| \n\nXanadu\n\n | \n\n- **[Personal Data Rights](https://www.servicenow.com/docs/access?context=exploring-personal-data-rights&family=xanadu&ft:locale=en-US)**\n\nUse the Personal Data Rights application that provides configurable workflows to manage and automate personal data rights requests efficiently, reducing the risk of non-compliance. The Personal Data Rights application enables customers to efficiently manage and fulfill Data Subject Access Requests \\(DSARs\\), consumer rights requests, and so on, ensuring compliance with privacy regulations. The application helps organizations to handle requests related to the personal data rights of their consumers while ensuring that employees can maintain data protection standards globally.\n\n- **[Create data lineage](https://www.servicenow.com/docs/access?context=processing-activity-hierarchy&family=xanadu&ft:locale=en-US)**\n\nEstablish a data lineage to understand how data is being consumed and shared in a given processing activity. Creating a data lineage also helps you to understand and manage the associated risks for the data being shared. This feature provides a visual representation of data lineage or hierarchy.\n\n- **[Create a regulatory agency](https://www.servicenow.com/docs/access?context=add-a-regulatory-agency&family=xanadu&ft:locale=en-US)**\n\nCreate regulatory agencies in the Privacy Workspace to identify the relevant regulatory authorities that are responsible for overseeing the businesses in the public interest. The centralized library consolidates all regulatory communication via emails.\n\n- **[Collaborate and chat with cross-functional teams for processing activities, privacy cases, privacy assessments, and personal data rights requests](https://www.servicenow.com/docs/access?context=manage-discussions-of-a-pa&family=xanadu&ft:locale=en-US)**\n\nInitiate quick discussions with key stakeholders while working on a processing activity, privacy case, or a personal data rights request. The chat feature is integrated with Microsoft Teams and a group is automatically created on Microsoft Teams when a discussion is initiated. The chat conversations that take place using the **Discuss** button are stored in the respective record making it simpler for the privacy teams to refer to them when working on a task.\n\n- **[View smart attestations on the processing activities](https://www.servicenow.com/docs/access?context=ropa-record&family=xanadu&ft:locale=en-US)**\n\nUse the Smart Assessment Engine feature to respond to attestations. View the reports of the new control attestations on the landing pages of the privacy analyst and the privacy manager. Utilize the filter in the Attestations report to select if you want to view the classic attestations or the new attestations.\n\n- **[Changes in roles with the Privacy Employee user application](https://www.servicenow.com/docs/access?context=roles-installed-prm&family=xanadu&ft:locale=en-US)**\n\n**Note:** Only applicable to the customers with the GRC Privacy Employee User application \\(sn\\_privacy\\_emp\\) installed.\n\nWhen you install the new GRC Privacy Employee User application and assign the sn\\_privacy\\_emp.privacy\\_employee role to your employees, the role enables your employees to perform the following operations from the Employee Center:\n\n - Proactively request privacy impact assessments \\(PIAs\\) for new implementations, applications, and processes from the Employee Center.\n - Report privacy cases related to data privacy policy and regulatory violations.\n - Read and acknowledge organizational privacy policies.\n - Create policy exceptions.\n - Create privacy issues.\n- **[Changes in roles with the GRC: Privacy Lite User application](https://www.servicenow.com/docs/access?context=roles-installed-prm&family=xanadu&ft:locale=en-US)**\n\nIf the GRC: Privacy Lite User application \\(sn\\_privacy\\_lite\\) is installed, the following roles are considered as lite operators:\n\n - sn\\_privacy.business\\_user\n - sn\\_privacy.assessment\\_responder\n - sn\\_privacy\\_case.privacy\\_case\\_business\\_user\n - sn\\_grc\\_pdr.data\\_owner\\_admin\nUsers with the lite operator role can do the following:\n\n - Respond to privacy assessment tasks as business users.\n - Respond to the processing activity's criticality risk assessments and object-based assessment.\n - View, update, and close assigned issues.\n - Respond to the assigned control attestations.\n - Respond to the assigned manual indicator tasks.\n - Create, update, and close assigned remediation tasks.\n - Work on the processing activity as a business user when it’s assigned to you to collect the required details.\n - Work on breach assessments and other privacy case tasks.\n - Respond to the detailed privacy risk assessments on each risk identified on a processing activity.\n - Respond to the assessment and investigation tasks assigned by the privacy team.\n - Work on personal data rights action tasks to handle data according to the requester's requests.\n\n |
