Privacy Workspace

As a case task owner, accept the task, provide the details requested by the case analyst, and submit it for a review. If a case task is assigned to an assignment group, and not to a specific user, then any user who is a part of the assignment group can accept the task and work on it.

Accept Personal Data Rights (PDR) tasks that are assigned to you. Unless you accept the work, you will not be able to work towards closing the task.

Access to processing activity records can be restricted by using Entity-Based Access (EBA).

Generate AI-assisted recommendations while reviewing a privacy assessment to quickly identify relevant control objectives from the privacy library.

Generate AI-assisted recommendations while reviewing a privacy assessment to quickly identify relevant risk statements from the privacy library.

Activate the GRC case summarization skill from the AI Admin Hub to generate AI-powered summaries of privacy case records.

Add data subject types to a processing activity in the Privacy Workspace.

Add a regulatory agency in the Privacy Workspace to identify the relevant regulatory authorities that are responsible for overseeing the industries or sectors within each jurisdiction. The jurisdictions consolidate all the regulatory communications via emails and implement the notification rules for data privacy or security breaches for the reported privacy cases.

Create action tasks for a Personal Data Rights request and assign them to the appropriate task owners. Action tasks are tasks that are created to facilitate and complete a valid personal data rights request

Define the root cause for the reported privacy case or event and its consequences on the organization using the Privacy Case Management application.

Add data subject types to privacy impact assessment from the Employee Center.

Define hierarchical relationships between entities (Global → Regional → Country-level) using Upstream and Downstream options. Adding an hierarchy creates a clear organizational structure.

Add the impacted areas or objects that are affected by the privacy case or event in the Privacy Case Management application.

Identify and manage issues related to the impacted areas for the reported privacy case. You can also create issues from the Privacy Case Management landing page.

Identify and manage issues related to the impacted areas for the reported privacy case. You can also create issues from the Privacy Case Management landing page.

Add key stakeholders to a privacy case to identify the key members who are responsible for the data that is lost during the breach. You can then send the respective breach assessments to the stakeholders based on their responsibilities.

To identify the types of personal data compromised during a breach, add [PI] information objects to a privacy case.

Add the necessary regulations that are or can be impacted by the case that has been reported. In the ServiceNow platform, regulations are captured as authority documents. Adding the regulations to the case enables you to identify which regulations are breached or violated and prevents penalties and fines.

Add the related areas that are related to a privacy case or event reported in the Privacy Case Management application.

Add key stakeholders to a processing activity. Based on their role, users are assigned default processing activity privileges that control whether they can edit a processing activity, view it, or respond to its privacy assessments.

Assign a transfer mechanism to a data transfer record to document the legal safeguard that permits the transfer of personal data.

Privacy analysts reviewing an assessment can use AI-assisted recommendations to quickly identify control objectives and risk statements that are most likely to apply to a processing activity.

The fields in the Report a privacy case form capture information about the suspected or confirmed privacy issue while keeping the reporter's identity confidential.

Enable stakeholders to update processing activities directly from the Employee Center by assigning the activity to them.

Case tasks help you to collaborate with multiple teams to investigate, perform impact assessment to establish case criticality, and gather evidence to capture the details and responses for further review.

Learn about the fields on the cause and consequence form. Use this form to define cause and consequence in the Privacy Case Management application.

Classify a data subject type as vulnerable. When you mark a data subject type as vulnerable, the criticality score is calculated as High.

Several types of components are installed with installation of the Privacy Case Management application, including tables, user roles.

Enable data subject selection in custom relationship types by configuring the sn_privacy.relationship_involving_data_subjects system property.

Specify which data subject types the external-facing Personal Data Rights (PDR) form offers in each location, so the form presents only the data subject types that local regulation supports.

Create the parent external form configuration record that anchors all location, data subject type, and request type rules for the external-facing Personal Data Rights (PDR) form.

