Data processing systems for generating and populating a data inventory

• US 10,282,700 B2
• Filed: 07/20/2018
• Issued: 05/07/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): Edwards, Linglan E
• Application Number:
  US16/041,563
• Publication Number:
  US 20180337954A1
• Time in Patent Office: 291 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). For example, a first data asset may include any software or device (e.g., server or servers) utilized by a particular entity for such data collection, processing, transfer, storage, etc.

Claims

1. A data processing data inventory generation system comprising:

one or more processors; and

computer memory, wherein the data processing data inventory generation system is configured for;

identifying a primary data asset that collects or stores personal data of one or more data subjects;

generating a data inventory for the primary data asset, the data inventory storing one or more primary data asset inventory attributes comprising;

a type of personal data collected or stored by the primary data asset; and

primary transfer data associated with the personal data and the primary data asset;

identifying a transfer data asset based at least in part on the primary transfer data;

modifying the data inventory to include the transfer data asset, the transfer data asset storing one or more transfer data asset inventory attributes comprising the primary transfer data;

digitally storing the data inventory in the computer memory; and

electronically linking the primary data asset to the transfer data asset in the data inventory.

2. The data processing data inventory generation system of claim 1, wherein the primary data asset is a data asset selected from the group consisting of:

a software application for collecting the personal data; and

one or more computer servers for storing the personal data.

3. The data processing data inventory generation system of claim 1, wherein generating the data inventory for the primary data asset comprises:

identifying the one or more primary data asset inventory attributes based at least in part on the primary data asset; and

generating the data inventory for the primary data asset comprises;

generating the data inventory to include the one or more primary data asset inventory attributes; and

electronically associating the one or more primary data asset inventory attributes with the primary data asset in the computer memory.

4. The data processing data inventory generation system of claim 3, wherein:

the primary data asset comprises a software application; and

the one or more primary data asset inventory attributes further comprise;

one or more processing activities associated with the software application;

encryption data associated with the personal data collected by the software application; and

access data associated with the personal data collected by the software application.

5. The data processing data inventory generation system of claim 1, wherein:

the transfer data asset is a data asset to which the primary data asset transfers the personal data;

the data processing data inventory generation system is further configured for;

identifying one or more transfer data asset inventory attributes comprising;

one or more processing activities associated with the transfer data asset;

modifying the data inventory to include the one or more processing activities associated with the transfer data asset;

identifying a second transfer data asset, the second transfer data asset comprising a data asset to which the transfer data asset transfers the personal data; and

electronically linking the transfer data asset to the second transfer data asset in the data inventory.

6. The data processing data inventory generation system of claim 1, wherein:

the transfer data asset is a first transfer data asset from which the primary data asset receives the personal data; and

the data processing data inventory generation system is configured for;

identifying a second transfer data asset based at least in part on the primary transfer data;

identifying, for the second transfer data asset, one or more second transfer data asset inventory attributes comprising;

one or more types of personal data collected by the second transfer data asset;

modifying the data inventory to include the one or more types of personal data collected by the second transfer data asset;

associating the one or more types of personal data collected by the second transfer data asset with the second transfer data asset in the computer memory; and

electronically linking the primary data asset to the second transfer data asset in the data inventory.

7. The data processing data inventory generation system of claim 6, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

generating a visual representation of the data inventory, the visual representation comprising;

a visual indication of the primary data asset, the first transfer data asset, and the second data asset;

a visual indication of a flow of the personal data from the first transfer data asset to the primary data asset; and

a visual indication of a flow of the personal data from the second transfer data asset to the primary data asset; and

displaying, on one or more computer displays, the visual representation of the data inventory.

8. The data processing data inventory generation system of claim 7, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

identifying a processing activity undertaken by a particular entity;

identifying the primary data asset that collects or stores the personal data based at least in part on the processing activity;

modifying the data inventory to include the processing activity;

associating the processing activity with the primary data asset in the computer memory; and

generating the visual representation to comprise a visual indication of the association between the processing activity and the primary data asset.

