We unknowingly had someone put some sensitive information into a native field. We removed it, but it's still in the System Notes as the 'Old Value.' Is there any way we can do anything about this? It's on a record type that a bunch of people need to access, so shutting off access entirely to these records isn't an option. Same with System Notes. They need to be viewable by many users for audit purposes. Any creative solutions?

There is a native/free GDPR tool that does go through and mask system notes along with other data. I'm not entirely sure that it'll work for this use case, but worth investigating I'd think.

@RJMNS PII removal tools in NetSuite does this

Excellent, thank you both! For some reason I had in my head that the PII tool only worked on certain fields, but that doesn't appear to be the case.

You can also use N/PII module in suitescript to do the automation as well