--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-xanadu-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zx bundleId : - delta3zx --- # Combined Privacy Management release notes for upgrades from Xanadu to Zurich # Combined Privacy Management release notes for upgrades from Xanadu to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 13 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Privacy Management Release Notes for Upgrades from Xanadu to Zurich This consolidated release note summarizes the enhancements, changes, and important upgrade information for ServiceNow Privacy Management from the Xanadu through Zurich releases. It is designed to help ServiceNow customers understand new capabilities, role updates, UI improvements, and activation details relevant for upgrading and managing privacy compliance effectively within their organizations. Show full answer Show less ## Key Features * **Personal Data Rights Application (Xanadu):** Automates and manages data subject access requests (DSARs) and other personal data rights efficiently to support global compliance. * **Data Lineage Visualization (Xanadu):** Provides a visual representation of how data is consumed and shared during processing activities, aiding risk management. * **Regulatory Agency Library (Xanadu):** Centralizes regulatory authorities and communications to streamline compliance oversight. * **Integrated Collaboration (Xanadu):** Enables chat and collaboration via Microsoft Teams directly from privacy records, facilitating quick stakeholder engagement. * **Smart Assessment Engine Enhancements (Yokohama and Zurich):** Offers improved assessment experiences capturing detailed data elements, enabling responders to update assessments without separately updating processing activities, and supporting privacy case action tasks. * **Criticality Factors Integration (Yokohama):** Automates initial risk scoring by embedding criticality factors into privacy assessments and processing activities, reducing privacy teams' workload. * **Information Object Categories (Yokohama):** Introduces classification of data (e.g., biometric data, contact information) to align with regulatory standards and improve data governance clarity. * **Privacy Management Dashboard (Zurich):** Provides a unified overview of privacy risk, compliance scores, trends, and risk heatmaps to prioritize remediation efforts. * **External Personal Data Rights Request Form (Zurich):** Allows external users, including customers and third parties, to submit PDR requests securely via email verification without Employee Center access. * **Access Control by Legal Entity (Zurich):** Restricts access to processing activities by legal entity to enforce privacy-by-design principles and reduce operational risk. * **Now Assist for Privacy Management (Zurich):** Uses Generative AI to streamline privacy workflows by summarizing assessments, condensing issue details, and optimizing control objectives. * **Email Reporting of Privacy Cases (Zurich):** Simplifies the process for employees to report privacy incidents directly via email, enhancing incident tracking and response speed. * **Enhanced UI and Theming (Zurich):** Includes a revamped Processing Activity overview page with key metrics and a new Coral theme with dark mode for improved user experience. ## Role and Access Changes * **GRC Privacy Employee User Application:** Empowers employees to request privacy impact assessments, report privacy cases, acknowledge policies, and create privacy issues directly from the Employee Center. * **GRC Privacy Lite User Application:** Defines lite operator roles with capabilities to respond to assessments, manage issues, remediation tasks, and privacy case activities. ## Upgrade and Activation Information * Privacy Management must be installed via the ServiceNow Store for each release family (Xanadu, Yokohama, Zurich). * Before upgrading to Zurich, customers should review pre- and post-upgrade tasks outlined in the release notes to ensure a smooth transition. * Generative AI skills in Zurich are enabled by default for new customers and certain upgrades; administrators must assign appropriate roles and activate skills as needed. ## Accessibility and Localization * The new Coral theme includes a dark mode option to improve readability and reduce eye strain across web and mobile experiences. * No additional localization changes or browser requirements were introduced in these releases. ## Practical Implications for ServiceNow Customers Upgrading to Zurich enables organizations to automate and enhance privacy workflows, improve collaboration, and gain greater visibility into privacy risks through new dashboards and AI-powered assistance. The external PDR request form and enhanced access controls support regulatory compliance and privacy-by-design principles, while UI improvements facilitate more efficient privacy operations. Customers should plan upgrades carefully, activate new features as appropriate, and leverage role changes to empower employees and business users in privacy management tasks. Consolidated page of all release notes for Privacy Management from Xanadu to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Privacy Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Privacy Management to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-privacymanagement-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Privacy Management. {#dfrn3-privacymanagement-summary__entry__10} | Release | Release notes | |-|-| | Xanadu | [Personal Data Rights](https://www.servicenow.com/docs/access?context=exploring-personal-data-rights&family=xanadu&ft:locale=en-US) : Use the Personal Data Rights application that provides configurable workflows to manage and automate personal data rights requests efficiently, reducing the risk of non-compliance. The Personal Data Rights application enables customers to efficiently manage and fulfill Data Subject Access Requests (DSARs), consumer rights requests, and so on, ensuring compliance