Configure the jurisdictions, authorized agent option, and per-location URLs for the external-facing Personal Data Rights (PDR) form. These settings determine what requesters in each jurisdiction see based on their local privacy rules.

Integrate RadarFirst with Privacy Case Management to analyze breaches and receive regulatory guidance for each impacted jurisdiction.

Write custom scripts on the assessment templates to update the processing activity fields using a script. The script runs when the assessment response is completed. You can write multiple scripts for both screening assessments and impact assessments.

Create a privacy assessment template using the Smart Assessment Engine as a base for sending screening assessments and use it to detect the privacy risks and mitigate those risks.

Configurie Entity-based access control in Privacy Management, including property activation, hierarchy setup, record mapping, user assignment, bulk updates, and activating entity-based record access rules.

Configure entity-based access by installing the Entity-based Access Configurations plugin and enabling properties for record types.

Configure information object categories to classify information objects effectively. For example, attributes like iris scans and fingerprints are often referred to as biometric data, or email addresses and phone numbers can be grouped as contact information. Information object categories enable you to categorize these information objects under these broader classifications.

Privacy teams can tailor the external-facing Personal Data Rights (PDR) form per jurisdiction and data subject type. This customization allows them to control location specific content, authorized agent submission, and the available request types.

Create a request type in the Personal Data Rights application to categorize and manage the personal data rights requests. After you create a request type, the personal data rights agents and the task owners can select the required request type on the request form while working on a personal data rights request.

Follow the order of the steps such as creating breach factor types, breach factors, PI data element types, and PI data elements to configure privacy breach assessment.

Follow the order of the tasks given here to configure Privacy Management. These tasks will help you manage your privacy program effectively.

Create privacy assessment templates using the Smart Assessment Engine as a base for sending privacy impact assessments and using them to detect the privacy risks and mitigate those risks.

Set up the Personal Data Rights to address various types of data rights request.

Follow the order of the tasks given here to configure Privacy Case Management application. These tasks help you to manage the compliance cases effectively.

Map some of the processing activity fields with the responses of the assessment questions to update the processing activity details based on the assessment response.

Create categories to help responders to identify breach factors within specific categories. For example, incident nature is a breach factor type which has factors under it as Intentional and Malicious, or Intentional and not malicious, and Unintentional or inadvertent.

Define new relationships in a hierarchy directly on a processing activity to record how it connects to vendors, applications, systems, and other processing activities across regions. This enables you to track cross-border data transfers and generate a lineage map to visualize data consumption, sharing, and the associated risks for a processing activity.

Record a data transfer directly on a processing activity if it wasn't captured as part of a hierarchy relationship.

Create jurisdictions for regions for data breach notification obligations as each obligation is broken down by jurisdiction. Jurisdiction can be created two levels below a region.

Define the transition conditions to control how a compliance case traverses through the different workflow states by using the Privacy Case Management application.

Create a request regarding your personal data to request access to, correction of, or deletion of personal information held by an organization or entity.

Report any privacy breaches and complaints to help reduce and avert losses.

Create geographic regions based on the data of the residents that is collected as a part of your business operations. Examples of regions are America, Europe, Asia Pacific, and so on.

Configure a risk assessment methodology (RAM) in the Privacy Management application so that you can assess the risks in your organization.

Create action task templates accessible to personal data rights administrators to align with various request types, such as the right to correct, delete, know, or opt-out. Using these templates for auto-generated action tasks ensures that each task meets the specific requirements of the request type. This alignment guarantees consistency, compliance, and efficiency in handling personal data rights requests.

Create your assessment configurations to determine when a processing activity must be automatically created.

Create various types of assessments and send those assessments to the business process or business application owners to collect their responses. The responses help you to understand how personal information (PI) is being used or stored in a processing activity.

Create breach factors to help privacy teams understand the characteristics of a breach and evaluate the related risks. Exercise your flexibility to either use the default breach factors or generate new ones. Additionally, link breach factors to specific regions or implement them universally across multiple regions or selected ones.

