Data processing systems for generating and populating a data inventory

Patent metadata

Field	Value
Publication number	US-11138336-B2
Application number	US-202117198757-A
Country	US
Kind code	B2
Filing date	Mar 11, 2021
Priority date	Jun 10, 2016
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

A computer-implemented method for populating a privacy-related data model by: (1) providing a data model that comprises one or more respective populated or unpopulated fields; (2) determining that at least a particular one of the fields for a particular data asset is an unpopulated field; (3) at least partially in response to determining that the at least one particular field is unpopulated, automatically generating a privacy questionnaire comprising at least one question that, if properly answered, would result in a response that may be used to populate the at least one particular unpopulated field; (4) transmitting the privacy questionnaire to at least one individual; (5) receiving a response to the questionnaire, the response comprising a respective answer to the at least one question; and (6) in response to receiving the response, populating the at least one particular unpopulated field with information from the received response.

First claim

What is claimed is:

1. A computer-implemented data processing method for populating a privacy-related data model, the method comprising:
generating, by one or more computer processors, a data model that defines one or more electronic links between a plurality of data assets, wherein the data model comprises a plurality of data inventories that each define one or more inventory attributes for a respective data asset of the plurality of data assets;
determining, by one or more computer processors, a respective value for each attribute of a first subset of inventory attributes of a first data inventory of the plurality of data inventories for a first data asset of the plurality of data assets;
populating, by one or more computer processors, each attribute of the first subset of inventory attributes of the first data inventory with the respective determined value;
storing, by one or more computer processors in a computer memory, the data model;
determining, by one or more computer processors, that at least one particular attribute of a second subset of inventory attributes of the first data inventory of the plurality of data inventories for the first data asset of the plurality of data assets is unpopulated;
at least partially in response to determining that the at least one attribute of the second subset of inventory attributes of the first data inventory is unpopulated, automatically generating, by one or more computer processors, a privacy questionnaire comprising:
at least one question that, if properly answered, would result in a response that may be used to populate the at least one attribute of the second subset of inventory attributes of the first data inventory; and
a user-selectable risk indicium associated with the at least one question;

presenting, by one or more computer processors on a video display device, a graphical user interface comprising the privacy questionnaire to at least one individual;
receiving, by one or more computer processors as input via the graphical user interface, a response to the questionnaire, the response comprising a respective answer to the at least one question and an indication of a user selection of the user-selectable risk indicium;
at least partially in response to receiving, in the response, the respective answer to the at least one question, updating the data model by populating, by one or more computer processors, the at least one attribute of the second subset of inventory attributes of the first data inventory with the respective answer to the at least one question;
at least partially in response to receiving, in the response, the indication of the user selection of the user-selectable risk indicium, updating the data model by associating, by one or more computer processors, a flag with the at least one attribute of the second subset of inventory attributes of the first data inventory; and
analyzing, by one or more computer processors, the updated data model to determine a risk associated with the first data asset by:
identifying the flag associated with the at least one attribute of the second subset of inventory attributes of the first data inventory;
determining, based at least in part on the flag associated with the at least one attribute of the second subset of inventory attributes of the first data inventory, a first risk value for the at least one attribute of the second subset of inventory attributes of the first data inventory; and
calculating a risk level for the first data asset using the first risk level value for the at least one attribute of the second subset of inventory attributes of the first data inventory.

2. The computer-implemented data processing method of claim 1 , wherein the at least one attribute of the second subset of inventory attributes of the first data inventory comprises a processing activity associated with the first data asset.

3. The computer-implemented data processing method of claim 1 , wherein the at least one attribute of the second subset of inventory attributes of the first data inventory comprises an indication of a second data asset of the plurality of data assets.

4. The computer-implemented data processing method of claim 1 , further comprising modifying, by one or more computer processors, the privacy questionnaire based at least in part on the response.

5. The computer-implemented data processing method of claim 1 , further comprising:
analyzing, by one or more computer processors, the response to identify a new data asset that is not currently referenced within the data model; and
at least partially in response to identifying the new data asset, generating, by one or more computer processors, a new data asset inventory for the new data asset.

6. The computer-implemented data processing method of claim 5 , wherein the new data asset comprises a data asset selected from a group consisting of:
(a) a software application for collecting specific personal data referenced within the data model; and
(b) one or more computer servers for storing the specific personal data.

7. The computer-implemented data processing method of claim 1 , wherein the response further comprises one or more risk attributes associated with the at least one attribute of the second subset of inventory attributes of the first data inventory selected from a group of risk attributes consisting of:
(a) a risk likelihood;
(b) a risk severity;
(c) a risk description; and
(d) a risk recommendation.

8. A computer system for populating a privacy-related data model comprising:
at least one computer processor;
a non-transitory computer-readable medium storing computer executable instructions that, when executed by the at least one computer processor, cause the at least one computer processor to perform operations comprising:
accessing, by the at least one computer processor, a data model that defines one or more electronic links between a plurality of data assets, wherein the data model comprises a plurality of data inventories that each define one or more inventory attributes for a respective data asset of the plurality of data assets;
identifying, by the at least one computer processor, one or more unpopulated inventory attributes of a first data inventory of the plurality of data inventories for a first data asset of the plurality of data assets;
at least partially in response to identifying the one or more unpopulated inventory attributes of the first data inventory, automatically generating, by the at least one computer processor, a privacy questionnaire comprising:
at least one question that, if properly answered, would result in a response that may be used to populate one or more of the one or more unpopulated inventory attributes of the first data inventory; and
a user-selectable control associated with the at least one question;

presenting, by the at least one computer processor on a video display device, a graphical user interface comprising the privacy questionnaire to at least one individual;
receiving, by the at least one computer processor as input via the graphical user interface, a response to the questionnaire, the response comprising a respective answer to the at least one question and an indication of a user selection of the user-selectable control associated with the at least one question;
at least partially in response to receiving, in the response, the respective answer to the at least one question, updating the data model by populating, by the at least one computer processor, the one or more of the one or more unpopulated inventory attributes of the first data inventory with the respective answer to the at least one question;
at least partially in response to receiving, in the response, the indication of the user selection of the user-selectable

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06Q30/0201

  Market modelling; Market analysis; Collecting market data · CPC title

• G06F16/1727

  Details of free space management performed by the file system (saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064) · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F16/252

  between a Database Management System and a front-end application · CPC title