Exploring Privacy Management

The ServiceNow® Privacy Management application enables you to manage your company’s privacy programs. Some examples of privacy programs are privacy regulatory compliance programs, privacy impact assessments, privacy policy management, and so on.

All organizations collect personal data of customers, employees, and third parties in some form. Some examples of personal data are as follows:

• Home address
• Location data
• Identification card number
• Biometric data

When your organization collects personal data, the data is exposed to multiple risks such as using the personal data for an organizational purpose without taking consent from the owners and the data getting inadvertently leaked. These events lead to compliance failure. Failure to manage data privacy laws can result in heavy fines and loss of customer and employee trust. This failure to protect data can also impact brand reputation.

The Privacy Management application helps you to manage multiple privacy regulations such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Australian Privacy Act. It also helps you to manage frameworks such as the National Institute of Standards and Technology (NIST), ISO 27001, and so on. The Privacy Management solution enables you to implement privacy policies and acknowledgments to handle the personal data of customers and employees.

The following are the key capabilities to help you manage your organization's privacy programs effectively:

• Creating an inventory of critical business processes, applications, and vendors for privacy assessments.
• Setting up the privacy library content such as authority documents, citations, control objectives, risk statements, and policies.
• Managing privacy impact assessments.
• Managing privacy risk assessments.
• Discovering processing activities that process personal information.
• Managing processing activities to track their risk and compliance posture with continuous monitoring and issue management capabilities.
• Understanding and analyzing the overall privacy posture of your organization with various dashboards and reports.

The Privacy Management application is available on the Privacy Workspace. This workspace displays Home page, the Tasks page, the Issues overview page, and the List view. Every item on and inside these pages and lists are only specific to the Privacy Management application. This means that, for example, if you view citations and authority documents, they are specific to Privacy Management.

The Privacy Management solution is available as an add-on in the Integrated Risk Management (IRM) suite.

• Processing activities
  A processing activity is a record that processes personal data. Examples of such records can be a business process or a business application of an organization that has personal information. Processing activities enable the privacy management teams to understand how personal information is being processed or used.
• Privacy classic assessments
  Privacy assessments are used to collect information from business owners. This information helps the privacy teams to understand how personal information (PI) is being used or stored in a processing activity.
• Smart assessments in Privacy Management
  The new and improved assessment experience in Privacy Management uses the Smart Assessment Engine (SAE) application. The assessment engine enables you to perform privacy screening and privacy impact assessments to collect the necessary information for the privacy teams.
• Risk assessments in Privacy Management
  You can perform risk assessments on your processing activities to determine their risk scores and find out the privacy risk posture of your organization.
• Information objects in Privacy Management
  The purpose of an information object is to logically describe the type of data that is exchanged between an application and a database.
• Privacy Workspace for the privacy manager
  The Privacy management dashboard provides a centralized interface for monitoring and managing privacy-related data processing activities within the organization.
• Privacy Workspace for the privacy analyst
  Privacy analysts manage the privacy compliance posture of the processing activity owned by them. Compliance posture refers to the overall compliance status of an organization, business process, or business application, and so on based on the compliant and non-compliant status of controls across various regulations.
• Privacy Management solution overview
  The Privacy Management solution provides you with a framework to manage your privacy-specific libraries such as citations, policies, control objectives, risk statements, privacy impact assessments, and privacy risk assessments. It also provides processing activity records to track privacy risk and compliance posture.
• Data subject types
  Data subjects are individuals whose personal data is collected, used, and processed by an organization. Data subject classification enables organizations to define and manage distinct groups, enabling a granular and context-specific representation of data processing activities.