9. The data processing data inventory generation system of claim 1, wherein the data processing data inventory generation system is configured for populating the one or more primary data asset inventory attributes using one or more intelligent identity scanning techniques.

10. A computer-implemented data processing method of generating a data inventory for a plurality of inter-related data assets utilized in the processing of one or more pieces of personal data, the method comprising:

identifying, by one or more processors, from the plurality of inter-related data assets, a storage asset, the storage asset storing the one or more pieces of personal data collected from one or more data subjects;

identifying, by one or more processors, from the plurality of inter-related data assets, a collection asset that transfers the one or more pieces of personal data to the storage asset;

identifying, by one or more processors, from the plurality of inter-related data assets, a transfer asset to which the storage asset transfers the one or more pieces personal data;

digitally storing, by one or more processors, in computer memory, one or more storage asset inventory attributes comprising a type of personal data stored by the storage asset;

digitally storing, by one or more processors, in computer memory, one or more collection asset inventory attributes comprising the one or more pieces of personal data that the collection asset transfers to the storage asset;

digitally storing, by one or more processors, in computer memory, one or more transfer asset inventory attributes comprising the one or more pieces of personal data that the storage asset transfers to the transfer asset; and

generating the data inventory by;

associating the storage asset with the one or more storage asset inventory attributes in computer memory;

associating the collection asset with the one or more collection asset inventory attributes in computer memory;

associating the transfer asset with the one or more transfer asset inventory attributes in computer memory;

electronically linking the collection asset to the storage asset in computer memory;

electronically linking the storage asset to the transfer asset; and

electronically mapping the one or more pieces of personal data to the collection asset, the storage asset, and the transfer asset.

11. The computer-implemented data processing method of claim 10, the method further comprising:

determining one or more individuals with access to the one or more pieces of personal data stored in the storage asset;

modifying the one or more storage asset inventory attributes to include access data that includes the one or more individuals with access to the one or more pieces of personal data.

12. The computer-implemented data processing method of claim 11, further comprising:

generating a visual data map of the data inventory, the visual data map comprising;

a visual indication of the storage asset, the collection asset, the transfer asset, and the one or more individuals with access to the one or more pieces of personal data;

a visual indication of a flow of the one or more pieces of personal data from the collection asset to the storage asset;

a visual indication of a flow of the one or more pieces of personal data from the storage asset to the transfer asset;

a visual indication of the one or more individuals with access to the one or more pieces of data having access to the storage asset; and

displaying, by one or more processors, on one or more computer displays, the visual data map of the data inventory.

13. The computer-implemented data processing method of claim 12, the method further comprising:

determining, by one or more processors, a first location of the storage asset;

determining, by one or more processors, a second location of the transfer asset;

analyzing, by one or more processors, the transfer of the one or more pieces of personal data from the first location to the second location to determine, based at least in part on the first location and the second location, whether one or more transfer guidelines apply to the transfer; and

in response to determining that the one or more transfer guidelines apply to the transfer, modifying the one or more transfer asset inventory attributes to include the one or more transfer guidelines.

14. The computer-implemented data processing method of claim 13, the method further comprising:

determining, using one or more risk analysis means, based at least in part on the one or more transfer guidelines, a risk level of the transfer of the one or more pieces of personal data from the first location to the second location to determine; and

modifying the visual data map to include a visual indication of the risk level in association with the visual indication of the flow of the one or more pieces of personal data from the storage asset to the transfer asset.

15. The computer-implemented data processing method of claim 10, wherein the plurality of inter-related data assets are associated with a particular data processing activity.

16. The computer-implemented data processing method of claim 15, wherein:

the particular data processing activity is a first data processing activity;

the plurality of inter-related data assets is a first plurality of inter-related data assets;

the data inventory is a first data inventory;

the method further comprises generating a second data inventory for a second plurality of inter-related data assets utilized in the processing of one or more second pieces of personal data as part of a second data processing activity; and

the first plurality of inter-related data assets comprise at least one data asset from the second plurality of inter-related data assets.