Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods

Patent metadata

Field	Value
Publication number	US-2022141257-A1
Application number	US-202217573808-A
Country	US
Kind code	A1
Filing date	Jan 12, 2022
Priority date	Jun 10, 2016
Publication date	May 5, 2022
Grant date	—

Abstract

In particular embodiments, a Cross-Border Visualization Generation System is configured to: (1) identify one or more data assets associated with a particular entity; (2) analyze the one or more data assets to identify one or more data elements stored in the identified one or more data assets; (3) define a plurality of physical locations and identify, for each of the identified one or more data assets, a respective particular physical location of the plurality of physical locations; (4) analyze the identified one or more data elements to determine one or more data transfers between the one or more data systems in different particular physical locations; (5) determine one or more regulations that relate to the one or more data transfers; and (6) generate a visual representation of the one or more data transfers based at least in part on the one or more regulations.

First claim

What is claimed is:

1 . A method comprising:
determining, by computing hardware, at least one of (a) a type of operation executed by one or more computing systems associated with an entity or (b) a geographic location associated with the one or more computing systems; generating, by the computing hardware, a first data structure having a first set of attributes indicating control actions applicable to the at least one of the type of operation or the geographic location; obtaining, by the computing hardware, a questionnaire having metadata mapping questions of the questionnaire to the first set of attributes in the first data structure; providing, by the computing hardware, the questionnaire for display on a graphical user interface to a user, wherein displaying the questionnaire on the graphical user interface involves providing a first prompt to the user requesting a first answer to a first one of the questions; receiving, by the computing hardware, the first answer; determining, by the computing hardware, a similarly situated entity based on the at least one of the type of operation or the geographic location; generating, by the computing hardware, an ontology mapping the first answer to a second answer used to populate an attribute from a second set of attributes indicating the control actions in a second data structure for the similarly situated entity; performing, by the computing hardware using the ontology, a comparison of the first answer to the second answer to determine the entity does not implement a particular control action of the control actions and the similarly situated entity does implement the particular control action of the control actions; generating, by the computing hardware and based on the comparison, a relative readiness for the entity; and providing, by the computing hardware, an indication of the relative readiness for display on the graphical user interface to the user, wherein the indication of the relative readiness identifies the similarly situated entity does implement the particular control action and the entity does not implement the particular control action.

2 . The method of claim 1 further comprising generating, by the computing hardware and based on the questionnaire, the graphical user interface, wherein generating the graphical user interface comprises configuring the first prompt for requesting the first answer to the first question.

3 . The method of claim 1 , wherein the particular control action comprises at least one of:
(a) a location for storing personal data; (b) a length of time for storing the personal data; (c) a type of the personal data; (d) a type of data subject associated with the personal data; or (e) a multifactor user authentication requirement.

4 . The method of claim 1 , wherein:
the particular control action is required for compliance with a particular privacy standard, the graphical user interface is configured to display a list of privacy standards, and the method further comprises receiving, by the computing hardware, a second indication originating from the graphical user interface of a selection of the particular privacy standard from the list of privacy standards.

5 . The method of claim 1 further comprising:
receiving, by the computing hardware, supporting data associated with the first answer; and
determining, by the computing hardware and based on the supporting data, a confidence level for the first answer.

6 . The method of claim 5 , wherein determining the confidence level for the first answer is based on a source of the supporting data.

7 . The method of claim 1 , wherein the relative readiness for the entity comprises a percentage representing a number of the control actions implemented by the entity as compared to a number of the control actions implemented by the similarly situated entity.

8 . A system comprising:
a non-transitory computer-readable medium storing instructions; and a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
receiving a first indication of at least one of (a) a type of operation executed by a computing system associated with an entity or (b) a geographic location associated with the computing system;
obtaining a questionnaire having metadata mapping questions of the questionnaire to a first set of attributes in a first data structure, wherein the first set of attributes indicate control actions applicable to the at least one of the type of operation or the geographic location;
providing the questionnaire for display on a graphical user interface to a user, wherein displaying the questionnaire on the graphical user interface involves providing a first prompt to the user requesting a first answer to a first one of the questions;
receiving the first answer;
generating an ontology mapping the first answer to a second answer used to populate an attribute from a second set of attributes indicating the control actions in a second data structure for a similarly situated entity, wherein the similarly situated entity is based on the at least one of the type of operation or the geographic location;
performing, using the ontology, a comparison of the first answer to the second answer to determine the entity does not implement a particular control action of the control actions and the similarly situated entity does implement the particular control action of the control actions;
generating, based on the comparison, a relative readiness for the entity; and
providing a second indication of the relative readiness for display on the graphical user interface to the user, wherein the second indication of the relative readiness identifies the similarly situated entity does implement the particular control action and the entity does not implement the particular control action.

9 . The system of claim 8 , wherein the operations further comprise generating, based on the questionnaire, the graphical user interface, wherein generating the graphical user interface comprises configuring the first prompt for requesting the first answer to the first question.

10 . The system of claim 8 , wherein the particular control action comprises at least one of:
(a) a location for storing personal data; (b) a length of time for storing the personal data; (c) a type of the personal data; (d) a type of data subject associated with the personal data; or (e) a multifactor user authentication requirement.

11 . The system of claim 8 , wherein the operations further comprise anonymizing the similarly situated entity so that an identity of the similarly situated entity is not displayed on the graphical user interface.

12 . The system of claim 8 , wherein the operations further comprise:
receiving supporting data associated with the first answer; and determining, based on the supporting data, a confidence level for the first answer.

13 . The system of claim 12 , wherein the supporting data comprises at least one of unsubstantiated data provided by the entity, substantiated data based on a remote interview with the entity, or substantiated data based on an audit of the entity.

14 . The system of claim 8 , wherein the relative readiness for the entity comprises a score representing a percentage of the control actions implemented by the entity as compared to a percentage of the control actions implemented by the similarly situated entity.

15 . A non-transitory computer-readable medium having program code that is stored thereon, the

Assignees

• Onetrust Llc

Inventors

• Brannon Jonathan Blake
• Kveen Bryan Patrick
• Patton-Kuhl Dylan D

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/0421

  Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer · CPC title

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title