Set access restrictions for the existing records in bulk by using the Entity based record access update utility guided-experience. Use the workflow to enable or disable access to record types.

Add new controls or manage the controls that are automatically added to the processing activity from the assessment responses. Adding controls ensures that the appropriate regulations are applied to the processing activity.

Create a repository of the users and specify the owners of various applications. This repository helps to identify which user must be assigned the personal data rights (PDR) request tasks.

Create information objects manually to associate the right data subject types with business processes or applications.

Add information objects to the processing activity after a processing activity is created. Adding information objects helps you understand the types of personal information that is being processed and the way it is processed. This task helps in applying the appropriate controls to the processing activity.

Publish a new version of a smart assessment template to revise its questionnaire, response options, or automations. Each version maintains a change history of templates used in privacy screening, impact, and breach assessments.

Create an organizational structure by configuring entity-based access for different levels such as headquarters, regional offices, and subsidiaries. Define access rules for users and groups.

Create issues or add existing issues for a processing activity. Associating issues to a processing activity helps you to identify and prioritize remediation actions. Relating issues reduces the number of issues customers need to manage, thus improving the overall organizational efficiency in management of these issues.​

Add new risks or manage the risks that are automatically added to the processing activity from the assessment responses. Adding risks helps you manage processing activities using the risk-based approach.

Create categories to help responders to identify personal data elements within specific categories. For example, for a PI data element type such as Personal information, the PI data elements can be Name, Age, Employer ID, Marital Status, Email, and so on.

Create PI data elements based on residents' personal information collected during the business process, such as phone numbers and email IDs. Use pre-configured elements or create new ones. Customize for data elements for specific regions or map a single PI data element to multiple regions.

Manually create a processing activity or update a processing activity that is automatically created out of a privacy screening assessment. You can also update a processing activity that is created from an entity record. When you update a processing activity, you can fill in the relevant details about the personal data that is being processed.

Data subjects are individuals whose personal data is collected, used, and processed by an organization. Data subject classification enables organizations to define and manage distinct groups, enabling a granular and context-specific representation of data processing activities.

Organizations often transfer personal data between applications, vendors, business units, and regions, which are subject to privacy regulations. Privacy Management captures each movement as a data transfer record on the processing activity to help you comply with privacy regulations.

Define the workflow states for a privacy case that govern the lifecycle of the case.

Delete a data transfer record from a processing activity.

Delete the controls that are no longer required in the processing activity.

Delete a lineage to remove a specific connection or node from the hierarchy of a processing activity.

This is an overview of domain separation and the Governance, Risk, and Compliance application Privacy Management. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Before you run GRC: Privacy Management (sn_privacy) in your instance, you must download it from the ServiceNow Store.

Use entity-based record access rules to secure records and enable continuous monitoring. These rules automatically apply restrictions to new or modified records, ensuring access settings stay enforced without manual updates. When entities or processing activities change, the system updates access controls automatically.

Add details such as justification for storing data to an information object after you add it to the processing activity. Adding details enables you to define how the personal data is being processed.

Edit an existing lineage relationship to update the relationship type, description, or key relationship status of a connected node.

A privacy breach assessment must clearly indicate the jurisdiction in which the breach occurred. This is crucial because each jurisdiction operates under distinct laws and regulations pertaining to privacy and data protection. It must also specify the personally identifiable information (PI) artifacts.

When a privacy manager plans the privacy program for an organization, the first step is to scope those business applications or processes that contain personal data. In Governance, Risk, and Compliance, these business applications or business processes are called as entities. After you identify the entities processing personal data, the processing activities are automatically created.

The ServiceNow Privacy Management application enables you to manage your company’s privacy programs. Some examples of privacy programs are privacy regulatory compliance programs, privacy impact assessments, privacy policy management, and so on.

Personal data rights (PDR) refer to the legal rights individuals have regarding the collection, use, storage, and protection of their personal data.

Export a privacy case as a PDF to easily share it with various stakeholders.

