---
sourceDocument: Zurich Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Roles installed

# Roles installed with Privacy Management {#ariaid-title1}

Release version: Zurich  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Roles installed with Privacy Management

The GRC: Privacy Management application in ServiceNow Zurich release installs specific roles tailored to support privacy compliance activities within your organization.
These roles empower privacy analysts, managers, administrators, and other stakeholders to manage, monitor, and enforce privacy policies and regulations effectively.
Show full answer Show less  

## Key Roles and Their Responsibilities

* **Privacy Analyst \[snprivacy.analyst\]**: Manages compliance for assigned processing activities by assessing privacy impacts, collaborating on controls, resolving compliance concerns, and monitoring control effectiveness. This role includes multiple subordinate roles related to compliance, risk, and assessment tasks.
* **Privacy Manager \[snprivacy.manager\]**: Oversees organization-wide privacy compliance, develops policies, monitors controls, leads the privacy team, and reports to leadership. This role encompasses analyst permissions plus broader administrative and management capabilities across compliance, risk, and regulatory functions.
* **Privacy Admin \[snprivacy.admin\]**: Configures privacy management solutions including privacy impact assessments, automated workflows, and processing activity creation rules. Also responsible for monitoring platform dependencies and managing privacy scripts. This role includes manager-level roles and advanced administration permissions.
* **Privacy Assessment Responder \[snprivacy.assessmentresponder\]**: Allows stakeholders to respond to privacy assessments and submit privacy requests via the portal. Provides read and user-level access needed for participation in assessment workflows.
* **Privacy Business User \[snprivacy.businessuser\]**: Enables editing of processing activities in the Discover state and responding to assessments. Equipped with task reader and related roles supporting business-user level interaction with compliance and risk data.
* **Privacy Developer \[snprivacy.developer\]**: Permits custom scripting capabilities needed to extend privacy management functionalities. Includes administration and developer roles across compliance and governance modules.

## Additional Role Packages

* **Privacy Employee User \[snprivacyemp.privacyemployee\]**: For organizations with the Privacy Employee User application, this role enables employees to request privacy impact assessments, report privacy cases, acknowledge policies, and create exceptions or issues via the Employee Center.
* **GRC: Privacy Lite User Roles**: Lite operator roles provide limited but essential capabilities such as responding to assessment tasks, working on processing activities, handling breach and risk assessments, managing personal data rights actions, and updating remediation tasks. These roles are useful for lighter operational involvement in privacy management.

## Why This Matters for ServiceNow Customers

Assigning the correct roles ensures that privacy responsibilities are clearly delineated and that users have the appropriate permissions to perform their tasks efficiently and compliantly. Understanding these roles helps you configure your ServiceNow environment to support privacy governance, risk management, and compliance workflows tailored to your organizational structure.

## What to Expect

Once roles are assigned according to your team's functions, you can expect streamlined privacy management processes including impact assessments, control effectiveness monitoring, incident handling, and regulatory compliance reporting. The roles also facilitate automation and integration with related GRC and risk modules, enhancing overall privacy posture management within ServiceNow.  
The GRC: Privacy Management application installs
the roles for the privacy analyst, the privacy manager, and the privacy administrator to perform
their respective tasks.
{#roles-installed-prm__table_m2t_czq_mqb__entry__3}

