Data processing systems for generating and populating a data inventory

Patent metadata

Field	Value
Publication number	US-11347889-B2
Application number	US-202117491906-A
Country	US
Kind code	B2
Filing date	Oct 1, 2021
Priority date	Jun 10, 2016
Publication date	May 31, 2022
Grant date	May 31, 2022

Abstract

A computer-implemented method for populating a privacy-related data model by: (1) providing a data model that comprises one or more respective populated or unpopulated fields; (2) determining that at least a particular one of the fields for a particular data asset is an unpopulated field; (3) at least partially in response to determining that the at least one particular field is unpopulated, automatically generating a privacy questionnaire comprising at least one question that, if properly answered, would result in a response that may be used to populate the at least one particular unpopulated field; (4) transmitting the privacy questionnaire to at least one individual; (5) receiving a response to the questionnaire, the response comprising a respective answer to the at least one question; and (6) in response to receiving the response, populating the at least one particular unpopulated field with information from the received response.

First claim

What is claimed is:

1. A method comprising:
identifying, by computing hardware, a data inventory, wherein the data inventory defines a plurality of inventory attributes for a data asset;
determining, by the computing hardware, that a first inventory attribute of the plurality of inventory attributes is unpopulated;
responsive to determining that the first inventory attribute is unpopulated, automatically generating, by the computing hardware, an inventory questionnaire for populating the first inventory attribute, the inventory questionnaire comprising:
a question soliciting an answer for populating the first inventory attribute; and
a user-selectable risk indicium associated with the question;

causing, by the computing hardware, a video display device to present a graphical user interface comprising the inventory questionnaire to a user;
receiving, by the computing hardware as input via the graphical user interface, a response to the inventory questionnaire, the response comprising the answer to the question and an indication of a user selection of the user-selectable risk indicium;
responsive to receiving the response, populating, by the computing hardware, the first inventory attribute in the data inventory with the answer to the question;
associating, by the computing hardware, the first inventory attribute with a flag corresponding to the indication of the user selection of the user-selectable risk indicium; and
analyzing, by the computing hardware, the data inventory to determine a risk associated with the data asset by:
identifying the flag associated with the first inventory attribute;
determining, based on the flag associated with the first inventory attribute, a risk value for the first inventory attribute; and
calculating a risk level for the data asset using the risk value for the first inventory attribute.

2. The method of claim 1 , wherein the data asset is found in a data model that: (i) comprises a plurality of data assets; (ii) defines a plurality of electronic links between the plurality of data assets; and (iii) comprises a respective data inventory for each of the plurality of data assets.

3. The method of claim 1 , wherein the inventory questionnaire is generated using a data asset template that maps the question to the first inventory attribute.

4. The method of claim 3 , wherein populating the first inventory attribute in the data inventory with the answer to the question is performed by using the data asset template.

5. The method of claim 1 further comprising causing, by the computing hardware, the video display device to present the graphical user interface comprising a visual representation of the data inventory to the user, wherein the visual representation comprises a visual indication of the risk level for the data asset.

6. The method of claim 1 , wherein the first inventory attribute comprises at least one of a type of data stored at the data asset, an amount of data stored at the data asset, an encryption status of data stored at the data asset, or transfer data associated with data stored at the data asset.

7. The method of claim 1 , wherein the response further comprises a risk attribute associated with the first inventory attribute that represents at least one of a risk likelihood, a risk severity, a risk description, or a risk recommendation.

8. The method of claim 1 , wherein the data asset comprises at least one of a software application for collecting personal data of data subjects or computer storage for storing the personal data.

9. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
identifying a processing activity inventory, wherein the processing activity inventory defines a plurality of processing activity inventory attributes for a processing activity;
determining that a first processing activity inventory attribute of the plurality of processing activity inventory attributes is unpopulated;
responsive to determining that the first processing activity inventory attribute is unpopulated, automatically generating a processing activity assessment for populating the first processing activity inventory attribute, the processing activity assessment comprising:
a question soliciting an answer for populating the first processing activity inventory attribute; and
a user-selectable risk indicium associated with the question;

proving the processing activity assessment for display to a user on a graphical user interface via a video display device;
receiving, as input via the graphical user interface, a response to the processing activity assessment, the response comprising the answer to the question and an indication of a user selection of the user-selectable risk indicium;
responsive to receiving the response, populating the first processing activity inventory attribute in the processing activity inventory with the answer to the question;
associating the first processing activity inventory attribute with a flag corresponding to the indication of the user selection of the user-selectable risk indicium; and
analyzing the processing activity inventory to determine a risk associated with the processing activity by:
identifying the flag associated with the first processing activity inventory attribute;
determining, based on the flag associated with the first processing activity inventory attribute, a risk value for the first processing activity inventory attribute; and
calculating a risk level for the processing activity using the risk value for the first processing activity inventory attribute.

10. The system of claim 9 , wherein the processing activity assessment is generated using a processing activity template that maps the question to the first processing activity inventory attribute.

11. The system of claim 10 , wherein populating the first processing activity inventory attribute in the processing activity inventory with the answer to the question is performed by using the processing activity template.

12. The system of claim 9 , wherein the response further comprises risk mitigation information associated with the first processing activity inventory attribute.

13. The system of claim 12 , wherein calculating the risk level for the processing activity is based on the risk mitigation information.

14. The system of claim 9 , wherein the operations further comprise providing a visual representation for display on the graphical user interface that comprises a flow of data processed by the processing activity.

15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
identifying a data inventory, wherein the data inventory defines an inventory attribute for a data asset;
determining that the inventory attribute is unpopulated;
responsive to determining that the inventory attribute is unpopulated, automatically generating an inventory questionnaire for populating the inventory attribute, the inventory questionnaire comprising:
a question soliciting an answer for populating the inventory attribute; and
a user-selectable risk indicium associated with the question;

providing the inventory questionnaire for display on a graphical user interface via a video display device;
receiving, as input via the graphical user interface, a response to the inventory questionnaire, the r

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• G06F16/2457

  with adaptation to user needs · CPC title

• G06F16/1727

  Details of free space management performed by the file system (saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064) · CPC title

• G06Q30/0201

  Market modelling; Market analysis; Collecting market data · CPC title

• G06F16/252

  between a Database Management System and a front-end application · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title