This article is based on commentary from Mark Cockerill, VP Legal (EMEA/APJ) & Head of Global Privacy at ServiceNow, originally published on diginomica.com.
The Data Privacy Challenge Is Global — and Growing
Data has become one of the most consequential resources of the modern economy. Yet unlike physical commodities, data crosses borders instantly and is subject to a patchwork of regulatory frameworks that differ dramatically by country and region. For enterprise software vendors that store and process customer data on a global scale, this creates a compliance landscape of extraordinary complexity.
ServiceNow operates in dozens of markets worldwide, and its customers span industries that are themselves tightly regulated. Keeping pace with the evolving legal requirements in each jurisdiction — while maintaining consistent, trustworthy data-handling practices — is a core operational challenge, not an afterthought.
According to Mark Cockerill, ServiceNow’s Head of Global Privacy, the company’s approach rests on three interdependent strategic pillars: Trust, Education, and Commerciality. Understanding each pillar — and how they interact — provides a useful model for any enterprise grappling with global data-privacy obligations.
A Fragmented Regulatory Landscape
Europe’s General Data Protection Regulation (GDPR) is the most widely recognised data-privacy framework, partly because its extraterritorial reach and steep penalties made it impossible for global businesses to ignore. Most enterprise technology and legal teams now have at least a working understanding of GDPR’s core requirements: lawful basis for processing, data-subject rights, breach notification timelines, and restrictions on international data transfers.
Beyond Europe, however, the picture becomes considerably more complicated. Countries including the United States, Canada, Australia, Singapore, Brazil, Japan, and South Korea each maintain distinct privacy regimes with their own definitions, obligations, and enforcement mechanisms. A data-handling practice that satisfies one framework may create liability under another.
These regulations are not static. Technology advances continuously expand what data can be collected and how it can be used, prompting legislators to respond. The California Consumer Privacy Act (CCPA) is a prominent example of sub-national regulation that introduced new consumer rights and business obligations in the United States, with a number of other US states subsequently pursuing their own privacy legislation.
For a global platform vendor like ServiceNow, staying ahead of this evolution is not optional — it is a prerequisite for continuing to serve enterprise customers.
The Processor vs. Controller Distinction
A critical legal distinction underpins ServiceNow’s approach to data privacy. Under frameworks such as GDPR, there is a meaningful difference between a data controller — the entity that determines the purposes and means of processing personal data — and a data processor — an entity that processes data on behalf of a controller.
ServiceNow operates primarily as a data processor for the services it provides to customers. Its customers, as controllers, retain responsibility for the data they bring into the platform. This does not, however, reduce ServiceNow’s compliance obligations or its responsibility for the security and integrity of data processed on its infrastructure.
Critically, this arrangement also means that data privacy is a shared responsibility. A breach or compliance failure anywhere in the processing chain can expose both the processor and the controller. Enterprise customers typically work with multiple IT vendors simultaneously, each of which may be classified as a data processor under applicable law. Managing those relationships — and ensuring no single vendor becomes the weak link — is a significant operational challenge for data owners.
Going Beyond the Bare Minimum
Minimum compliance — doing just enough to avoid regulatory penalties — is a tempting but ultimately self-defeating strategy. It signals to customers that privacy is a cost to be minimised rather than a value to be upheld, and it leaves organisations poorly positioned when regulations tighten or new frameworks emerge.
ServiceNow’s stated philosophy is to build privacy protections that are scalable and forward-looking, capable of accommodating regulatory advances that have not yet arrived. This requires:
- Designing products and workflows with privacy controls built in from the start, rather than retrofitted after the fact.
- Maintaining certifications and formal compliance attestations that give customers independent assurance of data-handling standards.
- Actively monitoring legislative developments across all operating jurisdictions and preparing customers in advance of changes taking effect.
Consumer awareness of data privacy is also rising rapidly. End users increasingly understand that they are handing over personal information and expect the organisations they deal with — and those organisations’ vendors — to handle it responsibly. Meeting that expectation is becoming as important to customer retention as product quality or price.
The Three Strategic Pillars
Pillar 1: Trust
Trust is the foundation on which the other pillars rest. It applies equally to internal relationships — between the privacy team and the rest of the organisation — and to external relationships with customers and regulators.
Building trust requires demonstrating genuine commitment rather than performing compliance for appearances. In practice, this means:
- Obtaining and maintaining relevant privacy and security certifications.
- Publishing clear, accurate policies that describe how data is handled.
- Responding transparently to customer inquiries and audits.
- Treating employee data with the same rigour applied to customer data.
Consistency is essential here. If different teams or individuals within the same organisation give different answers to the same privacy question, trust erodes. Internal alignment is therefore a prerequisite for external credibility.
Pillar 2: Education
Knowledge gaps are a leading cause of data-privacy failures. Employees who do not understand why a particular data-handling practice matters, or customers who are unaware of the controls available to them, introduce avoidable risk.
ServiceNow’s educational pillar addresses two audiences:
- Internal teams: All staff, regardless of department, receive training that creates a consistent understanding of privacy obligations and practices. This enables any customer-facing employee to give accurate, reliable guidance.
- Customers: Education extends beyond the vendor’s own walls. Helping customers understand what protections are in place, what additional measures they can implement (such as multi-factor authentication), and what their own responsibilities are as data controllers strengthens the overall security posture for both parties.
Privacy and security are, in this model, explicitly a joint responsibility — not something one party can outsource entirely to the other.
Pillar 3: Commerciality
Enterprise decisions must ultimately be sustainable from a business perspective, and privacy investments are no different. The commerciality pillar acknowledges that a risk-based approach — prioritising resources where the risk exposure is greatest — is both economically rational and operationally necessary.
Importantly, commerciality here does not mean cutting corners. Rather, it means that privacy investments are tied to tangible business outcomes: maintaining customer confidence, reducing the cost of regulatory incidents, enabling entry into new markets with strict privacy requirements, and differentiating the platform in competitive evaluations.
When trust and education are in place, commerciality becomes a mechanism for raising the bar further — using strong privacy practices as a competitive advantage rather than treating them as a tax on operations.
Practical Takeaways for Enterprise Teams
Whether you are evaluating ServiceNow as a platform or building your own organisation’s data-privacy programme, the three-pillar model offers a useful framework:
- Map your regulatory exposure. Identify every jurisdiction in which your organisation collects or processes personal data and maintain a living inventory of applicable requirements.
- Audit your vendor ecosystem. Treat each data processor in your supply chain as a potential compliance risk. Require evidence of certifications, conduct due diligence on sub-processors, and ensure data processing agreements are in place.
- Invest in internal training. Compliance failures frequently originate from human error rather than technical gaps. Consistent, role-appropriate training is a cost-effective mitigation.
- Design for future requirements. Build privacy controls that are extensible, so that adapting to new regulations does not require rebuilding systems from scratch.
- Communicate proactively with customers. Transparency about your data-handling practices builds the trust that is increasingly a prerequisite for enterprise relationships.
Conclusion
Global data privacy is not a problem that can be solved once and forgotten. Regulations evolve, technology introduces new vectors for data acquisition and misuse, and customer expectations continue to rise. Enterprise software vendors — and the organisations that depend on them — must treat privacy compliance as a continuous operational discipline rather than a periodic checkbox exercise.
ServiceNow’s three-pillar approach — grounding all activity in trust, maintaining that trust through education, and making commercially rational decisions about where to invest — provides a replicable model for any organisation navigating the same complexity. The underlying principle is straightforward: privacy done well is not a burden. It is the foundation of durable customer relationships.