Data processing systems for generating and populating a data inventory

• US 10,438,016 B2
• Filed: 12/14/2018
• Issued: 10/08/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): Pyzocha, Michael
• Application Number:
  US16/220,978
• Publication Number:
  US 20190138746A1
• Time in Patent Office: 298 Days
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 16/1727 Details of free space management performed by the file system saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064
• CPC Class Codes: G06F 16/2457 with adaptation to user needs
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). For example, a first data asset may include any software or device (e.g., server or servers) utilized by a particular entity for such data collection, processing, transfer, storage, etc.

Claims

1. A computer-implemented data processing method for generating a processing activity template for creation of a processing activity assessment for feeding a plurality of activity attribute values into a processing activity inventory for a particular processing activity, the method comprising:

identifying, by one or more processors, for the particular processing activity, a plurality of processing activity attribute values;

electronically linking, by one or more processors, each respective processing activity attribute value of the plurality of processing activity attribute values to each of;

an associated respective question of a plurality of questions in the processing activity template; and

an associated respective field of a plurality of fields in the processing activity inventory;

storing, by one or more processors, an indication of the electronic linking in computer memory;

creating, by one or more processors, the processing activity assessment based at least in part on the processing activity template, the processing activity assessment comprising the plurality of questions, wherein a first question of the plurality of questions is related to information selected from a group consisting of;

one or more types of personal data acquired from data subjects in the processing activity for use by one or more data assets;

one or more data assets that personal data acquired from data subjects will be stored;

whether personal data acquired from the data subjects will be encrypted;

one or more other data assets that the personal data will be transferred to; and

one or more individuals that will have the ability to access stored personal data;

receiving, by one or more processors, from a user, one or more responses to the processing activity assessment comprising a respective response to each of the plurality of questions;

analyzing, by one or more processors, the one or more responses to the processing activity assessment for one or more processing activity personal data risks;

in response to analyzing the one or more responses to the processing activity assessment, identifying, by one or more processors, at least one of the one or more processing activity personal data risks;

filling, by one or more processors, the plurality of processing activity attribute values based at least in part on the respective response to each of the plurality of questions, the associated respective question, and the associated respective field, wherein filling the plurality of processing activity attribute values includes marking each of the processing activity attribute values that are associated with the one or more responses in which the at least one of the one or more processing activity personal data risks was identified; and

storing, by one or more processors, the processing activity inventory along with the filled plurality of processing activity attribute values in computer memory.

2. The computer-implemented data processing method of claim 1, further comprising:

analyzing the one or more responses to identify a new asset discovery; and

in response to identifying the new asset discovery, generating a new asset inventory for the new asset.

3. The computer-implemented data processing method of claim 2, wherein the new asset comprises a data asset selected from the group consisting of:

a software application for collecting personal data processed by the particular processing activity; and

one or more computer servers for storing the personal data.

4. The computer-implemented data processing method of claim 3, the method further comprising:

identifying, by one or more processors, for the new asset, a plurality of asset attribute values;

modifying the asset inventory to include a plurality of asset attribute value fields based on the plurality of asset attribute values;

electronically linking, by one or more processors, each respective asset attribute value of the plurality of asset attribute values to each of;

an associated respective asset question of a plurality of asset questions in an asset template; and

an associated respective asset attribute value field of a plurality of asset attribute value fields in the asset inventory;

storing, by one or more processors, an indication of the electronic linking in computer memory;

creating, by one or more processors, an asset assessment based at least in part on the asset template, the asset assessment comprising the plurality of asset questions;

receiving, by one or more processors, from a user, one or more responses to the asset assessment comprising a respective response to each of the plurality of asset questions;

filling, by one or more processors, the plurality of asset attribute value fields based at least in part on the respective response to each of the plurality of asset questions, and the associated respective asset question;

storing, by one or more processors, the asset inventory along with the filled plurality of asset attribute value fields in computer memory.

5. The computer-implemented data processing method of claim 4, further comprising prompting the user for approval prior to filling the plurality of asset attribute field values.

6. The computer-implemented data processing method of claim 1, wherein the plurality of fields have a field type selected from a group consisting of:

a memo field type;

a numeric field type; and

a logical field type.

