Data Privacy Classic

Before you can define real-time protection policies, you must create your alert data patterns; reusable groups of data patterns that detect and then alert or block sensitive data across your organization.

You can review the findings of your attachment quarantine scans, and work with any quarantined or alerted attachments.

Manage policies that automatically isolate suspicious attachments for security review and analysis.

Integrate your organization's PII detection service to discover and mask sensitive data during AI inference calls. Routing your sensitive data inline guardrails to an external service allows you to comply with legal requirements around AI & Data Governance.

Configure a data privacy job on your production instance to use anonymized data on your non-production instance for user and data class jobs.

Configure a data privacy policy to specify which data privacy techniques are used when anonymizing your data.

Create a data privacy technique configuration to customize how data privacy anonymizes your data.

Data privacy clone integration is configured using a PostClone script to create and execute data privacy jobs for configured policies on the target. After running the script, users will see de-identified data and will not have access to the original data.

Configure a data privacy advanced configuration to de-identify personally identifiable information (PII) in generative AI applications.

Create a new policy for the inbound email channel to define sensitive data patterns that should be masked in inbound emails.

create external PII detection service configuration to connect your custom detection service to ServiceNow.

Create a new tokenization policy to define which sensitive data should be anonymized through reversible tokenization.

Data privacy (Classic) is available as a family release. The last family updates were released in the Tokyo launch.

Learn how to create data privacy techniques and policies, and how to create and execute data privacy jobs.

If any conrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file. In the short description, edit the first sentence to state whether domain separation is supported or not and add the application name. Keep the conref at the end that describes domain separation.Domain separation is unsupported for data privacy. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

You can use Data Privacy to detect and mask the sensitive data and PII during a Virtual Agent conversation.

Database changes are captured for actions like jobs and scripts so that the changes can be rolled back. Roll back a data privacy job for when human error inadvertently anonymizes incorrect user information. The rollback de-anonymizes the data from the data privacy job.

Use Data Privacy to classify sensitive data and to remove personally identifiable information (PII) from user data in a production instance and anonymize data in non-production instances. Once anonymized, the user data is no longer considered regulated private information.

Data privacy adds these roles.

Check which field types are supported when anonymizing data.

The default alerting policy automatically detects sensitive data being entered into unstructured fields in real-time and alerts administrators, providing immediate visibility into sensitive data flows without requiring configuration.

Data Privacy includes out-of-the-box default configurations that automatically activate for licensed Vault customers, providing immediate value without requiring setup. These configurations enable discovery of existing sensitive data and real-time alerting and user logs for new sensitive data entries in specific fields.

As customer data are cloned from a source to a target instance, typically from production to non-production, sensitive data are de-identified on the target instance.​

Review errors from Data Privacy jobs.

Data Privacy includes data classification and anonymization and is installed from the ServiceNow Store.

Assign anonymization techniques for data tables or columns, user specific data, or real time data.

Group data by type, using pre-defined or user-defined data classifications. Assign data classifications to specific table columns in the Dictionary [sys_dictionary] table. When you assign data classifications, it creates entries in the Dictionary-Data Class [m2m_dictionary_dataclass] table, which you can then review in the Overview dashboard.

Data privacy clone integration is configured using a PostClone script to create and execute data privacy jobs for configured policies on the target. After running the script, users will see de-identified data and will not have access to the original data.

Configure a data privacy job on your production instance to use anonymized data on your non-production instance for user and data class jobs.

Configure an anonymization policy to specify which techniques are used when anonymizing your data.

Create a data privacy technique configuration to customize how data privacy anonymizes your data.

Create your own user-defined data classifications in the [data_classification] table that you can then assign to specific columns in specific tables. Create new data classes to start the classification process.

Anonymization provides a way to easily transform data so that it is unidentifiable and more compliant with data privacy regulations.

Group data by type, using pre-defined or user-defined data classifications. If you have an assigned data classification administrator or auditor role, you can administer different data classes or visually analyze the current state of different types of data within the instance.

The Overview homepage is a starting point to manage your data and data privacy compliance.

The data privacy store app is a Next Experience refresh for data classification and data privacy with modern look, feel, and usability. Data privacy store app is supported in Utah and above.

Learn more how Data Privacy for ServiceNow Otto enhances your ability to protect sensitive data.

The inbound email channel enables organizations to discover and mask sensitive data in inbound emails through the Data Privacy framework. This replaces the previous approach which used Active Data Patterns with a centralized, streamlined policy-based experience for managing sensitive data in emails.

You can activate the data privacy plugin (com.glide.data_privacy) for Platform Security if you have the admin role. If the application doesn't include demo data or it doesn't install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they aren't already installed.

Learn about the components installed with the data privacy plugin (com.glide.data_privacy).

Review the alerts generated by the default alerting policy to track sensitive data entry patterns, identify training opportunities, and monitor compliance.

View summaries of de-tokenization jobs, monitor access to original sensitive data, and review audit logs for compliance purposes.

Set up and configure how to discover and anonymize sensitive data from generative AI prompts.

Use parallel jobs to reduce your anonymization job execution time.

Review real time anonymization(RTA) failures.

Use the real time anonymization(RTA) policy to anonymize data entries in real time.

You can configure policies to protect sensitive data in real-time through alerts and blocking actions.

Analyze user input in real time at the field level to identify sensitive data and alert users about potential sensitive data entry.

Tokenization masks sensitive data for unauthorized users using tokens, and stores a mapping of those tokens to the original data on the instance. Users with authorized roles can retrieve the original data by prompting within the ServiceNow Otto panel.

After the default discovery job completes, review the findings to understand sensitive data exposure on your instance and plan protective measures.

Roll back a data privacy job on your non-production instance that uses anonymized data from your production instance to a state prior to de-identification of a data class or user job.

You can view the top 100 activity logs for specific real-time protection policies that contain the most sensitive data from the last month.

The Vault by Default data discovery job automatically runs on ServiceNow instances. It helps to identify sensitive data in primary sources, providing immediate value for trial and licensed Vault customers without requiring configuration.