| \n\nYokohama\n\n | \n\n- **[\\[Placeholder link text to key bundle-grc.configure-criticality-factors\\]](https://www.servicenow.com/docs/access?context=configure-criticality-factors&family=yokohama&ft:locale=en-US)**\n\nLeverage criticality factors to evaluate the initial risks associated with processing activities. Integrate these factors into privacy assessments and automatically generate a criticality score upon assessment approval. These factors are also added to processing activities, enabling you to make updates at any time. Integrating these factors in a privacy assessment eliminates the need for a separate criticality assessment. This consolidation reduces the workload for the privacy teams.\n\n- **[Smart assessments](https://www.servicenow.com/docs/access?context=smart-assessments-in-privacy-management&family=yokohama&ft:locale=en-US)**\n\nUse the new and improved assessment experience that enables:\n\n - capturing the data elements, the information object attributes, hierarchies\n - building the assessment questionnaire\nThis new experience enables responders to update all the necessary details within the assessments, eliminating the need to update the processing activity separately.\n\n- **[Configure categories](https://www.servicenow.com/docs/access?context=configure-information-object-categories&family=yokohama&ft:locale=en-US)**\n\nImplement Information object categories to tag and classify information objects effectively. For example, attributes like iris scans and fingerprints are often referred to as biometric data, or email addresses and phone numbers can be tagged as contact information. Information object categories enable you to categorize these information objects under these broader classifications. This approach is useful in the following ways:\n\n - Enhances compliance with regulations such as GDPR, CCPA, and so on by accurately capturing and tracking required data categories.\n - Improves clarity for business users, ensuring they can easily identify and work with terms they’re familiar with while adhering to regulatory standards.\n - Streamlines data governance by creating a structured framework that supports both regulatory needs and business operations.\n- **[Smart assessment for privacy case management action tasks](https://www.servicenow.com/docs/access?context=accept-a-case-task&family=yokohama&ft:locale=en-US)**\n\nUse the new assessment experience of Smart Assessment Engine for privacy case action tasks. Only when an action task moves from the **Draft** to the **Assigned** state, the assessment can be sent. To use the smart assessment, a new property called enable\\_smart\\_assessments \\(sn\\_grc\\_case\\_mgmt.enable\\_smart\\_assessments\\) is introduced with the default value as **true**.\n\n\n |
| \n\nZurich\n\n | \n\n- **[Data subjects](https://www.servicenow.com/docs/access?context=data-subjects&family=zurich&ft:locale=en-US)**\n\nSelect and define the multiple data subject types for each processing activity. You can capture the volume of data subjects that were processed, the specific data elements that were collected from the users, and the user locations. With this feature, you get a realistic, granular, and scalable representation of your processing activities.\n\n- **[Privacy management dashboard](https://www.servicenow.com/docs/access?context=privacy-manager-dashboard&family=zurich&ft:locale=en-US)**\n\nGet an overview of your complete privacy risk and compliance posture from the Privacy Management dashboard so that you can quickly prioritize and remediate your processing activities. By looking at the Processing Activities, Risk & Compliance, and Operations & Case management sections, you can see the overall compliance score, trends, privacy criticality assessment scores, and risk heatmap. From the dashboard, you can also see information about the global legal framework to understand the regional obligations and the built-in risk metrics that automatically assess each processing activity.\n\n- **[New screening and PIA templates](https://www.servicenow.com/docs/access?context=privacy-mgmt-workflow&family=zurich&ft:locale=en-US)**\n\nUse the new Privacy Impact Assessments \\(PIAs\\) and Screening Assessment templates that provide standardized questions, evaluation criteria, and workflows so that you can perform a processing activity criticality and privacy risk assessment. With these new templates, you can ensure consistency, reduce manual effort, and support compliance with regulatory and organizational requirements.