7. The computer-implemented data processing method of claim 1, further comprising modifying the processing activity assessment based at least in part on the one or more responses.

8. The computer-implemented data processing method of claim 7, further comprising:

in response to modifying the processing activity assessment, modifying the processing activity inventory by deleting at least one processing activity value.

9. The computer-implemented data processing method of claim 8, further comprising automatically deleting a field associated with the at least one processing activity value from the processing activity inventory.

10. The computer-implemented data processing method of claim 7, wherein:

the one or more responses identify a new asset discovery; and

the method further comprises modifying the processing activity assessment to include at least one additional question that relates to the new asset discovery.

11. A computer-implemented data processing method for generating a first data asset assessment, the method comprising:

accessing, by one or more processors, a data model of a plurality of data assets used in the collection or storage of personal data, the data model defining one or more electronic links between the plurality of data assets and storing a plurality of data inventories that define a plurality of inventory attributes for each of the plurality of data assets;

identifying, by one or more processors, a first data inventory from the plurality of data inventories, each of the plurality of data inventories being associated with a respective data asset, wherein the first data inventory comprises a plurality of fields that each define a respective inventory attribute of a first data asset associated with the first data inventory;

determining, by one or more processors, for each of the plurality of fields, one or more populated inventory attributes and one or more unpopulated inventory attributes;

retrieving, by one or more processors, a data asset questionnaire template;

analyzing, by one or more processors, the data asset questionnaire template to identify one or more questions that map to the one or more unpopulated inventory attributes;

generating, by one or more processors, a first data asset assessment based at least in part on the one or more questions that map to the one or more unpopulated inventory attributes, wherein a first question of the one or more questions is related to information selected from a group consisting of;

one or more types of personal data acquired from data subjects stored within the first data asset;

whether personal data acquired from the data subjects and stored on the first data asset will be encrypted;

one or more other data assets that the personal data will be transferred to from the first data asset; and

one or more individuals that will have the ability to access stored personal data on the first data asset;

receiving, by one or more processors, one or more responses to the one or more questions;

analyzing, by one or more processors, the one or more responses to the first data asset assessment for one or more processing activity personal data risks;

in response to analyzing the one or more responses to the first data asset assessment, identifying, by one or more processors, at least one of the one or more first data asset personal data risks;

determining, by one or more processors, for each of the one or more unpopulated inventory attributes, one or more attribute values based at least in part on the one or more responses;

in response to determining the one or more attribute values, modifying, by one or more processors, the first data inventory to include the one or more attribute values for each of the one or more unpopulated inventory attributes by populating the plurality of fields, wherein modifying the first data inventory includes marking each of the attribute values that are associated with the one or more responses in which the at least one of the one or more first data asset personal data risks was identified; and

storing, by one or more processors, the modified first data inventory in computer memory.

12. The computer-implemented data processing method of claim 11, wherein generating the first data asset assessment comprises mapping each of the one or more questions to a particular respective field of the plurality of fields.

13. The computer-implemented data processing method of claim 12, wherein populating the plurality of fields comprises populating each particular respective field with one or more responses that correspond to the mapped one or more questions.

14. The computer-implemented data processing method of claim 11, the method further comprising:

modifying the first data asset assessment based at least in part on the one or more responses.

15. The computer-implemented data processing method of claim 14, wherein modifying the first data asset assessment comprises removing at least one question from the first data asset assessment.

16. The computer-implemented data processing method of claim 15, further comprising:

modifying the first data asset assessment in response to receiving a particular response to a particular question of the one or more questions; and

modifying the first data asset assessment on the fly as a user completes the first data asset assessment.

17. The computer-implemented data processing method of claim 11, further comprising transmitting the first data asset assessment to a user for completion.

18. The computer-implemented data processing method of claim 11, further comprising modifying the data model based at least in part on the one or more responses.

19. The computer-implemented data processing method of claim 11, wherein:

the one or more responses identify a new data asset; and

the method further comprises modifying the data model to include the new data asset.

20. The computer-implemented data processing method of claim 11, wherein the plurality of fields have a field type selected from a group consisting of:

a memo field type;

a numeric field type; and

a logical field type.