them in the System

If for some reason a person revoked their consent but changed their mind before the retention period has elapsed, their data can be recovered and they can be re-instituted to participate in the system. An administrator with the appropriate permissions in the administrator system can re-institute them using the following steps:
  1. Select the Administration tab on the left side of the screen.
  2. Select the Retention Period page.
  3. Click on the name of the active retention period.
    • You will see all the persons who revoked their consent while this retention period was in effect. Their data will be anonymized when the retention period has elapsed.
    • If a person revoked their consent when a previous retention period was in effect, their names will be listed when you click on one of the names of retention periods in the “Retention Period History”. Their data will be anonymized when the previous retention period days have elapsed.
  4. Click on the name of the person for which you want to re-institute consent.
  5. Scroll to the bottom of the person’s page. Click Consent so that it has a green check mark to show the person has given consent again.
  6. Click Save.

The person is now Active again in the system.