with privacy regulations. The application helps organizations to handle requests related to the personal data rights of their consumers while ensuring that employees can maintain data protection standards globally. [Create data lineage](https://www.servicenow.com/docs/access?context=processing-activity-hierarchy&family=xanadu&ft:locale=en-US) : Establish a data lineage to understand how data is being consumed and shared in a given processing activity. Creating a data lineage also helps you to understand and manage the associated risks for the data being shared. This feature provides a visual representation of data lineage or hierarchy. [Create a regulatory agency](https://www.servicenow.com/docs/access?context=add-a-regulatory-agency&family=xanadu&ft:locale=en-US) : Create regulatory agencies in the Privacy Workspace to identify the relevant regulatory authorities that are responsible for overseeing the businesses in the public interest. The centralized library consolidates all regulatory communication via emails. [Collaborate and chat with cross-functional teams for processing activities, privacy cases, privacy assessments, and personal data rights requests](https://www.servicenow.com/docs/access?context=manage-discussions-of-a-pa&family=xanadu&ft:locale=en-US) : Initiate quick discussions with key stakeholders while working on a processing activity, privacy case, or a personal data rights request. The chat feature is integrated with Microsoft Teams and a group is automatically created on Microsoft Teams when a discussion is initiated. The chat conversations that take place using the Discuss button are stored in the respective record making it simpler for the privacy teams to refer to them when working on a task. [View smart attestations on the processing activities](https://www.servicenow.com/docs/access?context=ropa-record&family=xanadu&ft:locale=en-US) : Use the Smart Assessment Engine feature to respond to attestations. View the reports of the new control attestations on the landing pages of the privacy analyst and the privacy manager. Utilize the filter in the Attestations report to select if you want to view the classic attestations or the new attestations. [Changes in roles with the Privacy Employee user application](https://www.servicenow.com/docs/access?context=roles-installed-prm&family=xanadu&ft:locale=en-US) : Note: Only applicable to the customers with the GRC Privacy Employee User application (sn_privacy_emp) installed. When you install the new GRC Privacy Employee User application and assign the sn_privacy_emp.privacy_employee role to your employees, the role enables your employees to perform the following operations from the Employee Center: * Proactively request privacy impact assessments (PIAs) for new implementations, applications, and processes from the Employee Center. * Report privacy cases related to data privacy policy and regulatory violations. * Read and acknowledge organizational privacy policies. * Create policy exceptions. * Create privacy issues. [Changes in roles with the GRC: Privacy Lite User application](https://www.servicenow.com/docs/access?context=roles-installed-prm&family=xanadu&ft:locale=en-US) : If the GRC: Privacy Lite User application (sn_privacy_lite) is installed, the following roles are considered as lite operators: * sn_privacy.business_user * sn_privacy.assessment_responder * sn_privacy_case.privacy_case_business_user * sn_grc_pdr.data_owner_admin Users with the lite operator role can do the following: * Respond to privacy assessment tasks as business users. * Respond to the processing activity's criticality risk assessments and object-based assessment. * View, update, and close assigned issues. * Respond to the assigned control attestations. * Respond to the assigned manual indicator tasks. * Create, update, and close assigned remediation tasks. * Work on the processing activity as a business user when it's assigned to you to collect the required details. * Work on breach assessments and other privacy case tasks. * Respond to the detailed privacy risk assessments on each risk identified on a processing activity. * Respond to the assessment and investigation tasks assigned by the privacy team. * Work on personal data rights action tasks to handle data according to the requester's requests. | | Yokohama | [\[Placeholder link text to key bundle-grc.configure-criticality-factors\]](https://www.servicenow.com/docs/access?context=configure-criticality-factors&family=yokohama&ft:locale=en-US) : Leverage criticality factors to evaluate the initial risks associated with processing activities. Integrate these factors into privacy assessments and automatically generate a criticality score upon assessment approval. These factors are also added to processing activities, enabling you to make updates at any time. Integrating these factors in a privacy assessment eliminates the need for a separate criticality assessment. This consolidation reduces the workload for the privacy teams. [Smart assessments](https://www.servicenow.com/docs/access?context=smart-assessments-in-privacy-management&family=yokohama&ft:locale=en-US) : Use the new and improved assessment experience that enables: * capturing the data elements, the information object attributes, hierarchies * building the assessment questionnaire This new experience enables responders to update all the necessary details within the assessments, eliminating the need to update the processing activity separately. [Configure categories](https://www.servicenow.com/docs/access?context=configure-information-object-categories&family=yokohama&ft:locale=en-US) : Implement Information object categories to tag and classify information objects effectively. For example, attributes like iris scans and fingerprints are often referred to as biometric data, or email addresses and phone numbers can be tagged as contact information. Information object categories enable you to categorize these information objects under these broader classifications. This approach