Data processing systems for generating and populating a data inventory

• US 10,803,097 B2
• Filed: 02/14/2020
• Issued: 10/13/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): Dang, Thanh-Ha
• Application Number:
  US16/791,337
• Publication Number:
  US 20200201888A1
• Time in Patent Office: 242 Days
• Field of Search: 707802
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 40/186 Templates
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). For example, a first data asset may include any software or device (e.g., server or servers) utilized by a particular entity for such data collection, processing, transfer, storage, etc.

Claims

1. A data processing system for data inventory population comprising:

one or more processors;

computer memory; and

a non-transitory computer-readable medium storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

generating a data inventory for a primary data asset used in the collection or storage of personal data;

storing the data inventory in the computer memory;

modifying the data inventory to include one or more data fields that each define an inventory attribute of a plurality of data inventory attributes of the primary data asset;

determining that a first inventory attribute of the plurality of inventory attributes is associated with a processing activity associated with the primary data asset;

determining that a second inventory attribute of the plurality of inventory attributes is associated with storage data associated with personal data processed by the processing activity;

determining that the second inventory attribute of the plurality of inventory attributes comprises a first unpopulated data field;

determining a data inventory attribute value for the first unpopulated data field, wherein determining the data inventory attribute value for the first unpopulated data field comprises;

requesting, via an application programming interface to an application, data associated with the storage data associated with the personal data processed by the processing activity,

receiving, from the application, the data associated with the storage data associated with the personal data processed by the processing activity, and

determining, based at least in part on the data associated with the storage data associated with the personal data processed by the processing activity, the data inventory attribute value for the for the first unpopulated data field;

in response to determining the data inventory attribute value for the first unpopulated data field, modifying the data inventory by populating the first unpopulated data field with the data inventory attribute value; and

storing the modified data inventory in the computer memory.

2. The data processing system of claim 1, wherein the non-transitory computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining that a third inventory attribute of the plurality of inventory attributes comprises a second unpopulated data field; and

determining a second data inventory attribute value for the second unpopulated data field using one or more intelligent identity scanning means.

3. The data processing system of claim 1, wherein the non-transitory computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining that a fourth inventory attribute of the plurality of inventory attributes comprises a third unpopulated data field; and

determining a third data inventory attribute value for the third unpopulated data field using a data repository scanning system.

4. The data processing system of claim 1, wherein the primary data asset is a data asset selected from a group consisting of:

a storage asset;

a collection asset; and

a transfer asset.

5. The data processing system of claim 1, wherein the data associated with the storage data associated with the personal data processed by the processing activity comprises schema details associated with the second inventory attribute of the plurality of inventory attributes.

6. The data processing system of claim 5, wherein the schema details comprise one or more schema details selected from a group consisting of:

an asset ID;

a Schema ID; and

a connection string.

7. The data processing system of claim 1, wherein the application programming interface to the application comprises an interface to a data repository, wherein the non-transitory computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

analyzing the data repository to determine whether the data repository is part of an existing data model of data assets; and

determining the data inventory attribute value for the first unpopulated data field further based at least in part on whether the data repository is part of the existing data model of data assets.

8. The data processing system of claim 1, wherein the non-transitory computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

identifying a second data asset from among one or more data assets associated with the primary data asset; and

determining the data inventory attribute value for the first unpopulated data field further based at least in part on data associated with the second data asset.

9. The data processing system of claim 1, wherein the non-transitory computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining a categorization for the second inventory attribute of the plurality of inventory attributes based at least in part on a confidence score associated with the second inventory attribute of the plurality of inventory attributes.

10. The data processing system of claim 9, wherein the non-transitory computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving input from a user confirming or denying the categorization for the second inventory attribute of the plurality of inventory attributes; and

in response to receiving the input from the user, modifying the confidence score associated with the second inventory attribute of the plurality of inventory attributes.

11. A computer-implemented data processing method of populating a data inventory with one or more data inventory attribute values, the method comprising:

accessing, by one or more processors, a data inventory for a primary data asset from among a plurality of data assets,

wherein the primary data asset collects or stores personal data of one or more data subjects,

wherein the data inventory comprises a plurality of fields that each define an inventory attribute of a plurality of inventory attributes of the primary data asset,

wherein a first inventory attribute of the plurality of inventory attributes is associated with a processing activity associated with the primary data asset, and

wherein a second inventory attribute of the plurality of inventory attributes is associated with a type of personal data processed by the processing activity;

determining, by the one or more processors, that the second inventory attribute of the plurality of inventory attributes is an unpopulated data field;

determining, by the one or more processors, a data inventory attribute value for the unpopulated second inventory attribute of the plurality of inventory attributes, wherein determining the data inventory attribute value for the unpopulated second inventory attribute of the plurality of inventory attributes comprises;

requesting, by the one or more processors via an application programming interface to an application, data associated with the type of personal data processed by the processing activity,

receiving, by the one or more processors from the application, the data associated with the type of personal data processed by the processing activity, and

determining, by the one or more processors based at least in part on the data associated with the type of personal data processed by the processing activity, the data inventory attribute value for the unpopulated second inventory attribute of the plurality of inventory attributes;

in response to determining the data inventory attribute value for the unpopulated second inventory attribute of the plurality of inventory attributes, modifying the unpopulated second inventory attribute of the plurality of inventory attributes to include the data inventory attribute value; and

storing the modified data inventory in the computer memory.

12. The computer-implemented data processing method of claim 11, wherein one or more inventory attributes of the plurality of inventory attributes of the primary data asset are associated with a data inventory attribute selected from a group consisting of:

a storage asset inventory attribute;

a collection asset inventory attribute; and

a transfer asset inventory attribute.

13. The computer-implemented data processing method of claim 11, wherein the application programming interface to the application comprises an interface to a third-party information technology system.

14. The computer-implemented data processing method of claim 11, wherein the application programming interface to the application comprises an interface to an application executing on a remote computing device.

15. The computer-implemented data processing method of claim 11, wherein the application programming interface to the application comprises an interface to a server storing data asset assessment information associated with the primary data asset.

16. The computer-implemented data processing method of claim 15, wherein receiving the data associated with the type of personal data processed by the processing activity comprises receiving a subset of the data asset assessment information associated with the primary data asset from the server.

17. The computer-implemented data processing method of claim 11, wherein the application programming interface to the application comprises an interface to a data repository,

wherein the method further comprises analyzing the data inventory attribute value for the unpopulated second inventory attribute of the plurality of inventory attributes and correlating metadata for the data repository with the data inventory attribute value for the unpopulated second inventory attribute of the plurality of inventory attributes.

18. The computer-implemented data processing method of claim 11, wherein the method further comprises using one or more machine learning techniques to categorize the second inventory attribute of the plurality of inventory attributes.

19. The computer-implemented data processing method of claim 18, wherein the method further comprises requesting user feedback regarding the categorization of the second inventory attribute of the plurality of inventory attributes.

20. The computer-implemented data processing method of claim 18, wherein the method further comprises:

determining one or more individuals with access to the personal data collected or stored by the primary data asset; and

modifying one or more of the plurality of inventory attributes to include access data that includes the one or more individuals with access to the personal data collected or stored by the primary data asset.