Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods

• US 10,594,740 B2
• Filed: 10/18/2019
• Issued: 03/17/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Jones, Kevin, Brannon, Jonathan Blake
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US16/656,835
• Publication Number:
  US 20200053130A1
• Time in Patent Office: 151 Days
• Field of Search: 717101-110
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In particular embodiments, a Cross-Border Visualization Generation System is configured to: (1) identify one or more data assets associated with a particular entity; (2) analyze the one or more data assets to identify one or more data elements stored in the identified one or more data assets; (3) define a plurality of physical locations and identify, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations; (4) analyze the identified one or more data elements to determine one or more data transfers between the one or more data systems in different particular physical locations; (5) determine one or more regulations that relate to the one or more data transfers; and (6) generate a visual representation of the one or more data transfers based at least in part on the one or more regulations.

Claims

1. A non-transitory computer-readable medium storing computer-executable instructions for:

identifying one or more data assets associated with a particular entity;

analyzing the one or more data assets to identify one or more data elements stored in the identified one or more data assets by using at least one data model to identify the one or more data elements stored in the identified one or more data assets, the at least one data model comprising;

a respective digital inventory for each of the one or more data assets, each respective digital inventory comprising transfer data associated with each respective data asset and one or more inventory attributes selected from the group consisting of;

one or more processing activities associated with each respective data asset; and

one or more pieces of personal data associated with each respective data asset; and

a data map identifying one or more electronic associations between at least two of the one or more data assets; and

defining a plurality of physical locations and identifying, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations;

analyzing the identified one or more data elements to determine one or more data transfers between the one or more data assets in different particular physical locations, wherein analyzing the identified one or more data elements to determine the one or more data transfers between the one or more data assets in different particular physical locations comprises analyzing the identified one or more data elements to determine one or more data transfers based at least in part on the transfer data;

determining one or more regulations that relate to the one or more data transfers;

generating a visual representation of a map comprising the plurality of physical locations;

generating an indicia for each of the one or more data assets that indicates the respective particular physical location of the plurality of physical locations for each of the one or more data assets on the visual representation of the map;

modifying the visual representation to indicate the one or more data transfers between the one or more data assets based at least in part on the one or more regulations; and

causing a display device to display the visual representation of the map.

2. The non-transitory computer-readable medium of claim 1, wherein the plurality of physical locations are selected from the group consisting of:

one or more countries;

one or more continents; and

one or more jurisdictions.

3. The non-transitory computer-readable medium of claim 2, wherein identifying the respective particular physical location for each of the identified one or more data assets comprises determining the respective particular physical location based at least in part on an IP address associated with each of the identified one or more data assets.

4. The non-transitory computer-readable medium of claim 1, wherein:

the one or more data assets comprise a first data asset and a second data asset;

the first data asset transfers data to the second data asset; and

the non-transitory computer-readable medium further stores computer-executable instructions for;

analyzing one or more first storage restrictions on personal data stored by the first data asset;

analyzing one or more second storage restrictions on personal data stored by the second data asset;

comparing the one or more first storage restrictions with the one or more second storage restrictions; and

flagging a first transfer of data from the first data asset to the second data asset based at least in part on the comparison.

5. The non-transitory computer-readable medium of claim 4, further storing computer-executable instructions for:

determining that the one or more second restrictions are less stringent than the one or more first restrictions; and

at least partially in response to determining that the one or more second restrictions are less stringent than the one or more first restrictions, automatically flagging the first transfer as risky.

6. The non-transitory computer-readable medium of claim 5, further storing computer-executable instructions for:

determining that the one or more second restrictions are at least as stringent as the one or more first restrictions; and

at least partially in response to determining that the one or more second restrictions are at least as stringent as the one or more first restrictions, automatically flagging the first transfer as acceptable.

7. The non-transitory computer-readable medium of claim 1, wherein modifying the visual representation to indicate the one or more data transfers between the one or more data assets comprises modifying the visual representation of each of the one or more data transfers to reflect at least one attribute of each of the one or more data transfers, the at least one attribute being selected from the group consisting of:

a type of security applied to each of the one or more data transfers; and

the one or more regulations that relate to each of the one or more data transfers.

8. The non-transitory computer-readable medium of claim 7, wherein:

the at least one attribute comprises the one or more regulations that relate to each of the one or more data transfers; and

the one or more regulations comprise at least one regulation selected from the group consisting of;

one or more binding corporate rules;

a privacy shield;

a safe harbor regulation; and

one or more contract provisions.

9. The non-transitory computer-readable medium of claim 1, wherein identifying the one or more data elements comprises analyzing the one or more data assets using one or more intelligent identity scanning means.

