Germany Hits Pause on SAP Data-Access Probe, But the Real Battle Is Still in the API Layer

Introduction

The German competition authority has stepped back from opening an abuse case against SAP, after reviewing complaints about how enterprise data can be extracted from its systems. That procedural move may sound like a win for the vendor, but the underlying dispute is more interesting than a yes-or-no legal answer. In modern ERP environments, the fight is often not over whether data can leave a platform at all, but over who controls the sanctioned path out.

SAP changed its API-related data-access policy in April, and the regulator said it currently sees enough extraction options to avoid formal proceedings. Even so, the issue remains technically and commercially important because enterprise data increasingly feeds analytics, automation, and process-mining tools outside the core system of record.

Fast Facts

• The Bundeskartellamt said it does not currently intend to open abuse proceedings against SAP.
• The review followed complaints from software companies, including Celonis.
• SAP changed its API-related data-access policy in April.
• The authority said it found sufficient data extraction options and no current signs of exclusionary conduct.
• A separate California complaint involving related data-access claims is still moving through the courts.

Body

The technical heart of the dispute is data portability. In large enterprise stacks, that usually means extracting operational records, event logs, and transaction data through supported interfaces, not through free-form access to underlying tables. Vendor policy can therefore shape practical mobility even when export remains possible in principle.

That distinction matters because process-mining systems and analytics platforms depend on regular, reliable feeds from ERP environments. If access is governed by rate limits, interface changes, licensing terms, or approved extraction patterns, customers may still face friction even without an outright ban. From a defensive and operational perspective, the risk is not only lock-in. It is also slow, expensive, and fragile integration.

This is why competition authorities increasingly look at data access and interoperability as market issues. In digital ecosystems, a platform that controls the preferred path for data extraction can influence switching costs, third-party integration, and how easily a customer can move workloads elsewhere. That does not automatically prove unlawful conduct, but it does explain why regulators scrutinize API governance so closely.

The practical lesson for enterprise buyers is straightforward. Export rights, documentation of the data model, and realistic testing of extraction workflows should be part of procurement, not an afterthought at exit time. If a vendor-controlled interface becomes the only workable route, then portability can remain technically available while still being operationally painful.

At the time of writing, the formal legal threshold has not been crossed in Germany, but the market question has not disappeared. The regulator plans to keep watching, which tells executives something important: API policy is not just a backend detail. It is part of the power structure around enterprise data.

Conclusion

The wider lesson is that data ownership means little if movement is costly, constrained, or constantly renegotiated. For CIOs and security teams alike, the real control point is not whether a system stores information, but whether that information can leave on terms the business can actually use.

WIKICROOK

• ERP: Enterprise Resource Planning software that manages core business processes and records.
• API: An application programming interface that lets software exchange data through defined rules.
• Data portability: The ability to move data from one platform or service to another.
• Interoperability: The capacity of different systems to work together and exchange usable data.
• Process mining: A method for analyzing event logs to reconstruct how business workflows actually run.