Use the field descriptions as reference when you fill the external-facing Personal Data Rights (PDR) form.

Populate a new location configuration record. Field choices determine whether requesters in the mapped jurisdictions see authorized agent paths, what URLs the form links to, and what introductory text appears at the start of the Personal Data Rights (PDR) form.

Automatically create action tasks for a personal data rights request. These action tasks are generated based on the data registry that is created by the personal data rights admin and are assigned to the right data owners.

Review the skill details on each configuration tab before activating the GRC case summarization skill. Even after activation, these fields can be edited to refine the AI-generated summary.

The Hierarchy tab connects your processing activity to applications, vendors, companies, entities, business processes, and other activities. It builds a clear picture of how data moves through your organization.

Import jurisdictions, risk factors, and data elements from RadarFirst to map them to the breach assessment data in your instance.

The purpose of an information object is to logically describe the type of data that is exchanged between an application and a database.

Initiate a breach assessment from a privacy case to capture the details of breach, the type of data that is impacted, and so on. These details help the privacy analyst to identify if the breach must be notified to a regulator.

Map the data elements and breach factors linked to the breach assessment regions in your instance to RadarFirst.

You can install the Privacy Case Management application (sn_privacy_case) if you have the admin role.If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.

The integration of Employee Center with Privacy Management provides all employees and users a simplified user experience to perform tasks such as submitting a privacy impact assessment for a new implementation, responding to control attestations, and accessing processing activities and privacy impact assessments.

The Governance, Risk, and Compliance: Privacy Case Management application enables users to report any privacy breaches or complaints, collaborate with key stakeholders, perform breach investigations, and analyse the causes and consequences of breaches.

RadarFirst specializes in privacy and incident response solutions, particularly in the context of data breach incidents. RadarFirst helps organizations manage and respond to data breaches and privacy incidents effectively.

After a privacy analyst initiates a privacy breach assessment, the assigned reviewer contributes their insights and includes the personally identifiable information (PI) artifacts and relevant jurisdictions before it is completed and closed.

Data lineage is the visual representation of the relationships you define in a hierarchy. You can add new relationships directly from the lineage map in a processing map.

Initiate quick discussions with key stakeholders while working on a processing activity, privacy case, or a personal data rights request. The chat feature is integrated with Microsoft Teams and a group is automatically created on Microsoft Teams when a discussion is initiated.

Keep your processing activity updated and in sync with any table in ServiceNow by mapping the entity fields with the processing activity.

Map the configured breach assessment regions and jurisdictions in your instance to those imported from RadarFirst.

Configure the request types available to each data subject type within a jurisdiction. When a requester selects a data subject type in the external-facing Personal Data Rights (PDR) form, only the request types scoped to it appear.

Map the risk statements to the responses of the assessment questions to automatically create and apply the respective risks on the processing activity.

You can modify the email templates to align the messages with your organization’s branding, or to add disclaimers required by regional regulations.

Use the new action task form to create action tasks for the appropriate owners.

Use the Personal data rights request form in the Personal Data Rights application to initiate a process to access, correct, or delete personal data.

Use the fields on the new privacy assessment creation form to create a new privacy assessment.

When you create a new hierarchy relationship in Privacy Management, you first define how a node is related to another, and then provide details for each related node.

ServiceNow Otto for Privacy Management is a GenAI‑powered capability that streamlines privacy workflows by summarizing risk assessments, condensing issue details, and identifying redundant control objectives for rationalization into a common control objective.

The Operations tab on the privacy management dashboard offers visibility into operational performance across key privacy compliance processes, supporting proactive management and confirming adherence to regulatory and internal risk standards.

After a breach assessment is completed, the overview page of the assessment displays the summary of the relevant and critical information for the privacy analyst to review.

The Privacy case overview page shows details, such as description, state, schedule and milestones, case tasks, and issues related to the case in the Privacy Case Management application.

Reference topics provide additional information about the Privacy Case Management application including tables.

