Privacy management systems and methods
Data processing systems and methods, according to various embodiments, are adapted for mapping various questions regarding a data breach from a master questionnaire to a plurality of territory-specific data breach disclosure questionnaires. The answers to the questions in the master questionnaire are used to populate the territory-specific data breach disclosure questionnaires and determine whether disclosure is required in territory. The system can automatically notify the appropriate regulatory bodies for each territory where it is determined that data breach disclosure is required.
1. A computer-implemented data processing method for determining data breach response activities, the method comprising:
generating, by one or more computer processors, a data breach information interface soliciting a first affected jurisdiction, a second affected jurisdiction, and data breach information;
presenting, by the one or more computer processors, the data breach information interface to a user;
receiving, by the one or more computer processors from the user via the data breach information interface, an indication of the first affected jurisdiction, an indication of the second affected jurisdiction, and the data breach information;
determining, by the one or more computer processors based on the first affected jurisdiction and the data breach information, a first plurality of data breach response requirements for the first affected jurisdiction;
determining, by the one or more computer processors based on the second affected jurisdiction and the data breach information, a second plurality of data breach response requirements for the second affected jurisdiction;
presenting, by the one or more computer processors to the user, a data breach response interface comprising a plurality of checklist items, wherein each checklist item of the plurality of checklist items corresponds to one or more of one requirement of the first plurality of data breach response requirements for the first affected jurisdiction and one requirement of the second plurality of data breach response requirements for the second affected jurisdiction;
detecting, by the one or more computer processors, an activation by the user of a first checklist item of the plurality of checklist items;
determining, by the one or more computer processors, a first data breach response requirement of the first plurality of data breach response requirements for the first affected jurisdiction corresponding to the first checklist item and a second data breach response requirement of the second plurality of data breach response requirements for the second affected jurisdiction corresponding to the first checklist item;
storing, in a memory by the one or more computer processors, an indication of completion of the first data breach response requirement;
storing, in the memory by the one or more computer processors, an indication of completion of the second data breach response requirement;
generating, by the one or more computer processors, a first data breach disclosure report for the first jurisdiction, the first data breach disclosure report comprising the indication of completion of the first data breach response requirement; and
generating, by the one or more computer processors, a second data breach disclosure report for the second jurisdiction, the second data breach disclosure report comprising the indication of completion of the second data breach response requirement.
2. The computer-implemented data processing method of claim 1 , wherein the data breach information interface solicits a third affected jurisdiction, the method further comprising:
receiving, by the one or more computer processors from the user via the data breach information interface, an indication of the third affected jurisdiction;
determining, by the one or more computer processors based on the third affected jurisdiction and the data breach information, a third plurality of data breach response requirements for the third affected jurisdiction;
determining, by the one or more computer processors based on the third affected jurisdiction and the data breach information, a penalty for failing to address the third plurality of data breach response requirements for the third affected jurisdiction; and
determining, by the one or more computer processors based on the penalty, to generate the data breach response interface comprising the plurality of checklist items, wherein no checklist item of the plurality of checklist items corresponds to a requirement of the third plurality of data breach response requirements for the third affected jurisdiction.
3. The computer-implemented data processing method of claim 1 , wherein the data breach information interface solicits a third affected jurisdiction, the method further comprising:
receiving, by the one or more computer processors from the user via the data breach information interface, an indication of the third affected jurisdiction;
determining, by the one or more computer processors based on the third affected jurisdiction and the data breach information, a third plurality of data breach response requirements for the third affected jurisdiction;
determining, by the one or more computer processors based on the third affected jurisdiction and the data breach information, an enforcement frequency for failures to address the third plurality of data breach response requirements for the third affected jurisdiction; and
determining, by the one or more computer processors based on the enforcement frequency, to generate the data breach response interface comprising the plurality of checklist items, wherein no checklist item of the plurality of checklist items corresponds to a requirement of the third plurality of data breach response requirements for the third affected jurisdiction.
