Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods

• US 10,798,133 B2
• Filed: 03/16/2020
• Issued: 10/06/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Jones, Kevin, Brannon, Jonathan Blake
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US16/820,208
• Publication Number:
  US 20200220901A1
• Time in Patent Office: 204 Days
• Field of Search: 717101-110
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In particular embodiments, a Cross-Border Visualization Generation System is configured to: (1) identify one or more data assets associated with a particular entity; (2) analyze the one or more data assets to identify one or more data elements stored in the identified one or more data assets; (3) define a plurality of physical locations and identify, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations; (4) analyze the identified one or more data elements to determine one or more data transfers between the one or more data systems in different particular physical locations; (5) determine one or more regulations that relate to the one or more data transfers; and (6) generate a visual representation of the one or more data transfers based at least in part on the one or more regulations.

Claims

1. A computer-implemented data processing method for generating a visualization of one or more data transfers between one or more data assets, the method comprising:

identifying one or more data assets associated with a particular entity;

analyzing the one or more data assets to identify one or more data elements stored in the identified one or more data assets;

defining a plurality of physical locations and identifying, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations;

analyzing the identified one or more data elements to determine one or more data transfers between the one or more data assets in different particular physical locations, wherein;

the one or more data assets comprise a first data asset and a second data asset; and

the one or more data transfers comprise a first data transfer between first data asset and the second data asset;

determining one or more attributes for each of the one or more data transfers;

generating a visual representation of a map comprising the plurality of physical locations;

generating an indicia for each of the one or more data assets that indicates the respective particular physical location of the plurality of physical locations for each of the one or more data assets;

generating a visual indication of the one or more data transfers between the one or more data assets based at least in part on the one or more attributes;

performing a data transfer assessment for the first data transfer based at least in part on applying the one or more attributes;

identifying one or more data transfer risks associated with the first data transfer, based at least in part on the one or more attributes;

calculating a risk score for the first data transfer based at least in part on the one or more data transfer risks associated with the first data transfer;

digitally storing the risk score for the first data transfer; and

modifying the visual representation such that the visual indication of the first data transfer reflects the risk score.

2. The computer-implemented data processing method of claim 1, wherein generating the visual representation of the one or more data transfers further comprises:

modifying the visual representation such that each visual indication of the one or more data transfers is color coded based at least in part on the one or more attributes.

3. The computer-implemented data processing method of claim 1, wherein the one or more attributes comprise a first attribute defining a first data retention policy at the first data asset.

4. The computer-implemented data processing method of claim 3, wherein the one or more attributes comprise a second attribute defining a second data retention policy at the first data asset.

5. The computer-implemented data processing method of claim 4, wherein generating the visual indication of the one or more data transfers between the one or more data assets based at least in part on the one or more attributes comprises generating visual indication based on a difference between the first data retention policy and the second data retention policy.

6. The computer-implemented data processing method of claim 4, wherein the first data retention policy comprises an encryption level applied at the first data asset to personal data that is involved in the first data transfer.

7. The computer-implemented data processing method of claim 4, wherein the first data retention policy comprises an amount of time that the personal data that is involved in the first data transfer is stored at the first data asset.

8. The computer-implemented data processing method of claim 1, the method further comprising:

comparing the risk score for the first data transfer to a threshold risk score; and

determining that the risk score for the first data transfer is greater than the threshold risk score; and

in response to determining that the risk score for the data transfer is greater than the threshold risk score, electronically marking the first data transfer for review.