Use the GRC Model State Transition Condition form to define the transition conditions to control how a compliance case traverses through the different workflow states by using the Privacy Case Management application.

The Privacy Case Management solution provides you a framework to manage any privacy breaches reported by the users. The solution provides an end-to-end workflow for the privacy team to triage the reported breach and perform the required investigation and analysis, gather evidence, record the key stakeholders, impacted areas, and regulatory violations, if any.

An external facing Personal Data Rights (PDR) form configuration record holds the form-wide content that the requester sees across regions.

The Personal Data Rights (PDR) external-facing form enables secure submission of Data Subject Requests (DSRs) from a public website, without logging in. The form is customizable, supports jurisdiction-based privacy rights, and verifies requester identity via email before creating a case.

Reference topics provide additional information such as tables, and roles that are installed with the Personal Data Rights application. These topics also provide supporting information.

Use the Request Type form in the Personal Data Rights application to categorize the personal data rights requests by their type.

Use the Tasks page on the Employee Center for a consolidated view of all your privacy tasks, including all assessments, enabling you to access and complete them efficiently.

The Personal Data Rights Workspace offers you the ability to create new personal data rights request and view the requests by their type, due date, and status.

The GRC: Personal Data Rights application enables you to exercise control over your personal data.

To perform a processing activity criticality and privacy risk assessment, two risk assessment methodologies (RAMs) are provided by default.

Privacy assessments can be sent using various methods such as entities, entity types, and processing activities.

Privacy breach assessments play an important role whenever there is an incident that threatens the privacy of individuals. These assessments help to determine if there is a breach and then serve as a measure to gauge the extent and impact of a breach.

On the new privacy case form in the Employee Center, fill in the fields as appropriate.

The Governance, Risk, and Compliance: Privacy Case Management application enables you to report and manage privacy violations and complaints. The solution allows for the swift and efficient management of privacy breaches and complaints through collaboration with various teams which help in investigating the root cause and key details of the breach reported.

The Privacy Case Management application home page offers the privacy case manager an overview of processing activities, risk and compliance information, operations details, and all your privacy case-related information.

The GRC case summarization skill uses a large language model (LLM) to generate a structured AI summary of a privacy case record. The summary is generated on demand from case data and can be saved to the record for future reference.

The Privacy cases tab on the privacy management dashboard serves as a centralized interface for monitoring, analyzing, and managing privacy-related incidents and requests within an organization.

The privacy content accelerator provides prebuilt privacy content that you can activate directly from the Privacy Workspace.

The "Recommendation of similar control objectives" skill generates recommendations by identifying, deduplicating, and rationalizing similar control objectives within the compliance library. This enables identification of redundant control objectives, making it easier to maintain a clean and efficient compliance library.

Use Risk assessment summarization skill to generate a risk assessment summary that is based on inherent risks, residual risks, target risks, and control effectiveness data. Your approvers get the key insights to understand the context quickly, and you can reduce the time involved in creating summaries manually.

Privacy assessments are used to collect information from business owners. This information helps the privacy teams to understand how personal information (PI) is being used or stored in a processing activity.

Install ServiceNow Otto for Privacy Management.

The Privacy Management library consists of authority documents, citations, control objectives, policies, and [PI] Information objects that help to manage the privacy content.

Reminders enable relevant users to perform their assessments and complete the tasks associated with them.

Use the Governance, Risk, and Compliance: Privacy Management application to help protect your customers, employees, and suppliers with integrated data privacy risk and compliance management solutions and privacy by design concepts​.

The Privacy Management home page provides an overview of the complete privacy risk and compliance posture with details, such as the processing activity criticality score, privacy risk assessment status, privacy impact assessment status, control attestations, issues-specific status, and privacy cases.

Reference topics provide additional information such as tables, and roles that are installed with the Privacy Management application. These topics also provide supporting information.