4. The computer-implemented data processing method of claim 1 , wherein the data breach information interface solicits a third affected jurisdiction and a business value for the third affected jurisdiction, the method further comprising:
determining, by the one or more computer processors based on the business value for the third affected jurisdiction, to generate the data breach response interface comprising the plurality of checklist items, wherein no checklist item of the plurality of checklist items corresponds to a requirement of a third plurality of data breach response requirements for the third affected jurisdiction.
5. The computer-implemented data processing method of claim 1 , wherein the data breach information comprises at least one of a number of affected users, a data breach discovery date, a data breach discovery time, a data breach occurrence date, a data breach occurrence time, a personal data type, or a data breach discovery method.
6. The computer-implemented data processing method of claim 1 , wherein the first plurality of data breach response requirements comprises at least one of:
generating a notification to a regulatory agency,
generating a notification to affected data subjects, or
generating a notification to an internal organization.
7. The computer-implemented data processing method of claim 1 , wherein the data breach information interface is presented to the user via a web browser.
8. A computer-implemented data processing method for performing data breach response activities, the method comprising:
determining, by one or more computer processors, a first jurisdiction affected by a data breach;
determining, by the one or more computer processors, a first plurality of reporting requirements for the first jurisdiction;
determining, by the one or more computer processors, a second jurisdiction affected by the data breach;
determining, by the one or more computer processors, a second plurality of reporting requirements for the second jurisdiction;
generating, by the one or more computer processors, an ontology mapping a first reporting requirement of the first plurality of reporting requirements to a second reporting requirement of the second plurality of reporting requirements;
generating, by the one or more computer processors, a master questionnaire comprising a master question;
mapping, in the ontology by the one or more computer processors, the first reporting requirement of the first plurality of reporting requirements to the master question;
mapping, in the ontology by the one or more computer processors, the second reporting requirement of the second plurality of reporting requirements to the master question;
presenting, by the one or more computer processors, the master questionnaire to a user;
receiving, by the one or more computer processors, data responsive to the master question from the user;
storing, by the one or more computer processors, the data responsive to the master question;
associating, by the one or more computer processors using the ontology, the data responsive to the master question with the first reporting requirement of the first plurality of reporting requirement;
associating, by the one or more computer processors using the ontology, the data responsive to the master question with the second reporting requirement of the second plurality of reporting requirements;
generating, by the one or more computer processors, a first data breach disclosure report for the first jurisdiction, the first data breach disclosure report comprising the data responsive to the master question; and
generating, by the one or more computer processors, a second data breach disclosure report for the second jurisdiction, the second data breach disclosure report comprising the data responsive to the master question.
9. The computer-implemented data processing method of claim 8 , the method further comprising:
determining, by the one or more computer processors, a third jurisdiction affected by a data breach;
determining, by the one or more computer processors based on the third jurisdiction, a penalty for failing to address a third plurality of reporting requirements for the third jurisdiction; and
determining, by the one or more computer processors based on the penalty, to generate the ontology with no mapping of a reporting requirement of the third plurality of reporting requirements to the master question.
10. The computer-implemented data processing method of claim 8 , the method further comprising:
determining, by the one or more computer processors, a third jurisdiction affected by a data breach;
determining, by the one or more computer processors based on the third jurisdiction, an enforcement frequency for failures to address a third plurality of reporting requirements for the third jurisdiction; and
determining, by the one or more computer processors based on the enforcement frequency, to generate the ontology with no mapping of a reporting requirement of the third plurality of reporting requirements to the master question.
11. The computer-implemented data processing method of claim 8 , the method further comprising:
determining, by the one or more computer processors, a third jurisdiction affected by a data breach and a business value for the third jurisdiction; and
determining, by the one or more computer processors based on the business value for the third jurisdiction, to generate the ontology with no mapping of a reporting requirement of a third plurality of reporting requirements for the third jurisdiction to the master question.
12. The computer-implemented data processing method of claim 8 , wherein the master questionnaire comprises a plurality of questions, and wherein:
a first question of the plurality of questions solicits a number of affected users,
a second question of the plurality of questions solicits a data breach discovery date, and
a third question of the plurality of questions solicits a data breach discovery method.
