Thanks for your data

SAP’s current focus is on AI. This should not surprise anyone. Any company only slightly in the IT business must do something with AI and offer some AI powered products. If not, the company will get into serious problems, especially when it is a public listed company. As a result, SAP does not stop saying that they are an AI company and that AI is everywhere. This got once more obvious at SAP TechEd 2025. The event is also accompanied by press conferences and interviews with senior SAP management as well as news articles. One of those articles cites Muhammad Alam where he states that ten thousands of customers trust SAP with their data and to use it (article in German only).

This is not the first time you have heard such a statement from SAP management. At the DSAG JK 2023 Christian Klein (CEO SAP) already mentioned that SAP’s AI is used by 25.000 customers. At that time, I already wondered if the customers and their employees were aware of this. With the current focus of SAP on AI and the above-mentioned statement, I still wonder: do customers know that they are giving their data to SAP? Do they know that their data is used to improve SAP products? Maybe it will even be used to train SAP AI models?

Long story short: Customers do allow SAP to use their (personal) data to improve SAP products. If you are customer of a SAP (cloud) product, you grant this right to SAP. Of course, personal data is anonymized. But: a customer cannot really opt-out of this. Or even opt-in. The opt-in is done when the product is purchased. SAP is not hiding this. The information what SAP can or cannot do with customer data is publicly available. Therefore, no one should be surprised that SAP is using the anonymized data. I’d even say: this is common practice. You use a cloud service, what did you expect?

SAP Privacy Statement

SAP transformed over the years several of their solutions to SaaS. One example is Ariba, aka SAP Business Network (SBN). What is the general approach from SAP regarding using customer data? At sap.com you can find the SAP privacy statement. It is publicly available and details how SAP uses data collected when you do business with them. At the beginning of the document SAP already makes clear that they are collecting data with the objective of using it also for developing products.

“develop and offer you its software products, cloud, and other services,”

The privacy statement includes more information about this. Section “For what purposes does SAP process your Personal Data and based on what legal basis?” contains following explanation:

“Development of products and services: Within an existing business relationship between you or your employer and SAP, SAP may process your personal data for internal research, technological demonstration and development, and to help SAP create, develop, operate, deliver, improve, upgrade or enhance SAP products and services. SAP may process personal data to create anonymized data sets which may then be used to improve SAP’s products and services.”

Short: SAP may process your personal data […] develop, operate, deliver, improve, upgrade or enhance SAP products and services. Of course, it does not stop here. SAP has the right to process personal data to create anonymized data sets which may then be used to improve SAP’s products and services.

Agreements

Besides the privacy statement on sap.com, SAP has several other agreements you can find on the SAP Trust Center website. SAP lists the available agreements for several areas like cloud services or software. From here you can explore the agreements that fit your scenario. The agreement for Data Processing Agreement for Cloud Services, SAP Support and SAP Serivces states:

“continuous improvement of Cloud Service features and functionalities provided as part of the Cloud Service including automation, transaction processing and machine learning”. The same applies to SAP Support and Professional Services. Personal data is used to improve products and in machine learning.

One entry in the cloud services agreements list is about Product Development Schedule. The description text makes it clear that customer data is used in SAP product development.

Opening the SAP Product Development Schedule agreement listed in cloud services makes clear that SAP can use customer data in their product development.

“Notwithstanding anything in the Agreement, the SAP Group may also process Customer Data in accordance with this Product Development Schedule for Product Development purposes globally”. Of course, personal data is anonymized. SAP grants customers the option to decline permission.

SAP Cloud

SAP Cloud is no different. The Data Processing Agreement for Cloud Services gives SAP the right to improve their products using customer data.

“continuous improvement of service features and functionalities provided as part of the Cloud Service including automation, transaction processing and machine learning” (page 8).

Same applies for Concur.

A similar statement is also available for SAP Support and Professional Services and applies also for on premise software and support.

SAP Business Network

Another cloud product is the SAP Business Network (SBN). SAP offers a broad range of documents on their website. The SAP Business Network Terms of Use includes several links to documents like the ones mentioned above.

• SAP Business Network Data Policy: “perform internal tracking and SAP BN improvement”
• SAP Business Network Privacy Statement: “use this anonymized data to create statistical reports, benchmarks and insights which SAP uses to improve SBN Services”

The SBN privacy statement makes it also clear that a customer cannot simply use the SAP service and not have SAP use their data. The usage of the service and usage right to SAP are linked. If a company does not want to give SAP this data, they cannot really use the service.

Know what you do

In case you wonder why your buyers allow this: they were informed. SAP provides a sample order form and yes, the sample already contains links to agreements. How SAP handles customer data is communicated.

As the buyers in your company received this, read the documents and signed it: they gave SAP permission to use customer data, including personal data for product improvements, including machine learning, or AI. The buyers know what they signed up to.

Awareness

It is true: ten thousands customers trust SAP their (personal) data. With ten thousands customers allowing SAP to use their data, SAP has access to the personal data of millions of people. Of course, the data is anonymized. SAP can use that data for product improvements. Machine learning is explicitly mentioned, but product improvement can include AI training. At least AI training is not explicitly ruled out.

The question that remains is rather: are companies aware of this? Or better: are the employees that use the services know that their (private) data is used by SAP? Of course, it is anonymized and no one can track it back to a person. But still: do they know that their data is used by SAP to improve a product? Do they know their data is used as input for machine learning? To maybe train AI? I’d say no, they are not aware of this. I doubt that the normal employee reads the agreements associated with a given SAP product or service. Normally they also have no choice. The product was bought; it is part of their job to use it. Employees get training, a manual and the task of using the tool. A deep dive on personal data anonymization and usage is not part of the onboarding process. I guess that not even those responsible for selecting, buying and offering the product at a customer are aware of this.

What could help raise awareness? First, a need to do so. From SAP side: why? The necessary information was shared with the customers; it is publicly available. Customers? Also, why? Using the data to improve a product or to offer a platform: yes, this is needed. This is what is expected by customers. The buy the software because it solves business problems better. As long as there is no legal requirement, why bother? Employees? Well, it is their personal data. In the context of an employee working for a company, but still: their personal data. Making them aware about the data processing might be polite. Maybe sending out a (monthly?) reminder that customer and employee data is anonymized and used for product development might help raise awareness.

SAP customers trust SAP their data, customer emplyoees trust SAP their personal data to improve SAP products. It is not only SAP that does this. Others do it too. It is not unusual. It is common for cloud products. Nevertheless, it would be nice to remind users what is happening with their personal data. Just for transparency.