9. A non-transitory computer-readable medium storing computer-executable instructions for:

identifying one or more data assets associated with a particular entity, the one or more data assets comprising a first data asset and a second data asset;

analyzing the one or more data assets to identify one or more data elements stored in the identified one or more data assets;

defining a plurality of physical locations and identifying, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations;

analyzing the identified one or more data elements to determine one or more data transfers between the one or more data assets in different particular physical locations, the one or more data transfers comprising a first data transfer between the first data asset and the second data asset;

determining one or more attributes of each of the one or more data transfers;

generating a visual representation of a map comprising the plurality of physical locations;

generating an indicia for each of the one or more data assets that indicates the respective particular physical location of the plurality of physical locations for each of the one or more data assets;

modifying the visual representation to indicate the one or more data transfers between the one or more data assets based at least in part on the one or more attributes;

performing a data transfer assessment for the first data transfer based at least in part on the one or more attributes;

determining one or more data transfer risks associated with the first data transfer, based at least in part on the data transfer assessment;

calculating a risk score for the first data transfer based at least in part on the one or more data transfer risks associated with the first data transfer;

digitally storing the risk score for the first data transfer; and

modifying the visual representation based at least in part on the risk score.

10. The non-transitory computer-readable medium of claim 9, wherein the plurality of physical locations are selected from the group consisting of:

one or more countries;

one or more continents; and

one or more jurisdictions.

11. The non-transitory computer-readable medium of claim 10, wherein the first data asset is located in a first location of the plurality of physical locations and the second data asset is located in a second location of the plurality of physical locations.

12. The non-transitory computer-readable medium of claim 11, wherein the one or more attributes comprise a first attribute defining a first data retention policy at the first data asset.

13. The non-transitory computer-readable medium of claim 12, wherein the one or more attributes comprise a second attribute defining a second data retention policy at the first data asset.

14. The non-transitory computer-readable medium of claim 13, wherein the first data retention policy comprises a data retention policy selected from the group consisting of:

an encryption level applied at the first data asset to personal data that is involved in the first data transfer; and

an amount of time that the personal data that is involved in the first data transfer is stored at the first data asset.

15. The non-transitory computer-readable medium of claim 13, wherein the non-transitory computer-readable medium further stores computer-executable instructions for:

analyzing the first data retention policy;

analyzing the second data retention policy;

comparing the first data retention policy and the second data retention policy; and

flagging the first data transfer based at least in part on the comparison.

16. The non-transitory computer-readable medium of claim 15, further storing computer-executable instructions for:

determining that the first data retention policy is more stringent than the second data retention policy; and

at least partially in response to determining that the first data retention policy is less stringent than the second data retention policy, automatically flagging the first data transfer as risky.

17. The non-transitory computer-readable medium of claim 15, further storing computer-executable instructions for:

determining that the first data retention policy is less stringent than the second data retention policy; and

at least partially in response to determining that the first data retention policy is less stringent than the second data retention policy, automatically flagging the first data transfer as acceptable.

18. A computer-implemented data processing method for generating a visualization of one or more data transfers between one or more data assets, the method comprising:

identifying, by one or more processors, one or more data assets associated with a particular entity;

analyzing, by one or more processors, the one or more data assets to identify one or more data elements stored in the identified one or more data assets;

defining, by one or more processors, a plurality of physical locations and identifying, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations;

analyzing, by one or more processors, the identified one or more data elements to determine one or more data transfers between the one or more data assets in different particular physical locations, wherein;

the one or more data assets comprise a first data asset and a second data asset; and

the one or more data transfers comprise a first data transfer between first data asset and the second data asset;

generating, by one or more processors, a visual representation of a map comprising the plurality of physical locations;

generating, by one or more processors, on the visual representation of the map, indicia for each of the one or more data assets that indicates the respective particular physical location of the plurality of physical locations for each of the one or more data assets;

generating, by one or more processors, on the visual representation of the map, a visual indication of the one or more data transfers between the one or more data assets;

performing a data transfer assessment for the first data transfer;

identifying one or more data transfer risks associated with the first data transfer;

calculating a risk score for the first data transfer based at least in part on the one or more data transfer risks associated with the first data transfer;

digitally storing the risk score for the first data transfer; and

modifying the visual representation such that a first visual indication of the first data transfer reflects the risk score.