Data processing systems for identifying and modifying processes that are subject to data subject access requests
In particular embodiments, in response a data subject submitting a request to delete their personal data from an organization's systems, the system may: (1) automatically determine where the data subject's personal data is stored; (2) in response to determining the location of the data (which may be on multiple computing systems), automatically facilitate the deletion of the data subject's personal data from the various systems; and (3) determine a cause of the request to identify one or more processing activities or other sources that result in a high number of such requests.
1. A computer-implemented data processing method for identifying one or more patterns of related requests to delete personal data associated with one or more data subject from one or more computer systems of an organization, the method comprising:
analyzing, by one or more processors, (i) first metadata associated with a request from a data subject to delete the personal data associated with a data subject from one or more computer systems of an organization, and (ii) second metadata associated with a plurality of additional requests from a plurality of data subjects to delete the personal data associated with each respective data subject of the plurality of data subjects from the one or more computer systems;
identifying a processing activity of a plurality of processing activities from (i) the first metadata associated with the request from the data subject to delete the personal data associated with the data subject from one or more computer systems of the organization a particular number of the plurality of data subject requests, and (ii) the second metadata associated with the plurality of additional requests from the plurality of data subjects to delete the personal data associated with each respective data subject of the plurality of data subjects from the one or more computer systems;
comparing, by one or more processors, a number of occurrences of each processing activity of the plurality of processing activities to a threshold processing activity number of occurrences;
determining, by one or more processors, that a number of occurrences of a particular processing activity is greater than the threshold processing activity number of occurrences; and
in response to determining that the number of occurrences of the particular processing activity is greater than the threshold processing activity number of occurrences, automatically generating an alert indicating that the number of occurrences of the particular processing activity is greater than the threshold processing activity number of occurrences.
2. The computer-implemented data processing method of claim 1 , further comprising:
in response to automatically generating an alert indicating that the number of occurrences of the particular processing activity is greater than the threshold processing activity number of occurrences, automatically modifying the particular processing activity to change at least one type of personal data collected as part of the particular processing activity.
3. The computer-implemented data processing method of claim 1 , wherein the automatically generated alert is provided to one or more privacy officers of the organization.
4. The computer-implemented data processing method of claim 1 , wherein the threshold processing activity number of occurrences is based at least in part on a particular percentage of the plurality of data subjects for whom the system processed data as part of the particular processing activity has submitted one of the plurality of data subject requests.
5. The computer-implemented data processing method of claim 1 , wherein the threshold processing activity number of occurrences is based at least in part on a particular number of the plurality of data subjects for whom the system processed data as part of the particular processing activity has submitted one of the plurality of data subject requests.
6. The computer-implemented data processing method of claim 1 , wherein the threshold processing activity number of occurrences is automatically set based at least in part on a type of the particular processing activity.
7. The computer-implemented data processing method of claim 1 , wherein the threshold processing activity number of occurrences is adjustable by one or more privacy officers of the organization.
8. The computer-implemented data processing method of claim 1 , the method further comprising:
identifying at least one data subject associated with the particular processing activity that has not submitted one of the plurality of data subject requests; and
in response to identifying the at least one data subject, prompting the at least one data subject to provide consent for storage of personal data associated with the at least one data subject as part of the particular processing activity.
9. The computer-implemented data processing method of claim 1 , the method further comprising:
determining whether the organization has recently modified the particular processing activity; and
in response to determining that the organization has recently modified the particular processing activity, automatically modifying the particular processing activity to change a type of personal data collected as part of the particular processing activity.