is useful in the following ways: * Enhances compliance with regulations such as GDPR, CCPA, and so on by accurately capturing and tracking required data categories. * Improves clarity for business users, ensuring they can easily identify and work with terms they're familiar with while adhering to regulatory standards. * Streamlines data governance by creating a structured framework that supports both regulatory needs and business operations. [Smart assessment for privacy case management action tasks](https://www.servicenow.com/docs/access?context=accept-a-case-task&family=yokohama&ft:locale=en-US) : Use the new assessment experience of Smart Assessment Engine for privacy case action tasks. Only when an action task moves from the Draft to the Assigned state, the assessment can be sent. To use the smart assessment, a new property called enable_smart_assessments (sn_grc_case_mgmt.enable_smart_assessments) is introduced with the default value as true. | | Zurich | [Data subjects](https://www.servicenow.com/docs/access?context=data-subjects&family=zurich&ft:locale=en-US) : Select and define the multiple data subject types for each processing activity. You can capture the volume of data subjects that were processed, the specific data elements that were collected from the users, and the user locations. With this feature, you get a realistic, granular, and scalable representation of your processing activities. [Privacy management dashboard](https://www.servicenow.com/docs/access?context=privacy-manager-dashboard&family=zurich&ft:locale=en-US) : Get an overview of your complete privacy risk and compliance posture from the Privacy Management dashboard so that you can quickly prioritize and remediate your processing activities. By looking at the Processing Activities, Risk \& Compliance, and Operations \& Case management sections, you can see the overall compliance score, trends, privacy criticality assessment scores, and risk heatmap. From the dashboard, you can also see information about the global legal framework to understand the regional obligations and the built-in risk metrics that automatically assess each processing activity. [New screening and PIA templates](https://www.servicenow.com/docs/access?context=privacy-mgmt-workflow&family=zurich&ft:locale=en-US) : Use the new Privacy Impact Assessments (PIAs) and Screening Assessment templates that provide standardized questions, evaluation criteria, and workflows so that you can perform a processing activity criticality and privacy risk assessment. With these new templates, you can ensure consistency, reduce manual effort, and support compliance with regulatory and organizational requirements. [PDR external-facing form](https://www.servicenow.com/docs/access?context=pdr-external-facing&family=zurich&ft:locale=en-US) : A new external-facing form for personal data rights (PDR) requests is now available, enabling customers, ex-employees, and third party individuals to initiate PDR requests directly from a company's website, without needing Employee Center access. The form allows users to submit various requests, including Right to Know, Right to Delete, Right to Correct, and Right to Opt-Out, with the flexibility to add additional request types as required. An email-based verification process ensures security before processing the PDR request. The PDR form is customizable and can be easily embedded on external sites. [Access control by legal entity](https://www.servicenow.com/docs/access?context=access-control-by-legal-entity&family=zurich&ft:locale=en-US) : The Access control by legal entity feature allows teams to access processing activities relevant only to their legal entity. This ensures teams view only their own records, maintaining adherence to the privacy by design principle. By limiting access according to legal entities, this feature reduces operational risks and enables organizations to manage privacy requests and regulatory compliance effectively. [ServiceNow Otto for Privacy Management](https://www.servicenow.com/docs/access?context=now-assist-for-privacy-management&family=zurich&ft:locale=en-US) : Now Assist for Privacy Management leverages GenAI to support privacy workflows by summarizing risk assessments, condensing issue details, and identifying redundant control objectives and merging them into a common control objective. Now Assist for Privacy Management is delivered as a separate plugin, requiring administrators to activate specific skills and assign the new sn_prm_gen_ai.user role to access these features. [Report a privacy case through email](https://www.servicenow.com/docs/access?context=add-issues-email&family=zurich&ft:locale=en-US) : Employees can now report privacy incidents directly through email, eliminating the need for complex forms or portals. This enhancement simplifies the reporting process, enabling faster case handling and efficient tracking of privacy issues. [Impacted and related areas configuration](https://www.servicenow.com/docs/access?context=configure-record-type-area&family=zurich&ft:locale=en-US) : The Record Type Configuration feature allows privacy case managers or analysts to add additional relevant business area types in impacted and related areas. When creating or updating a privacy case, users can select from pre-defined options to add these areas, ensuring that each case accurately reflects its business context. