In the ServiceNow Shared Responsibility Model, the customer acts as the data controller . The customer determines why personal information is collected and how that information is processed within its ServiceNow environment. This includes decisions concerning collection, storage, use, sharing, retention, archiving, and destruction of data.

ServiceNow ' s official Shared Responsibility Model specifically identifies the customer as the data controller and states that the customer is responsible for meeting applicable privacy-law requirements in jurisdictions where it operates and collects personal data. The customer also remains the owner of the data stored in its ServiceNow instances.

ServiceNow, by contrast, generally performs the role of the data processor in this relationship. ServiceNow provides the platform and maintains appropriate controls designed to protect customer data while assisting customers in satisfying their data-protection obligations. ServiceNow does not decide the business purposes for which the customer ' s personal data is collected or processed.

Datacenter partners may participate in the infrastructure used to deliver cloud services, but that infrastructure role does not make them the customer ' s data controller within the ServiceNow Shared Responsibility Model.

Therefore, the distinction to remember for CSA purposes is: Customer = Data Controller; ServiceNow = Data Processor.

Study Guide Reference/Topics: Security and Access Control → Shared Responsibility Model → Data Privacy → Data Controller → Data Processor → Customer and ServiceNow Responsibilities.