The Privacy Management solution provides you with a framework to manage your privacy-specific libraries such as citations, policies, control objectives, risk statements, privacy impact assessments, and privacy risk assessments. It also provides processing activity records to track privacy risk and compliance posture.

Privacy analysts manage the privacy compliance posture of the processing activity owned by them. Compliance posture refers to the overall compliance status of an organization, business process, or business application, and so on based on the compliant and non-compliant status of controls across various regulations.

The Privacy management dashboard provides a centralized interface for monitoring and managing privacy-related data processing activities within the organization.

On the new privacy case form, fill in the fields.

After a requester successfully submits a privacy request and completes email verification, the request is routed to a Personal Data Rights (PDR) agent. The agent assigns action tasks to internal owners, reviews all completed tasks, closes the request, and notifies the requester by email with relevant details.

After acting on the recommendations, the owner sends it for review to the configured reviewers. The reviewers then analyze the actions taken and either approve or reject them, providing proper justification for their decisions.

Use Issue summarization skill to summarize an issue, and obtain a quick context and awareness about an issue.

Act on the recommendations, like accept as duplicate, retain as primary, or dismiss, to enable your compliance managers and analysts to streamline their processes by identifying, deduplicating, and rationalizing similar control objectives within the compliance library.

Use the Assessment Metric Type form to create an assessment questionnaire template instead of using the default template.

Learn about the fields on the assignment rule form. Use this form to define case assignment rules in the Privacy Case Management application.

On the new case task form, fill in the fields.

Create case tasks to work on the various tasks such as investigations, assessments, inquiries, gathering evidence, and so on required to analyze and work on the case that has been reported. Each case can have multiple case tasks that can be assigned to different owners from various teams.

Create view rules to define the form view of the privacy cases in the Privacy Workspace. Specifying the rules helps you to control how the privacy case form appears.

Create an assessment and send those assessments to the privacy case task owners to collect their responses. The responses help the privacy case analysts to determine the breaches that have occurred due to the privacy case.

Specify the conditions for assigning a privacy case to a particular user or group by creating assignment rules.

Create state models to control the workflow of a privacy case by defining the states and transition conditions.

Learn about the fields on the view rule form. Use this form to define workspace and default view rules in the Privacy Case Management application.

Track how personal data flows across vendors, applications, and systems within and beyond a processing activity to identify and mitigate privacy-related risks.

The processing activity overview page provides the privacy risk and compliance posture for a processing activity. This page contains details, such as compliance score, criticality score, risk posture and heatmap, privacy and risk assessment status, issues and policy exceptions, and control assurance status.

The Processing activity tab on the Privacy management dashboard provides a comprehensive and real-time overview of all data processing activities across the organization.

Reassign an Assessment type case task to another user. A case analyst or a case task owner can reassign a task to another case task owner, if required.

Use the Create Regulatory Agency form in the Privacy Workspace to create a regulatory agency. The regulatory agency is a new record type that handles regulatory changes.

Map the control objectives to the responses of the assessment questions to automatically create and apply the respective controls on the processing activity.

Map the [PI] Information objects to the responses of the assessment questions that must be associated to the processing activity. This association helps the privacy teams to understand what personal information is being processed by the processing activity.

Submit any suspected or confirmed privacy case without having to disclose your identity using the Anonymous Reporting Center (ARC).

Use the Employee Center to report any privacy breaches and complaints directly to the privacy teams. Reporting these cases helps to reduce and avert losses.

Any user can report a privacy case or an event that needs the attention of the privacy team.

The Privacy Management reports are available as overview pages in the various records.

Access a processing activity directly from the Employee Center and request edit access to update the details your team is responsible for.

Respond to an impact assessment from the Assessment Workspace to help privacy teams understand the potential privacy risks and their mitigation measures.

As an entity owner or a processing activity key stakeholder, respond to the privacy assessment that is initiated by the privacy lead.

Review a case task after a case task owner provides their responses and observations for the case.

Review a privacy assessment after the business user submits it. You can either close the assessment after a review or request a revision if you determine that the assessment requires more information.

