Data processing systems for generating and populating a data inventory

• US 10,275,614 B2
• Filed: 07/20/2018
• Issued: 04/30/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US16/041,520
• Publication Number:
  US 20180349640A1
• Time in Patent Office: 284 Days
• Field of Search: 726 30
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 16/1727 Details of free space management performed by the file system saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064
• CPC Class Codes: G06F 16/2457 with adaptation to user needs
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). For example, a first data asset may include any software or device (e.g., server or servers) utilized by a particular entity for such data collection, processing, transfer, storage, etc.

Claims

1. A computer-implemented data processing method for generating a first data asset assessment, the method comprising:

accessing, by one or more processors, a data model of a plurality of data assets used in the collection or storage of personal data, the data model defining one or more electronic links between the plurality of data assets and storing a plurality of data inventories that define a plurality of inventory attributes for the plurality of data assets;

identifying, by one or more processors, a first data inventory from the plurality of data inventories, each of the plurality of data inventories being associated with a respective data asset, wherein the first data inventory comprises a plurality of fields that each define a respective inventory attribute of a first data asset associated with the first data inventory;

determining, by one or more processors, for the plurality of fields, one or more populated inventory attributes and one or more unpopulated inventory attributes;

retrieving, by one or more processors, a data asset questionnaire template;

analyzing, by one or more processors, the data asset questionnaire template to identify one or more questions that map to the one or more unpopulated inventory attributes;

generating, by one or more processors, a first data asset assessment based at least in part on the one or more questions that map to the one or more unpopulated inventory attributes;

receiving, by one or more processors, one or more responses to the one or more questions;

determining, by one or more processors, for each of the one or more unpopulated inventory attributes, one or more attribute values based at least in part on the one or more responses;

in response to determining the one or more attribute values, modifying, by one or more processors, the first data inventory to include the one or more attribute values for each of the one or more unpopulated inventory attributes by populating the plurality of fields;

storing, by one or more processors, the modified first data inventory in computer memory;

assigning a relative risk rating to each of the one or more responses;

calculating a relative risk level for the first data asset based at least in part on the relative risk rating and the one or more responses; and

modifying the first data inventory to include the relative risk rating.

2. The computer-implemented data processing method of claim 1, wherein generating the first data asset assessment comprises mapping each of the one or more questions to a particular respective field of the plurality of fields.

3. The computer-implemented data processing method of claim 2, wherein populating the plurality of fields comprises populating each particular respective field with one or more responses that correspond to the mapped one or more questions.

4. The computer-implemented data processing method of claim 1, the method further comprising:

modifying the first data asset assessment based at least in part on the one or more responses.

5. The computer-implemented data processing method of claim 4, wherein modifying the first data asset assessment comprises removing at least one question from the first data asset assessment.

6. The computer-implemented data processing method of claim 5, further comprising:

modifying the first data asset assessment in response to receiving a particular response to a particular question of the one or more questions; and

modifying the first data asset assessment substantially on the fly as a user completes the first data asset assessment.

7. The computer-implemented data processing method of claim 1, further comprising transmitting the first data asset assessment to a user for completion.

8. A computer-implemented data processing method for generating a processing activity template for creation of a processing activity assessment for feeding a plurality of activity attribute values into a processing activity inventory for a particular processing activity, the method comprising:

identifying, by one or more processors, for the particular processing activity, a plurality of processing activity attribute values;

electronically linking, by one or more processors, each respective processing activity attribute value of the plurality of processing activity attribute values to each of;

an associated respective question of a plurality of questions in the processing activity template; and

an associated respective field of a plurality of fields in the processing activity inventory;

storing, by one or more processors, an indication of the electronic linking in computer memory;

creating, by one or more processors, the processing activity assessment based at least in part on the processing activity template, the processing activity assessment comprising the plurality of questions;

receiving, by one or more processors, from a user, one or more responses to the processing activity assessment comprising a respective response to each of the plurality of questions;

filling, by one or more processors, the plurality of processing activity attribute values based at least in part on the respective response to each of the plurality of questions, the associated respective question, and the associated respective field;

assigning a respective relative risk rating to each of the one or more responses;

calculating a relative risk level for the particular processing activity based at least in part on each respective relative risk rating and the one or more responses;

modifying the processing activity inventory to include each respective relative risk rating; and

storing, by one or more processors, the processing activity inventory along with the filled plurality of processing activity attribute values in computer memory.

9. The computer-implemented data processing method of claim 8, wherein identifying the plurality of processing activity attribute values comprises identifying the plurality of processing activity attribute values based at least in part on a type of the particular processing activity.

10. The computer-implemented data processing method of claim 8, further comprising:

analyzing the one or more responses to identify a new asset discovery; and

in response to identifying the new asset discovery, generating a new asset inventory for the new asset.

11. The computer-implemented data processing method of claim 10, wherein the new asset comprises a data asset selected from the group consisting of:

a software application for collecting personal data processed by the particular processing activity; and

one or more computer servers for storing the personal data.

12. The computer-implemented data processing method of claim 11, the method further comprising:

identifying, by one or more processors, for the new asset, a plurality of asset attribute values;

modifying the asset inventory to include a plurality of asset attribute value fields based on the plurality of asset attribute values;

electronically linking, by one or more processors, each respective asset attribute value of the plurality of asset attribute values to each of;

an associated respective asset question of a plurality of asset questions in an asset template; and

an associated respective asset attribute value field of a plurality of asset attribute value fields in the asset inventory;

storing, by one or more processors, an indication of the electronic linking in computer memory;

creating, by one or more processors, an asset assessment based at least in part on the asset template, the asset assessment comprising the plurality of asset questions;

receiving, by one or more processors, from a user, one or more responses to the asset assessment comprising a respective response to each of the plurality of asset questions;

filling, by one or more processors, the plurality of asset attribute value fields based at least in part on the respective response to each of the plurality of asset questions, and the associated respective asset question;

storing, by one or more processors, the asset inventory along with the filled plurality of asset attribute value fields in computer memory.

13. The computer-implemented data processing method of claim 12, further comprising prompting the user for approval prior to filling the plurality of asset attribute field values.

14. The computer-implemented data processing method of claim 8, further comprising modifying the processing activity assessment based at least in part on the one or more responses.

15. The computer-implemented data processing method of claim 14, further comprising:

in response to modifying the processing activity assessment, modifying the processing activity inventory by deleting at least one processing activity value.

16. The computer-implemented data processing method of claim 15, further comprising automatically deleting a field associated with the at least one processing activity value from the processing activity inventory.

17. The computer-implemented data processing method of claim 8, wherein the plurality of fields have a field type selected from a group consisting of:

a memo field type;

a numeric field type; and

a logical field type.