ServiceNow Data Privacy The business challenge In modern enterprise environments, organizations handle troves of sensitive data including personally identifiable information (PII). This data is at risk of leakage and exfiltration by malicious actors, accidental exposure through misconfigured access controls, and memorization by GenAI, specifically LLMs during training or inference. It is crucial for organizations to safeguard the confidentiality of this information by enforcing stringent data privacy controls and implementing defense-in-depth security measures. The ServiceNow solution The ServiceNow Data Privacy solution is a bundled add-on to the out of the box Data Classification platform capability that adds Data Discovery and Data Anonymization. ServiceNow Data Classification ServiceNow Data Classification provides organizations a method for categorizing and managing data based on its level of sensitivity and the impact that unauthorized disclosure could have. Using predefined or custom data classifications, businesses can organize their data into different categories like Personally Identifiable Information (PII) or restricted data, ensuring that sensitive information is adequately protected. This organized approach aids in data protection planning and is a crucial step in forming and enhancing the overall data governance strategy. ServiceNow Data Discovery ServiceNow Data Discovery helps organizations to detect sensitive data such as PII/PHI within a ServiceNow instance. For structured sensitive data, such as, credit card numbers, phone numbers, social security numbers (SSN), etc. organizations can either use out-of-the- box common data patterns or create their own. For unstructured and often context-based sensitive data such as names, addresses, etc. organizations can rely on power of AI and machine learning to aid with identification. ServiceNow Data Anonymization ServiceNow Data Anonymization is a critical process for enterprises aiming to permanently remove or obscure sensitive data within databases, ensuring compliance with data privacy regulations. Organizations can utilize various techniques to anonymize data, ranging from partial anonymization such as the last four digits of a SSN, or full anonymization of a credit card number. Further, the ability to de-identify user data with pseudonyms or false identifiers, known as synthetic replacement, enterprises can maintain data structure integrity while ensuring privacy and regulatory compliance. Anonymization jobs can be scheduled, in real- time, or based on specific findings, across both production and non-production environments. One of the key use-cases is mitigating security and privacy risks when importing production data for testing purposes to be shared with developers and contractors working with real data. Benefits The ServiceNow Data Privacy solution is used in production and sub-production environments to discover and anonymize sensitive data. It is often used during cloning to remove sensitive data from lower environments (e.g., testing, development, staging) and as a means of maintaining compliance with security, privacy, and information technology policies and regulations. Data governance Organize and understand the sensitive data in your organization, apply appropriate security controls, and comply with regulatory requirements. Uncover dark data Identify undisclosed and unutilized sensitive data to mitigate the risk of its misuse and/or ingestion by GenAI. Realtime sensitive data handling Discover and anonymize sensitive data in real-time as it enters the platform or as it is updated to prevent the risk of unintentional data exposure. Ensure compliance Stay compliant with regulatory and privacy laws such as GDPR, HIPAA, CCPA and others by protecting personal and confidential information. Classify, Discover, Anonymize Sample Use Cases Preserving confidential Information during organizational collaboration: Sharing sensitive information is a significant challenge when enterprises collaborate. For instance, a healthcare provider may need to share patient data with a research organization developing medical treatments. By employing Data Anonymization techniques, all data fields that could identify the patient (such as name, age, gender, etc.) can be anonymized to protect patient confidentiality while retaining the valuable data attributes required by the research and development organization. Helping analytics teams get meaningful insights from customer data: Gaining customer insights is essential for businesses to drive continuous improvement. However, customers often hesitate to share their data due to concerns about potential misuse. It is imperative for retailers to safeguard customer information to adhere to regulatory and compliance standards. By employing data anonymization techniques, retailers can effectively remove, obscure, or de- identify personal data, thereby maintaining customer privacy and confidentiality. Detecting and handling sensitive data for auditors: Financial institutions must ensure that sensitive customer information is properly identified and managed to comply with stringent privacy and reporting regulations. Data Privacy is essential in this process, as it safeguards sensitive data, making it possible to share and analyze information without compromising privacy. Demonstrating to auditors that sensitive data is correctly detected, protected, or anonymized is crucial for compliance and maintaining trust. Data Privacy Features Core Platform Data Privacy Data Classification Classify table and column data based on sensitivity and risk. ✓ Incoming Email (RTA) Real-time discovery and anonymization of sensitive data found in incoming email. ✓ AI Agents Discovery and anonymization for real-time interactions with prompts, responses and data extraction. Includes synthetic data replacement to preserve data format. ✓ User Data Anonymization Anonymization of PII associated with users. ✓ Scheduled Jobs Scheduled as well as on-demand discovery and anonymization of sensitive data in tables. E.g. cloning, prod and sub-prod scans. ✓ Real-time Anonymization (RTA) Real-time data discovery and anonymization of sensitive data in tables and columns. ✓ Granular Findings Discover and review sensitive records in real-time within specific columns. ✓ Real-time APIs Real-time data discovery and anonymization APIs for admins and developers for custom workflows. ✓ AI Discovery Detect sensitive data that doesn’t follow standard patterns (e.g., names, organizations and addresses). ✓ Attachment Scanning Discover sensitive data in attachments, PDF, DOC(X), and TXT to notify admins. ✓ ServiceNow Data Privacy Dashboard Data Classification Types Anonymization Techniques Define Anonymization Policies AI/ML Data Discovery © 2025 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, Now Platform, an d other ServiceNow marks are trademarks and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other compan y names, product names, an d logos may be trademarks of the respective companies with which they are associated. servicenow.com