Data processing systems for assessing readiness for responding to privacy-related incidents
Data processing systems and methods, according to various embodiments, are adapted for mapping various questions regarding a data breach from a master questionnaire to a plurality of territory-specific data breach disclosure questionnaires. The answers to the questions in the master questionnaire are used to populate the territory-specific data breach disclosure questionnaires and determine whether disclosure is required in territory. The system can automatically notify the appropriate regulatory bodies for each territory where it is determined that data breach disclosure is required.
1. A computer-implemented data processing method for assessing data breach response readiness, the method comprising:
providing, by one or more computer processors, simulated personal data breach incident information;
receiving, by one or more computer processors, received personal data breach incident information;
determining, by one or more computer processors, an affected business sector based at least in part on one or more of the simulated personal data breach incident information and the received personal data breach incident information;
determining, by one or more computer processors, a first affected jurisdiction and a second affected jurisdiction based at least in part on one or more of the simulated personal data breach incident information and the received personal data breach incident information;
determining, by one or more computer processors, a first plurality of required activities for the first affected jurisdiction based at least in part on the affected business sector and the first affected jurisdiction;
determining, by one or more computer processors, a second plurality of required activities for the second affected jurisdiction based at least in part on the affected business sector and the second affected jurisdiction;
providing, by one or more computer processors, a listing of instructions comprising a first plurality of instructions and a second plurality of instructions, wherein each instruction of the first plurality of instructions corresponds to a respective required activity of the first plurality of required activities, and wherein each instruction of the second plurality of instructions corresponds to a respective required activity of the second plurality of required activities;
receiving, by one or more computer processors, a plurality of indications, wherein each indication of the plurality of indications corresponds to a respective instruction in the listing of instructions, and wherein each indication of the plurality of indications indicates that a corresponding respective instruction in the listing of instructions has been completed;
determining, by one or more computer processors, a readiness score based at least in part on the plurality of indications; and
generating, by one or more computer processors, a representation of the readiness score.
2. The computer-implemented data processing method of claim 1 , wherein the simulated personal data breach incident information comprises an indication of a type of compromised personal data and an indication of a quantity of compromised personal data.
3. The computer-implemented data processing method of claim 1 , wherein the received personal data breach incident information comprises an indication of a number of affected users.
4. The computer-implemented data processing method of claim 1 , wherein the first plurality of required activities comprises transmitting of a notification comprising a subset of the simulated personal data breach incident information.
5. The computer-implemented data processing method of claim 1 , wherein the listing of instructions comprises a first plurality of checkboxes and a second plurality of checkboxes, wherein each checkbox of the first plurality of checkboxes is associated with a respective instruction of the first plurality of instructions, and wherein each checkbox of the second plurality of checkboxes is associated with a respective instruction of the second plurality of instructions.
6. The computer-implemented data processing method of claim 1 , wherein a first indication of the plurality of indications comprises an indication of a time of completion of a first corresponding respective instruction in the listing of instructions.
7. The computer-implemented data processing method of claim 1 , the method further comprising receiving, by one or more computer processors, data associated with a particular instruction in the listing of instructions.
8. A data processing system for assessing data breach response readiness, the data processing system comprising:
one or more processors; and
computer memory, wherein the data processing system is configured for:
providing simulated personal data breach incident information comprising information indicating a compromised system and a number of compromised accounts;
receiving received personal data breach incident information;
determining an affected business sector based at least in part on the received personal data breach incident information;
determining a first affected jurisdiction based at least in part on the received personal data breach incident information;
determining a second affected jurisdiction based at least in part on the received personal data breach incident information;
determining a first plurality of instructions for the first affected jurisdiction based at least in part on the affected business sector and the first affected jurisdiction, wherein each instruction of the first plurality of instructions corresponds to a respective required activity for the first affected jurisdiction;
determining a second plurality of instructions for the second affected jurisdiction based at least in part on the affected business sector and the second affected jurisdiction, wherein each instruction of the second plurality of instructions corresponds to a respective required activity for the second affected jurisdiction;
providing, to a user, the first plurality of instructions and a first plurality of checkboxes, wherein each checkbox of the first plurality of checkboxes corresponds to a respective instruction of the first plurality of instructions;
providing, to the user, the second plurality of instructions and a second plurality of checkboxes, wherein each checkbox of the second plurality of checkboxes corresponds to a respective instruction of the second plurality of instructions;
receiving an indication that a checkbox of the first plurality of checkboxes has been activated by the user;
storing an indication that the respective instruction of the first plurality of instructions associated with the checkbox of the first plurality of checkboxes has been completed;
receiving an indication that a checkbox of the second plurality of checkboxes has been activated by the user;
storing an indication that the respective instruction of the second plurality of instructions associated with the checkbox of the second plurality of checkboxes has been completed;
providing, to the user, a representation of the indication that the respective instruction of the first plurality of instructions associated with the checkbox of the first plurality of checkboxes has been completed; and
providing, to the user, a representation of the indication that the respective instruction of the second plurality of instructions associated with the checkbox of second plurality of checkboxes has been completed.
9. The data processing system for assessing data breach response readiness of claim 8 , wherein the data breach response readiness assessment system is further configured for determining a readiness score for the first affected jurisdiction based at least in part on a number of indications that instructions of the first plurality of instructions have been completed.