| Role title \[name\] | Description | Contains roles |
|-|-|-|
| Privacy Analyst \[sn_privacy.analyst\] | Privacy analysts are responsible for managing the privacy compliance posture of the processing activities owned by them.​ They perform the following tasks: * Assess the processing activities regularly by sending and reviewing privacy impact assessments. * Work with the management and business users to identify and manage controls related to a processing activity. * Manage and resolve the concerns of business users about compliance-related issues and policy exceptions. * Test and monitor control effectiveness. {#roles-installed-prm__ul_vjb_vmj_4qb} ​ | * sn_grc_workspace.task_reader * sn_compliance.policy_user * sn_compliance.library_user * sn_compliance.control_framework_user * sn_smart_asmt.template_reader * sn_privacy.business_user * sn_risk.implementation_user * sn_risk.library_user * sn_privacy_case.privacy_case_analyst {#roles-installed-prm__ul_k3m_r2p_gtb} If the sn_risk_advanced plugin is active: * sn_risk_advanced.ara_approver * sn_risk_advanced.ara_assessor {#roles-installed-prm__ul_k3m_s2p_gtb} If the sn_prm_gen_ai plugin is active: sn_reco_template.rationalization_process_writer If the sn_reg_body_mgmt plugin is active: sn_reg_body_mgmt.reader If the sn_smart_asmt plugin is active: sn_smart_asmt.assessment_reader |
| Privacy Manager \[sn_privacy.manager\] | Privacy managers are responsible for managing the overall organization level privacy compliance posture.​ They perform the following tasks: * Develop and implement privacy regulations, authority documents, and policies. * Review privacy regulatory requirements and policies. * Design and monitor controls to deal with violations of privacy regulations and internal policies. * Plan privacy programs and scope entities. * Create privacy impact assessment templates. * Continuously monitor control effectiveness and recommend effective improvements. * Supervise the privacy compliance team. * Report to management and the Board of Directors on compliance posture. * Discover who is implementing privacy regulation for the first time in their organization. {#roles-installed-prm__ul_mt4_mhj_4qb} | * sn_privacy.analyst * sn_grc_workspace.task_admin * sn_compliance.attestation_creator * sn_privacy_case.privacy_case_manager * sn_compliance.control_framework_manager * sn_compliance.library_manager * sn_compliance.policy_manager * sn_risk.implementation_manager * sn_risk.library_manager * sn_smart_asmt.template_contributor * sn_smart_asmt.template_manager {#roles-installed-prm__ul_p7n_t2p_gtb} If the sn_grc_pdr plugin is active: sn_grc_pdr.pdr_manager If the sn_privacy_content plugin is active: sn_esg_content.admin If the sn_prm_gen_ai plugin is active: sn_smart_imp_auto.automation_reader If the sn_grc_reg_change plugin is active: sn_grc_reg_change.manager If the sn_grc_ent_access plugin is active: sn_grc_ent_access.reader If the sn_reg_body_mgmt plugin is active: sn_reg_body_mgmt.writer If the sn_smart_asmt plugin is active: sn_smart_imp_auto.automation_reader |
| Privacy Admin \[sn_privacy.admin\] | Privacy administrators administer the privacy policy and compliance management. ​ Users assigned this role are responsible for configuring privacy management solutions as per the privacy team's requirements.​ They perform the following tasks: * Configure privacy impact assessments and automated flows to trigger assessments * Configure rules to auto-create processing activities out of privacy screening assessments. * Monitor the ServiceNow AI Platform dependencies with other applications and modules. * Can read the scripts under Processing activity script configurations related list. {#roles-installed-prm__ul_z2d_yjt_tqb}​ | * sn_privacy.manager * sn_risk_advanced.ara_admin * sn_privacy_case.privacy_case_admin * sn_compliance.control_framework_admin * sn_compliance.library_admin * sn_compliance.policy_admin * sn_grc_workspace.assessment_template_configuration_writer * sn_smart_asmt.assessment_admin {#roles-installed-prm__ul_q4r_u2p_gtb} If the sn_grc_pdr plugin is active: sn_grc_pdr.pdr_admin If the sn_grc_ent_access plugin is active: * sn_grc_ent_access.admin * sn_grc_ent_access.bulk_access_config_admin {#roles-installed-prm__ul_q4r_v2p_gtb} If the sn_smart_asmt plugin is active: sn_smart_imp_auto.automation_creator |
| Privacy assessment responder \[sn_privacy.assessment_responder\] | Privacy assessment responders can respond to the privacy assessments as key stakeholders. They can also raise privacy requests from the portal. | * sn_grc_workspace.task_reader * canvas_user * sn_grc_workspace.assessment_template_configuration_reader * sn_grc_workspace.user {#roles-installed-prm__ul_w5s_x2p_gtb} If the sn_smart_asmt plugin is active: sn_smart_asmt.actor |
| Privacy business user \[sn_privacy.business_user\] | Privacy business users can edit the assigned processing activities in the [Discover state](https://www.servicenow.com/docs/riqrZ0dM2pQQbywWCpGKvw "A processing activity workflow helps the privacy analysts to manage the life cycle of a processing activity."), and also respond to the assessments. | * sn_grc_workspace.task_reader * canvas_user * sn_privacy_case.privacy_case_business_user * sn_compliance.control_framework_business_user * sn_compliance.library_business_user * sn_compliance.policy_business_user * sn_grc_workspace.assessment_template_configuration_reader * sn_grc_workspace.user * sn_risk.implementation_business_user * sn_smart_asmt.actor * sn_smart_asmt.assessment_reader {#roles-installed-prm__ul_y6t_z2p_gtb} If the sn_risk_advanced plugin is active: sn_risk_advanced.ara_reader |
| Privacy developer \[sn_privacy.developer\] | Privacy developers can write custom scripts | * sn_privacy.admin * sn_compliance.compliance_shared_developer * sn_grc.grc_shared_developer {#roles-installed-prm__ul_b8v_a3p_gtb} |
| If the Privacy Employee User application is installed, then the following roles are available. |||
| Privacy employee user \[sn_privacy_emp.privacy_employee\] | Enables your employees to perform the following operations from the Employee Center: * Proactively request privacy impact assessments (PIAs) for new implementations, applications, and processes from the Employee Center. * Report privacy cases related to data privacy policy and regulatory violations. * Read and acknowledge organizational privacy policies * Create policy exceptions. * Create privacy issues. {#roles-installed-prm__ul_ecf_4l1_wbc} | * sn_grc.issue_employee_user * sn_compliance.policy_ack_employee_user * sn_compliance.policy_exception_employee_user {#roles-installed-prm__ul_dwp_3kz_xbc} |
| If the GRC: Privacy Lite User application is installed, then the following roles are considered as lite operators. |||
| * sn_privacy.assessment_responder * sn_privacy_case.privacy_case_business_user * sn_privacy.business_user * sn_grc_pdr.data_owner_admin {#roles-installed-prm__ul_vsc_mmb_wbc} | Users with the lite operator role can do the following: * Respond to privacy assessment tasks as business users. * Work on the processing activity as a business user when it's assigned to you to collect the required details. * Respond to the processing activity's criticality risk assessments and object-based assessment. * Respond to the detailed privacy risk assessments on each risk identified on a processing activity. * Work on breach assessments and other privacy case tasks. * Respond to the assessment and investigation tasks assigned by the privacy team. * Work on personal data rights action tasks to handle data according to the requester's requests. * Respond to the assigned control attestations. * View, update, and close assigned issues. * Create, update, and close assigned remediation tasks. * Respond to the assigned manual indicator tasks. {#roles-installed-prm__ul_bcb_vn1_wbc} |   |
[Table 1. Roles and their descriptions]

{#roles-installed-prm__table_m2t_czq_mqb}