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Privacy Management features. {#dfrn3-privacymanagement-summary__entry__18} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Tagging of information object tags](https://www.servicenow.com/docs/access?context=tag-io-with-pi&family=yokohama&ft:locale=en-US) : Use the Data classification field to tag information objects instead of using the tag icon. [Initiating privacy assessment](https://www.servicenow.com/docs/access?context=send-privacy-asmt-from-pa&family=yokohama&ft:locale=en-US) : When you initiate a privacy assessment from either an entity or a processing activity, you're no longer redirected to the Create new privacy assessment form, instead, a new pop-up window appears where you can specify all the assessment details. | | Zurich | [Some generative AI skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=zurich&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install an AI product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Australia Early Access): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Processing activity tab](https://www.servicenow.com/docs/access?context=processing-activity-tab&family=zurich&ft:locale=en-US) : The revamped Processing Activity overview page provides a unified dashboard that displays key compliance and risk metrics, such as risk scores, compliance scores, and criticality scores. This update makes it easier for privacy managers and analysts to assess the status of each processing activity, track open issues, and prioritize actions. Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Layout for processing activity record view](https://www.servicenow.com/docs/access?context=processing-activity-homepage&family=zurich&ft:locale=en-US) : The vertical layout of a processing activity enables you to see the information in a top-down linear flow. With this layout, you can see the sequential representation of a data processing workflow. [Privacy management home page](https://www.servicenow.com/docs/access?context=privacy-mgmt-ws-privacy-compliance-manager&family=zurich&ft:locale=en-US) : The enhanced Privacy Management home page now has dedicated tabs for Processing Activity, Risk and compliance, Operations, and Privacy Cases. This updated layout helps to improve readability by organizing your reports into clearly defined sections. | [ ] ## Removed Between your current release family and Zurich, some Privacy Management features or functionality were removed. {#dfrn3-privacymanagement-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Privacy Management features or functionality were deprecated. {#dfrn3-privacymanagement-summary__entry__34} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Privacy Management. {#dfrn3-privacymanagement-summary__entry__42} | Release | Release notes | |-|-| | Xanadu | Install Privacy Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=xanadu&ft:locale=en-US). | | Yokohama | Activation information : Install Privacy Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Privacy Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Privacy Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Privacy Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Privacy Management we have noted them here. {#dfrn3-privacymanagement-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Privacy Management we have noted them here. {#dfrn3-privacymanagement-summary__entry__58} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Privacy Management, such as specific requirements or compliance levels. {#dfrn3-privacymanagement-summary__entry__66} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Privacy Management we have noted them here. {#dfrn3-privacymanagement-summary__entry__74} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Privacy Management we have noted them here. {#dfrn3-privacymanagement-summary__entry__82} | Release | Release notes | |-|-| | Xanadu | * Use the Personal Data Rights application to manage personal data rights requests from your customers or consumers, and employees in compliance with global privacy regulations. * Establish a data lineage to visualize data consumption, sharing, and the associated risks for a processing activity. * Use the Smart Assessment Engine to respond to and view new control attestations related to your processing activity. * Create a regulatory agency library to store and access regulatory details, including correspondence with the regulators. * Initiate chats from privacy assessments, processing activities, privacy cases, and personal data rights requests to collaborate with various teams to ensure quick responses. See [Explore](https://www.servicenow.com/docs/access?context=explore-privacy-management&family=xanadu&ft:locale=en-US) for more information. | | Yokohama | * Integrate criticality factors into assessments and processing activities thereby simplifying the assessment process, and reducing the workload for privacy teams. * Use the Smart Assessment Engine to capture details regarding information objects and hierarchies, updating all details within the assessments and eliminating the need to separately update processing activities. * Implement information Object (IO) categories such as biometric data, to align with regulatory classifications and bridge the gap between requirements and user understanding. * Empower privacy case analysts to perform assessments on privacy cases using the Smart Assessment Engine See [Privacy Management](https://www.servicenow.com/docs/access?context=privacy-management&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * A new external Personal data rights (PDR) request form enables customers, ex-employees, and third parties to submit PDR requests from a website with email verification. * Access Control by Legal Entity feature enables teams to access only processing activities relevant to their legal entity, maintaining privacy by design principle. * Now Assist for Privacy Management plugin uses Generative AI to streamline privacy workflows by summarizing assessments, condensing issues, and merging control objectives. * Reporting privacy incidents through email feature enables employees to report privacy incidents directly through email. * Impacted and related areas configuration allows privacy case managers to add custom business area types to privacy cases for better context. * Revamped Processing Activity overview page provides a unified dashboard showing key compliance and risk metrics for processing activities. See [Privacy Management](https://www.servicenow.com/docs/access?context=privacy-management&family=zurich&ft:locale=en-US) for more information. | [ ]