10. A computer-implemented data processing method for generating a visualization of one or more data transfers between one or more data assets, the method comprising:

identifying, by one or more processors, one or more data assets associated with a particular entity;

analyzing, by one or more processors, the one or more data assets to identify one or more data elements stored in the identified one or more data assets by using at least one data model to identify the one or more data elements stored in the identified one or more data assets, the at least one data model comprising;

a respective digital inventory for each of the one or more data assets, each respective digital inventory comprising transfer data associated with each respective data asset and one or more inventory attributes selected from the group consisting of;

one or more processing activities associated with each respective data asset; and

one or more types of personal data stored on each respective data asset; and

a data map identifying one or more electronic associations between at least two of the one or more data assets;

defining, by one or more processors, a plurality of physical locations and identifying, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations;

analyzing, by one or more processors, the identified one or more data elements to determine one or more data transfers between the one or more data assets in different particular physical locations, wherein analyzing the identified one or more data elements to determine the one or more data transfers between the one or more data assets in different particular physical locations comprises analyzing the identified one or more data elements to determine one or more data transfers based at least in part on the transfer data;

generating, by one or more processors, a visual representation of a map comprising the plurality of physical locations;

generating, by one or more processors, on the visual representation of the map, a visual representation for each of the one or more data assets that indicates the respective particular physical location of the plurality of physical locations for each of the one or more data assets;

generating, by one or more processors, on the visual representation of the map, a visual indication of the one or more data transfers between the one or more data assets; and

displaying the visual representation of the map on a display device.

11. The computer-implemented data processing method of claim 10, wherein generating the visual indication of the one or more data transfers between the one or more data assets comprises displaying a respective visual indication for each of the one or more data transfers to reflect at least one attribute of each of the one or more data transfers, the at least one attribute being selected from the group consisting of:

a type of security applied to each of the one or more data transfers; and

one or more regulations that apply to each of the one or more data transfers.

12. The non-transitory computer-readable medium of claim 10, wherein:

the at least one attribute comprises the one or more regulations that relate to each of the one or more data transfers; and

the one or more regulations comprise at least one regulation selected from the group consisting of;

one or more binding corporate rules;

a privacy shield;

a safe harbor regulation; and

one or more contract provisions.

13. The computer-implemented data processing method of claim 10, wherein generating the visual indication of the one or more data transfers between the one or more data assets comprises generating a line representing each of the one or more data transfers.

14. The computer-implemented data processing method of claim 13, wherein the plurality of physical locations comprises a plurality of countries.

15. The computer-implemented data processing method of claim 13, wherein:

the identified one or more data assets comprise one or more servers; and

identifying, for each of the identified one or more data assets, the respective particular physical location comprises identifying in which of the plurality of countries each of the one or more servers is located.

16. A computer-implemented data processing method for generating a visualization of a data transfer between a first data asset and a second data asset, the method comprising:

analyzing, by one or more processors, at least one data model to identify the first data asset and the second data asset, wherein;

the first data asset stores one or more first data elements;

the second data asset stores one or more second data elements;

the at least one data model comprises;

a respective digital inventory for the first data asset and the second data asset, each respective digital inventory comprising transfer data associated the first data asset and the second data asset and one or more inventory attributes selected from the group consisting of;

one or more processing activities associated with the first data asset and the second data asset; and

one or more types of personal data stored on the first data asset and the second data asset; and

a data map identifying one or more electronic associations between the first data asset and the second data asset; and

defining, by one or more processors, a plurality of physical locations and identifying, for the first data asset and the second data asset, a first location of the first data asset and a second location of the second data asset, the first location and the second location comprising a location of the plurality of physical locations;

analyzing, by one or more processors, the first data asset and the second data asset to identify the one or more first data elements and the one or more second data elements;

analyzing, by one or more processors, the one or more first data elements and the one or more second data elements to determine the data transfer between the first data asset and the second data asset based at least in part on the transfer data;

determining, by one or more processors, one or more regulations that relate to the data transfer;

generating, by one or more processors, a visual representation of a map comprising the plurality of physical locations;

displaying a first indicia representing the first location and a second indicia representing the second location on the visual representation of the map;

generating, by one or more processors, on the visual representation of the map, a line indicating the data transfer between the first location and the second location;

modifying, by one or more processors, the line indicating the data transfer based at least in part on the one or more regulations; and

causing a display device to display the visual representation of the map.

17. The computer-implemented data processing method of claim 16, wherein modifying the line indicating the data transfer based at least in part on the one or more regulations comprises color-coding the line.

18. The computer-implemented data processing method of claim 17, wherein:

the one or more regulations are selected from the group consisting of;

one or more binding corporate rules;

a privacy shield;

a safe harbor regulation; and

one or more contract provisions; and

the one or more regulations provide a legal basis for the data transfer.