The Risk and compliance tab on the privacy management dashboard provides a centralized view of privacy-related risk exposure and regulatory compliance performance.

Use the Risk Assessment Methodology form in the Core UI to create a risk assessment methodology (RAM).

Risk Assessment Methodology (RAM) provides a systematic and repeatable approach to identifying, evaluating, and mitigating privacy risks associated with data processing activities.

You can perform risk assessments on your processing activities to determine their risk scores and find out the privacy risk posture of your organization.

The GRC: Privacy Management application installs the roles for the privacy analyst, the privacy manager, and the privacy administrator to perform their respective tasks.

A processing activity is a record that processes personal data. Examples of such records can be a business process or a business application of an organization that has personal information. Processing activities enable the privacy management teams to understand how personal information is being processed or used.

Determine which entities have and process personal information using the ServiceNow Configuration Management Database (CMDB) application.

Send emails from a privacy case to seamlessly communicate with various stakeholders and regulators and gather more information about the case. All the emails sent and received are stored in the Privacy Case Management application.

Send a privacy assessment to a processing activity owner from a processing activity record to collect more information on why and how the processing activity is using personal information.

Send the privacy screening assessment or the Privacy impact assessment (PIA) assessments to multiple entities to understand why and how personal data is being processed.

Send multiple privacy assessments from multiple processing activities. This capability enables you to filter the processing activities by business units, locations, data subjects, and data types.

Send a privacy assessment to an entity owner to determine if there's personal data involved in the processing activities.

Create the connection and credential that allows Privacy Case Management to communicate with RadarFirst.

Utilize the Smart Assessment Engine to perform smart assessments on privacy case action tasks.

The new and improved assessment experience in Privacy Management uses the Smart Assessment Engine (SAE) application. The assessment engine enables you to perform privacy screening and privacy impact assessments to collect the necessary information for the privacy teams.

A processing activity workflow helps the privacy analysts to manage the life cycle of a processing activity.

A processing activity is a record that processes personal data. Examples of such records are a business process or a business application of an organization. Processing activities enable the privacy management teams to understand how personal information is being processed or used.

Initiate a RadarFirst analysis to evaluate the breach against applicable privacy regulations and receive an overall risk estimate for each impacted jurisdiction.

Submit a privacy request through your organization's external-facing Personal Data Rights (PDR) form, either for yourself or as an authorized agent acting on behalf of someone.

Use the GRC case summarization skill to generate an AI summary of a privacy case. The summary provides a consolidated view of the case life cycle, including breach-related assessment activity.

Tables are added with activation of GRC: Privacy Management.

Categorize information objects as personal information. Only information objects classified as personal information can be associated with the processing activities.

Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations.

Add translation values for the configurable fields on the external-facing Personal Data Rights (PDR) form, so that text specific to your organization is correctly translated.

To discover whether a business process or an application is processing personal data, you can use privacy screening assessments. To regularly assess how processing activities are processing personal data, you can use privacy assessments such as privacy impact assessment (PIA).

Activate an authority document or risk statement version to install the associated citations, control objectives, or risk statements into your privacy library.

Update an installed authority document or risk statement version to add newer citations, control objectives, and risk statements to your privacy library.

Add or update the existing transfer mechanisms in your Privacy Management application, so that privacy analysts can add them to data transfer records.

Update the sn_privacy.nodemap.maxLevel system property to control how many node levels are visible on the lineage map.

You can use the Privacy Case Management application to report privacy cases and manage the lifecycle of a privacy case.

Use the Personal Data Rights application to create new requests to manage your personal data.

As a privacy analyst or a privacy manager, you can identify which business applications or processes store and use personal information.

Accept the work of assessing a privacy breach assessment and work on the assessment.

A personal data rights request is initiated by a requester and directed to the Personal data rights (PDR) agent. The agent then processes the request, assigns it to the appropriate task owners, the task owners work on their tasks, and then request is closed.