SAP MDG: Apply Role- and Attribute-Based Masking to Vendor Bank and Tax Data

Arjun Mehta breaks down what you need to know

A purchasing analyst may need to review a supplier’s status without seeing its bank account. A tax specialist may need a personal tax identifier to validate registration. Both users participate in vendor governance, but their legitimate visibility requirements differ.

After 25 years working with ABAP and SAP integrations, I regard this distinction as fundamental: permission to open a master-data record should not automatically mean permission to see every field.

UI masking can enforce that distinction. The challenge is making it consistent across SAP MDG workflows without preventing authorized users from completing their work.

The Real Story

The SAPinsider source

IF person_status IN {NATURAL_PERSON, UNKNOWN}: tax_masked = NOT can_view_personal_tax(user, vendor_context) ELSE: tax_masked = other_tax_visibility_rules(user, vendor_context)

Keep view and change permissions separate. A user authorized to verify an account does not necessarily need permission to replace it.

## Action Items

- **Inventory sensitive fields and display paths.** Include account numbers, IBANs, tax identifiers, detail screens, search results, and change comparisons. Do not assume protection on one screen covers another.
- **Resolve the masking targets.** Map each business field to the relevant technical fields and supported masking configuration in your release. Use documented framework mechanisms rather than scattered screen-specific substitutions.
- **Verify attribute resolution during change requests.** Check whether the decision uses active data or pending changes. Otherwise, a newly entered natural-person classification may not protect the tax number until activation.
- **Separate display transformation from persistence.** Confirm that mask characters never overwrite stored values or enter replication payloads.
- **Test authorized processing as thoroughly as denial.** Bank verification, tax validation, approval, and activation must remain possible for the intended users.

At minimum, test each relevant role against natural-person, non-natural-person, and unclassified vendors. Add users with overlapping roles and users whose sensitive-data entitlement has been removed.

For example, a purchasing reviewer should see a masked account, while an approved bank verifier should see the value. Both should receive consistent behavior in detail and comparison views. Refreshes and record changes must not leave a previously visible value on screen.

## Community Perspective

The evidence supplied does not include practitioner comments, so there is no basis for claiming community consensus.

The implementation tension is nevertheless clear: broad masking can obstruct work, while broad exemptions defeat the control. A generic “MDG processor” role is a poor substitute for field-specific visibility requirements.

From an integration perspective, I would also examine responses, logs, and error messages. Hiding a value visually while delivering it to an unauthorized user’s browser is not a satisfactory security boundary.

## Bottom Line

Use roles to establish legitimate visibility and vendor attributes to determine when conditional protection applies. Then test the complete processing path.

The strongest design protects sensitive values without corrupting master data or forcing users into workarounds. Successful masking is not a screenshot containing asterisks; it is a repeatable access decision backed by reliable classification and verified enforcement.

*Source: Protecting Vendor Bank and Tax Data in SAP MDG with UI Data Protection Masking---

## References

- Department of the Treasury - Division of Taxation- TurboTax® Official Site: File Taxes Online, Tax Filing Made Easy- [What It Is and How It Works | TaxEDU Glossary](https://taxfoundation.org/taxedu/glossary/tax/)
- Tax- Ubiquiti: UniFi - Rethinking IT- User interface

---

## References

- [Protecting Vendor Bank and Tax Data in SAP MDG with UI Data Protection Masking](https://sapinsider.org/expert-insights/sap-mdg-data-masking-vendor-bank-tax-data/)
- [Department of the Treasury - Division of Taxation](https://www.nj.gov/treasury/taxation/)
- [TurboTax® Official Site: File Taxes Online, Tax Filing Made Easy](https://turbotax.intuit.com/)
- [What It Is and How It Works | TaxEDU Glossary](https://taxfoundation.org/taxedu/glossary/tax/)
- [Tax](https://en.wikipedia.org/wiki/Tax)