13. The computer-implemented data processing method of claim 8 , further comprising:
determining a first penalty for failing to address the first plurality of reporting requirements for the first jurisdiction; and
determining a second penalty for failing to address the second plurality of reporting requirements for the second jurisdiction.
14. The computer-implemented data processing method of claim 8 , further comprising:
determining a first enforcement frequency for failures to address the first plurality of reporting requirements for the first jurisdiction; and
determining a second enforcement frequency for failures to address the second plurality of reporting requirements for the second jurisdiction.
15. A data breach response system comprising:
one or more processors; and
computer memory, wherein the data breach response system is configured for:
generating a data breach information interface soliciting a first affected jurisdiction, a second affected jurisdiction, and data breach information;
presenting the data breach information interface to a user;
receiving, from the user via the data breach information interface, an indication of the first affected jurisdiction, an indication of the second affected jurisdiction, and the data breach information;
determining, based on the first affected jurisdiction and the data breach information, a first plurality of data breach response requirements for the first affected jurisdiction;
determining, based on the second affected jurisdiction and the data breach information, a second plurality of data breach response requirements for the second affected jurisdiction;
generating an ontology mapping a first requirement of the first plurality of data breach response requirements to a second requirement of the second plurality of data breach response requirements;
generating a master questionnaire comprising a master question;
mapping the first requirement of the first plurality of data breach response requirements to the master question in the ontology;
mapping the second requirement of the second plurality of data breach response requirements to the master question;
determining data responsive to the master question based on the data breach information;
associating the data responsive to the master question with the first requirement of the first plurality of data breach response requirements in the ontology;
associating the data responsive to the master question with the second requirement of the second plurality of data breach response requirements in the ontology;
generating a first data breach disclosure report for the first affected jurisdiction, the first data breach disclosure report comprising the data responsive to the master question; and
generating a second data breach disclosure report for the second affected jurisdiction, the second data breach disclosure report comprising the data responsive to the master question.
16. The data breach response system of claim 15 , wherein the data breach information interface further solicits a third affected jurisdiction, and wherein the data breach response system is further configured for:
receiving, from the user via the data breach information interface, an indication of the third affected jurisdiction;
determining, based on the third affected jurisdiction and the data breach information, a third plurality of data breach response requirements for the third affected jurisdiction;
determining, based on the third affected jurisdiction and the data breach information, a penalty for failing to address the third plurality of data breach response requirements for the third affected jurisdiction; and
determining, based on the penalty, to generate the ontology such that no question of the master questionnaire maps to a requirement of the third plurality of data breach response requirements for the third affected jurisdiction.
17. The data breach response system of claim 15 , wherein the data breach information interface further solicits a third affected jurisdiction, and wherein the data breach response system is further configured for:
receiving, from the user via the data breach information interface, an indication of the third affected jurisdiction;
determining, based on the third affected jurisdiction and the data breach information, a third plurality of data breach response requirements for the third affected jurisdiction;
determining, based on the third affected jurisdiction and the data breach information, an enforcement frequency for failing to address the third plurality of data breach response requirements for the third affected jurisdiction; and
determining, based on the enforcement frequency, to generate the ontology such that no question of the master questionnaire maps to a requirement of the third plurality of data breach response requirements for the third affected jurisdiction.
18. The data breach response system of claim 15 , wherein the data breach information interface further solicits a third affected jurisdiction and a business value for the third affected jurisdiction, and wherein the data breach response system is further configured for:
receiving, from the user via the data breach information interface, an indication of the third affected jurisdiction;
receiving, from the user via the data breach information interface, an indication of the business value for the third affected jurisdiction;
determining, based on the third affected jurisdiction and the business value for the third affected jurisdiction, to generate the ontology such that no question of the master questionnaire maps to a requirement of the third plurality of data breach response requirements for the third affected jurisdiction.
19. The data breach response system of claim 15 , wherein the data breach information comprises at least one of a number of affected users, a data breach discovery date, a data breach discovery time, a data breach occurrence date, a data breach occurrence time, or a data breach discovery method.
20. The data breach response system of claim 15 , wherein the first data breach disclosure report is one of a notification to a regulatory agency, a notification to affected data subjects, or a notification to an internal organization.