\n\n\n - **[PDR external-facing form](https://www.servicenow.com/docs/access?context=pdr-external-facing&family=zurich&ft:locale=en-US)**\n\nA new external-facing form for personal data rights \\(PDR\\) requests is now available, enabling customers, ex-employees, and third party individuals to initiate PDR requests directly from a company's website, without needing Employee Center access. The form allows users to submit various requests, including Right to Know, Right to Delete, Right to Correct, and Right to Opt-Out, with the flexibility to add additional request types as required. An email-based verification process ensures security before processing the PDR request. The PDR form is customizable and can be easily embedded on external sites.\n\n\n - **[Access control by legal entity](https://www.servicenow.com/docs/access?context=access-control-by-legal-entity&family=zurich&ft:locale=en-US)**\n\nThe Access control by legal entity feature allows teams to access processing activities relevant only to their legal entity. This ensures teams view only their own records, maintaining adherence to the privacy by design principle. By limiting access according to legal entities, this feature reduces operational risks and enables organizations to manage privacy requests and regulatory compliance effectively.\n\n\n - **[ServiceNow Otto for Privacy Management](https://www.servicenow.com/docs/access?context=now-assist-for-privacy-management&family=zurich&ft:locale=en-US)**\n\nNow Assist for Privacy Management leverages GenAI to support privacy workflows by summarizing risk assessments, condensing issue details, and identifying redundant control objectives and merging them into a common control objective. Now Assist for Privacy Management is delivered as a separate plugin, requiring administrators to activate specific skills and assign the new sn\\_prm\\_gen\\_ai.user role to access these features.\n\n\n - **[Report a privacy case through email](https://www.servicenow.com/docs/access?context=add-issues-email&family=zurich&ft:locale=en-US)**\n\nEmployees can now report privacy incidents directly through email, eliminating the need for complex forms or portals. This enhancement simplifies the reporting process, enabling faster case handling and efficient tracking of privacy issues.\n\n\n - **[Impacted and related areas configuration](https://www.servicenow.com/docs/access?context=configure-record-type-area&family=zurich&ft:locale=en-US)**\n\nThe Record Type Configuration feature allows privacy case managers or analysts to add additional relevant business area types in impacted and related areas. When creating or updating a privacy case, users can select from pre-defined options to add these areas, ensuring that each case accurately reflects its business context.\n\n\n |
| \n\nAustralia\n\n | \n\n- **[External-facing PDR form configuration](https://www.servicenow.com/docs/access?context=configure-pdr-ext-form&family=australia&ft:locale=en-US)**\n - Starting from version 22.3.x of Personal Data Rights \\(PDR\\), privacy administrators can navigate to **External form configuration** to tailor the public-facing PDR form for their organization. They can map jurisdictions to data subject types and request types, and specify whether an authorized agent can submit a request on behalf of a data subject for each jurisdiction.\n - For each jurisdiction, administrators can add terms and conditions, disclaimers, and guidance text that requesters see when they submit a request from that jurisdiction.\n - Administrators can also show or hide form fields based on the combination of jurisdiction, data subject type, and request type that a requester selects. The form collects only the information needed, therefore, requesters see only the fields that apply to their request.\n- **[Enable key stakeholders to edit processing activities](https://www.servicenow.com/docs/access?context=request-edit-access-pa&family=australia&ft:locale=en-US)**\n - Starting from version 22.3.x of Privacy Management, privacy analysts can add any user, including users without privacy roles, as a key stakeholder on a processing activity. Such users are set to **No privilege to respond to assessments** by default and therefore, can only view the record if they are granted the business user role.\n - Key stakeholders with the appropriate business user role can access and view the related lists of a processing activity directly from the Employee Center.\n - After they review the processing activity and find that it needs updating, they can select **Request edit access** to ask for editing rights to a processing activity.