Data processing systems and methods for generating personal data inventories for organizations and other entities

Patent metadata

Field	Value
Publication number	US-10026110-B2
Application number	US-201715619469-A
Country	US
Kind code	B2
Filing date	Jun 10, 2017
Priority date	Apr 1, 2016
Publication date	Jul 17, 2018
Grant date	Jul 17, 2018

Abstract

Data processing systems and methods, according to various embodiments, are configured for generating personal data inventories for an organization by: (1) conducting, by one or more computer processors, privacy impact assessments for each of the organization's new business initiatives, the privacy impact assessments including both data-mapping and non-data-mapping questions; (2) flagging, by one or more computer processors, any data-mapping questions within the privacy impact assessments as data mapping questions; and (3) generating, one or more computer processors, personal data inventories on-demand based on the flagged data-mapping data.

First claim

What is claimed is:

1. A computer-implemented data processing method for automatically generating an inventory of personal data stored by a particular organization, the data processing method comprising, for each of a plurality of particular privacy campaigns:
presenting, on one or more computer user interfaces, a plurality of prompts for the input of data mapping data related to the particular privacy campaign, wherein each of the plurality of particular privacy campaigns utilizes personal data collected from one or more persons or one or more entities;
electronically receiving the data mapping data via input by one or more users, wherein the data mapping data comprises:
a descriptor of the particular privacy campaign;
an identification of one or more types of particular personal data to be acquired or used during the privacy campaign;
data indicating one or more locations in computer memory where the particular personal data is to be stored; and
data identifying one or more particular types of individuals who will have access to the particular personal data;

processing the data mapping data by electronically associating the data mapping data with a record for the particular privacy campaign;
digitally storing, in memory, the data mapping data associated with the record for the particular campaign;
determining, based at least in part on the data mapping data, a risk value associated with the privacy campaign, wherein determining the risk value comprises:
electronically retrieving, from memory, the data mapping data associated with the record for the privacy campaign;
electronically determining a weighting factor for each of a plurality of risk factors, wherein the plurality of the risk factors comprises:
the descriptor of the particular privacy campaign;
the identification of one or more type of particular personal data to be acquired or used during the privacy campaign;
the data indicating one or more locations in computer memory where the particular personal data is to be store; and
the data identifying one or more particular types of individual who will have access to the particular personal data;

electronically determining a relative risk rating for each of the plurality of risk factors; and
electronically calculating a risk value for the privacy campaign based upon, for each respective one of the plurality of risk factors, the relative risk rating for the respective risk factor and the weighting factor for the respective risk factor; and

storing the risk value in computer memory,
wherein the computer-implemented data processing method further comprises:
receiving, via a user interface, a request to generate an inventory of personal data for the particular organization; and
in response to receiving the request, generating the requested inventory of personal data for the particular organization, wherein the requested inventory comprises the data mapping data for each of the plurality of particular privacy campaigns.

2. The computer-implemented data processing method of claim 1 , wherein the method further comprises electronically flagging one or more of the plurality of prompts as a prompt requesting data mapping data.

3. The computer-implemented data processing method of claim 2 , wherein the electronically flagged one or more of the plurality of prompts prompt a user to input data mapping data for the particular privacy campaign.

4. The computer-implemented method of claim 1 , wherein each of the plurality of prompts for input of data mapping data includes a respective unique identifier to associate its respective prompt with a respective category of data mapping data selected from a group consisting of:
campaign description;
type of personal data;
time period for storage of the personal data; and
storage location of personal data.

5. The computer-implemented method of claim 1 , further comprising automatically configuring the plurality of prompts for the input of data mapping data based on a selection of a particular template from one or more templates.

6. The computer-implemented method of claim 5 , wherein the particular template of the one or more templates is selected based on a type of the particular privacy campaign.

7. A computer-implemented data processing method for automatically generating an inventory of personal data stored by a particular organization, the data processing method comprising:
for each of a plurality of particular privacy campaigns, wherein each of the plurality of particular privacy campaigns utilizes personal data collected from one or more persons or one or more entities:
receiving, via a computer user interface, a command to create an electronic record for the particular privacy campaign;
in response to receiving the command, creating an electronic record for the particular privacy campaign and digitally storing the record in memory;
presenting, on one or more computer user interfaces, a plurality of prompts for the input of data mapping data related to the privacy campaign;
electronically receiving data mapping data input by one or more users, wherein the data mapping data comprises:
a description of the privacy campaign;
an identification of one or more types of particular personal data related to the privacy campaign;
data identifying a particular type of subject from which the personal data was collected;
data indicating one or more locations in computer memory where the personal data is to be stored; and
data identifying one or more particular types of individual who will have access to the particular personal data;

processing the data mapping data by electronically associating the data mapping data with the record for the particular privacy campaign; and
digitally storing, in memory, the data mapping data associated with the record for the particular campaign;
determining, based at least in part on the data mapping data, a risk value associated with the privacy campaign, wherein determining the risk value comprises:
electronically retrieving, from memory, the data mapping data associated with the record for the privacy campaign;
electronically determining a weighting factor for each of a plurality of risk factors, wherein the plurality of risk factors comprises:
the identification of one or more types of particular personal data related to the privacy campaign;
the data identifying a particular type of subject from which the personal data was collected; and
the data indicating one or more locations in computer memory where the particular personal data is to be stored,

electronically determining a relative risk rating for each of the plurality of risk factors;
electronically calculating a risk value for the privacy campaign based upon, for each respective one of the plurality of risk factors, the relative risk rating for the respective risk factor and the weighting factor for the respective risk factor;

storing the risk value in computer memory;
receiving a request, from a user, to display an inventory of personal data for the particular organization that includes the data mapping data for each of the plurality of particular campaigns; and
in response to receiving the request to display the inventory of personal data for the particular organization that includes the data mapping data for each of the plurality of particular campaigns, displaying, on a display screen, the inventory of personal data for the particular organization.

8. The computer-implemented data processing method of claim 7 , further comprising:
storing the plurality of prompts for the input of data mapping data among a plurality of user selection tabs for presentation of the plurality of prompts for the input of data mapping data along with one or more different prompts for no

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A

Classifications

• G06Q50/265

  Personal security, identity or safety · CPC title

• G06Q30/0609 Primary

  Qualifying participants for shopping transactions (payment transaction verification G06Q20/401) · CPC title

• G06Q10/063114

  Status monitoring or status determination for a person or group · CPC title