Systems and methods for identifying data processing activities based on data discovery results

Patent metadata

Field	Value
Publication number	US-11615192-B2
Application number	US-202217828953-A
Country	US
Kind code	B2
Filing date	May 31, 2022
Priority date	Nov 6, 2020
Publication date	Mar 28, 2023
Grant date	Mar 28, 2023

Abstract

Aspects of the present invention provide methods, apparatuses, systems, computing devices, computing entities, and/or the like for identifying data processing activities associated with various data assets based on data discovery results. In accordance various aspects, a method is provided comprising: identifying and scanning data assets to detect a subset of the data assets, wherein each asset of the subset is associated with a particular data element used for target data; generating a prediction for each pair of data assets of the subset on the target data flowing between the pair; identifying a data flow for the target data based on the prediction generated for each pair; and identifying a data processing activity associated with handling the target data based on a correlation identified for the particular data element, the subset, and/or the data flow with a known data element, subset, and/or data flow for the data processing activity.

First claim

What is claimed is:

1. A method comprising:
causing, by computing hardware, scanning of a plurality of data assets associated with a computing system to detect a subset of data assets found in the plurality of data assets, wherein each data asset in the subset of data assets includes a particular data element used in handling target data;
injecting, by the computing hardware, test data into the computing system, wherein:
the test data is associated with the target data; and
injecting the test data into the computing system causes a propagation of the test data through the subset of data assets for the computing system;

identifying, by the computing hardware and based on the propagation of the test data through the subset of data assets for the computing system, a data flow for the test data between the data assets of the subset of data assets; and
identifying, by the computing hardware, a data processing activity associated with the target data based on matching at least one of the particular data element used in handling the target data for each data asset of the subset of data assets, the subset of data assets, or the data flow with at least one of a known data element, a known subset of data assets, a known data flow, or a known data processing activity.

2. The method of claim 1 further comprising causing, by the computing hardware and based on the data processing activity associated with the target data, performance of an action.

3. The method of claim 2 , wherein the action comprises recording results indicating the data processing activity is associated with the target data for the computing system.

4. The method of claim 3 , wherein the action further comprises:
receiving a request from an individual to at least one of view, receive, access, revise, or delete the target data for the individual from the computing system; and
responsive to receiving the request, processing the request by accessing the results to identify the data processing activity associated with the target data.

5. The method of claim 2 , wherein the action comprises:
identifying a risk associated with the data processing activity being associated with the target data; and
responsive to identifying the risk, performing at least one of communicating the risk to an individual, initiating a process to suspend the data processing activity, or initiating a process to encrypt the target data.

6. The method of claim 1 , wherein causing scanning the plurality of data assets comprises installing software within the computing system that scans the computing system to detect the subset of data assets.

7. The method of claim 1 , wherein identifying the data flow for the test data between the data assets of the subset of data assets comprises causing scanning the subset of data assets using software installed within the computing system to detect the propagation to the test data through the subset of data assets.

8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
identifying, from a plurality of data assets associated with a computing system, a subset of data assets found in the plurality of data assets, wherein each data asset in the subset of data assets includes a particular data element used in handling target data;
identifying, based on a propagation of test data associated with the target data through the subset of data assets for the computing system, a data flow for the test data between the data assets of the subset of data assets, wherein the test data has been injected into the computing system to cause the propagation of the test data through the subset of data assets for the computing system; and
identifying a data processing activity associated with the target data based on matching at least one of the particular data element used in handling the target data for each data asset of the subset of data assets, the subset of data assets, or the data flow with at least one of a known data element, a known subset of data assets, a known data flow, or a known data processing activity.

9. The system of claim 8 , wherein the operations further comprise causing, based on the data processing activity associated with the target data, performance of an action.

10. The system of claim 9 , wherein the action comprises recording results indicating the data processing activity is associated with the target data for the computing system.

11. The system of claim 10 , wherein the action further comprises:
receiving a request from an individual to at least one of view, receive, access, revise, or delete the target data for the individual from the computing system; and
responsive to receiving the request, processing the request by accessing the results to identify the data processing activity associated with the target data.

12. The system of claim 9 , wherein the action comprises:
identifying a risk associated with the data processing activity being associated with the target data; and
responsive to identifying the risk, performing at least one of communicating the risk to an individual, initiating a process to suspend the data processing activity, or initiating a process to encrypt the target data.

13. The system of claim 8 , wherein identifying the subset of data assets is based on a scan of the plurality of data assets performed by software installed within the computing system to detect the particular data element used in handling the target data for each data asset of the subset of data assets.

14. The system of claim 8 , wherein identifying the data flow for the test data between the data assets of the subset of data assets is based on a scan of the subset of data assets performed by software installed within the computing system to detect the propagation to the test data through the subset of data assets.

15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
scanning of a plurality of data assets associated with a computing system to detect a subset of data assets found in the plurality of data assets, wherein each data asset in the subset of data assets includes a particular data element used in handling target data; and
scanning the subset of data assets for the computing system to identify a propagation of test data through the subset of data assets, wherein:
the test data is associated with the target data and is injected into the computing system to cause the propagation of the test data through the subset of data assets for the computing system,
the propagation of the test data is used in identifying a data flow for the test data between the data assets of the subset of data assets, and
the data flow is used for identifying a data processing activity associated with the target data based on matching the data flow with at least one of a known data flow or a known data processing activity.

16. The non-transitory computer-readable medium of claim 15 , wherein an action is performed based on the data processing activity being associated with the target data.

17. The non-transitory computer-readable medium of claim 16 , wherein the action comprises:
recording results indicating the data processing activity is associated with the target data for the computing system;
receiving a request from an individual

Assignees

• Onetrust Llc

Inventors

• Brannon Jonathan Blake
• Jones Kevin
• Pitchaimani Saravanan
• Patton-Kuhl Dylan D
• Malladi Ramana
• Viswanathan Subramanian

Classifications

• G06F16/906

  Clustering; Classification · CPC title

• G06V30/248

  involving plural approaches, e.g. verification by template match; Resolving confusion among similar patterns, e.g. "O" versus "Q" (G06V30/242 takes precedence) · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06N20/00

  Machine learning · CPC title

• G06V30/2528

  Combination of methods, e.g. classifiers, working on the same input data · CPC title