\n- **[New privacy content in Privacy Management Content](https://www.servicenow.com/docs/access?context=update-privacy-content&family=australia&ft:locale=en-US)**\n - Starting from version 22.3.x of Privacy Management Content, privacy managers can extend their regulatory library with new ready-to-use authority documents, Digital Personal Data Protection Act 2023 \\(DPDPA\\), Virginia Consumer Data Protection Act, and Colorado Privacy Act. When activating an authority document, they can select which citations to add to the library, and then select from the AI-generated control objectives already mapped to those citations.\n - Privacy Management Content also ships an updated version of privacy risk statement that carries forward the AI-generated risk statements from the previous version and adds new ones. Reinstalling the already existing risk statements after the update may overwrite certain changes made to them.\n- **[Smart assessment versioning of privacy assessment templates](https://www.servicenow.com/docs/access?context=create-new-smart-asmt-version&family=australia&ft:locale=en-US)**\n\nStarting from version 22.3.x of Privacy Management and Privacy Case Management, you can create a version of an existing privacy assessment template to revise the questionnaire, response options, or automations without disrupting assessments that are already in progress. New privacy assessments use the latest published version of the template.\n\n\n - **[Case summarization for privacy cases](https://www.servicenow.com/docs/access?context=privacy-case-summarization-skill&family=australia&ft:locale=en-US)**\n\nPrivacy analysts can now use the Now Assist case summarization feature to quickly understand a privacy case without manually reviewing every field or related list. Now Assist analyzes key case attributes, such as timelines, impacted areas, evidence, and actions, and generates a structured summary directly inside the privacy case. This feature solves a common problem: case data is often lengthy, scattered across multiple related lists, and difficult for analysts to digest efficiently. Analysts can also save and edit summaries as case data evolves, ensuring the record stays current.\n\n- **[Report a privacy case anonymously](https://www.servicenow.com/docs/access?context=report-privacy-case-anonymously&family=australia&ft:locale=en-US)**\n\nEmployees can now use the Anonymous Reporting Center to report privacy violations such as data breaches or exposure, unauthorized data use, privacy law violations \\(GDPR, CCPA\\), or other privacy-by-design lapses without revealing their identity or location.Accessed through the Employee Center, the Anonymous Reporting Center portal automatically logs users out to enforce anonymity, creates case records without mapping to employee identity, and provides a unique report key for secure follow-up communication.Reports are routed to the appropriate compliance team based on the nature of the concern. Throughout the investigation process:\n\n - Investigators can request additional information through a comments system visible to the reporter\n - Reporters can follow up on their case using their report key to check progress and respond to questions\n - All interactions maintain reporter anonymity at every step; no identity or location data is ever captured or linked\nThis enhancement enables organizations to build trust, mitigate risks before escalation, and ensures regulatory compliance with whistleblower protection requirements.\n\n- **[Hierarchy and lineage enhancements](https://www.servicenow.com/docs/access?context=hierarchy-tab&family=australia&ft:locale=en-US)**\n\nThe Hierarchy and lineage enhancements enables privacy teams to identify which systems, vendors, and applications belong to a specific processing activity by marking relationships as “part of a processing activity.” This ability differentiates scoped components from global or shared connections. Users can toggle between a processing‑activity‑scoped view and a full lineage view, helping them understand data flows in the appropriate context.\n\n- **[Privacy content accelerator](https://www.servicenow.com/docs/access?context=privacy-content-accelerator&family=australia&ft:locale=en-US)**\n\nThe privacy regulatory content through Unified Content Management provides pre‑built authority documents, citations, control objectives, and risk statements aligned with major privacy frameworks, including GDPR, CCPA, LGPD, and the NIST Privacy Framework 1.0. These resources are available for download directly from the Privacy Workspace, enabling teams to readily access standardized regulatory content.\n\n\n |
\n