10. The data processing system for assessing data breach response readiness of claim 9 , wherein the data breach response readiness assessment system is further configured for:
determining a plurality of comparison readiness scores for the first affected jurisdiction; and
providing, to the user, the readiness score for the first affected jurisdiction and the plurality of comparison readiness scores for the first affected jurisdiction.
11. The data processing system for assessing data breach response readiness of claim 10 , wherein the data breach response readiness assessment system is further configured for:
determining a relative ranking of each comparison readiness score of the plurality of comparison readiness scores for the first affected jurisdiction and the readiness score for the first affected jurisdiction; and
color coding the readiness score for the first affected jurisdiction and the plurality of comparison readiness scores for the first affected jurisdiction based at least in part on the relative ranking.
12. The data processing system for assessing data breach response readiness of claim 8 , wherein the data breach response readiness assessment system is further configured for determining a readiness score for the first affected jurisdiction based at least in part on a comparison of a number of indications that instructions of the first plurality of instructions have been completed and a total number of instructions of the first plurality of instructions.
13. The data processing system for assessing data breach response readiness of claim 8 , wherein the data breach response readiness assessment system is further configured for receiving a timestamp for the indication that the checkbox of the first plurality of checkboxes has been activated by the user.
14. The data processing system for assessing data breach response readiness of claim 13 , wherein the data breach response readiness assessment system is further configured for determining a readiness score for the first affected jurisdiction based at least in part on a comparison of the timestamp for the indication that the checkbox of the first plurality of checkboxes has been activated by the user and a deadline associated with the respective instruction of the first plurality of instructions associated with the checkbox of the first plurality of checkboxes.
15. A non-transitory computer-readable medium storing computer-executable instructions for:
providing simulated personal data breach incident information to a user;
receiving received personal data breach incident information from the user;
determining an affected business sector based at least in part on the received personal data breach incident information;
determining a first affected jurisdiction based at least in part on the received personal data breach incident information;
determining a second affected jurisdiction based at least in part on the received personal data breach incident information;
determining a first plurality of instructions for the first affected jurisdiction based at least in part on the affected business sector and the first affected jurisdiction, wherein each instruction of the first plurality of instructions corresponds to a respective required activity for the first affected jurisdiction;
determining a second plurality of instructions for the second affected jurisdiction based at least in part on the affected business sector and the second affected jurisdiction, wherein each instruction of the second plurality of instructions corresponds to a respective required activity for the second affected jurisdiction;
providing the first plurality of instructions and the second plurality of instructions to the user;
receiving an indication that a subset of the first plurality of instructions has been completed;
receiving an indication that a subset of the second plurality of instructions has been completed;
determining a first readiness score for the first affected jurisdiction based at least in part on the subset of the first plurality of instructions;
determining a second readiness score for the second affected jurisdiction based at least in part on the subset of the second plurality of instructions; and
presenting a graphical user interface comprising the first readiness score and the second readiness score to the user.
16. The non-transitory computer-readable medium of claim 15 , further comprising computer-executable instructions for comparing the first readiness score to a threshold, wherein the graphical user interface further comprises a representation of the comparison of the first readiness score to the threshold.
17. The non-transitory computer-readable medium of claim 16 , further comprising computer-executable instructions for determining a reassessment recommendation based at least in part on the comparison of the first readiness score to the threshold, wherein the graphical user interface further comprises a representation of the reassessment recommendation.
18. The non-transitory computer-readable medium of claim 15 , further comprising computer-executable instructions for determining a number of affected users based at least in part on the received personal data breach incident information.
19. The non-transitory computer-readable medium of claim 18 , wherein the first plurality of instructions for the first affected jurisdiction is further determined based at least in part on the number of affected users, and wherein the second plurality of instructions for the second affected jurisdiction is further determined based at least in part on the number of affected users.
20. A data processing system for assessing data breach response readiness comprising:
simulated personal data breach incident information generation means for providing simulated personal data breach incident information to a user;
personal data breach incident information receiving means for receiving personal data breach incident information from the user;
business sector determination means for determining an affected business sector based at least in part on the personal data breach incident information;
jurisdiction determination means for determining a first affected jurisdiction based at least in part on the personal data breach incident information;
the jurisdiction determination means for determining a second affected jurisdiction based at least in part on the personal data breach incident information;
instruction determination means for determining a first plurality of instructions for the first affected jurisdiction based at least in part on the affected business sector and the first affected jurisdiction, wherein each instruction of the first plurality of instructions corresponds to a respective required activity for the first affected jurisdiction;
the instruction determination means for determining a second plurality of instructions for the second affected jurisdiction based at least in part on the affected business sector and the second affected jurisdiction, wherein each instruction of the second plurality of instructions corresponds to a respective required activity for the second affected jurisdiction;
instruction providing means for providing the first plurality of instructions and the second plurality of instructions to the user;
indication receiving means for receiving an indication that a subset of the first plurality of instructions has been completed;
the indication receiving means for receiving an indication that a subset of the second plurality of instructions has been completed;
readiness score determination means for determining a first readiness score for the first affected jurisdiction based at least in part on the subset of the first plurality of instructions;
the readiness score determination means for determining a second readiness score for the second affected jurisdiction based at least in part on the subset of the second plurality of instructions; and
readiness score presentation means for presenting a graphical user interface comprising the first readiness score and the second readiness score to the user.