Data processing and scanning systems for generating and populating a data inventory
In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). The system may be configured to identify particular data assets and/or personal data in data repositories using any suitable intelligent identity scanning technique.
1. A data processing intelligent data repository scanning system comprising:
one or more computer processors;
computer memory; and
a computer-readable medium storing computer-executable instructions that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
connecting the data processing intelligent data repository scanning system to a database configured on one or more remote computing devices, wherein the database is configured to store one or more pieces of personal data;
scanning the database on the one or more remote computing devices to identify one or more data fields, wherein each of the identified one or more data fields comprises at least one piece of personal data;
analyzing the one or more data fields to determine a first subset of the one or more data fields associated with a first type of personal data;
analyzing the one or more data fields to determine a second subset of the one or more data fields associated with a second type of personal data, wherein the second type of personal data is distinct from the first type of personal data;
determining an association between a first piece of data in a first field of the first subset of the one or more data fields and a second piece of data in a second field of the second subset of data fields;
generating a catalog comprising the first piece of data, the second piece of data, and an indication of the association between the first piece of data and the second piece of data;
scanning one or more data repositories using the catalog to identify one or more data attributes associated with at least one of the first piece of data and the second piece of data;
at least partially in response to identifying one or more data attributes associated with at least one of the first piece of data and the second piece of data, determining whether a data model associated with at least one of the first piece of data and the second piece of data includes the one or more data repositories; and
at least partially in response to determining that the data model associated with at least one of the first piece of data and the second piece of data does not include the one or more data repositories, modifying the data model to include the one or more data repositories and one or more of:
an indication of an association between the first piece of data and the one or more data repositories; and
an indication of an association between the second piece of data and the one or more data repositories.
2. The data processing intelligent data repository scanning system of claim 1 , wherein the operations further comprise modifying the data model to include an indication of a location of the one or more data repositories.
3. The data processing intelligent data repository scanning system of claim 1 , wherein analyzing the one or more data fields to determine the first subset of the one or more data fields associated with the first type of personal data comprises:
determining a location of the database; and
determining that each data field in the first subset of the one or more data fields is associated with the first type of personal data based at least in part on the location of the database.
4. The data processing intelligent data repository scanning system of claim 3 , wherein the first type of personal data is selected from a group consisting of:
(a) a name;
(b) an address;
(c) a telephone number;
(d) an e-mail address;
(e) a social security number;
(f) banking information; and
(g) location data.
5. The data processing intelligent data repository scanning system of claim 1 , wherein scanning the database on the one or more remote computing devices to identify the one or more data fields comprises analyzing one or more access logs to identify the one or more data fields.
6. The data processing intelligent data repository scanning system of claim 1 , wherein scanning the database on the one or more remote computing devices to identify the one or more data fields comprises:
providing a communication channel between the data processing intelligent data repository scanning system and an application configured at the one or more remote computing devices, wherein the application is configured to communicate with the data processing intelligent data repository scanning system via a firewall; and
receiving data comprising the one or more data fields from the application via the communication channel.
7. The data processing intelligent data repository scanning system of claim 1 , wherein the operations further comprise at least partially in response to determining that the data model associated with at least one of the first piece of data and the second piece of data does not include the one or more data repositories, generating a second data model associated with the one or more data repositories.
8. A computer-implemented data processing method for identifying related data stored across data sources, the method comprising:
initiating, by one or more computer processors, a communication channel with one or more data sources configured to store one or more pieces of personal data;
scanning, by one or more computer processors via the communication channel, the one or more data sources to identify one or more data fields, wherein each of the identified one or more data fields comprises at least one piece of personal data;
analyzing, by one or more computer processors, the one or more data fields to determine a first subset of the one or more data fields associated with a first type of personal data;
analyzing, by one or more computer processors, the one or more data fields to determine a second subset of the one or more data fields associated with a second type of personal data, wherein the second type of personal data is distinct from the first type of personal data;
determining, by one or more computer processors, an association between a first piece of data in a first field of the first subset of the one or more data fields and a second piece of data in a second field of the second subset of data fields;
generating, by one or more computer processors, a catalog comprising the first piece of data, the second piece of data, and an indication of the association between the first piece of data and the second piece of data;
scanning, by one or more computer processors, one or more data repositories using the catalog to identify one or more data attributes associated with at least one of the first piece of data and the second piece of data;
at least partially in response to identifying one or more data attributes associated with at least one of the first piece of data and the second piece of data, determining by one or more computer processors, whether a data model associated with at least one of the first piece of data and the second piece of data includes the one or more data repositories; and
at least partially in response to determining that the data model associated with at least one of the first piece of data and the second piece of data does not include the one or more data repositories:
generating, by one or more computer processors, a data inventory for the one or more data repositories comprising an indication of an association between the one or more data repositories and at least one of the first piece of data and the second piece of data; and
modifying, by one or more computer processors, the data model associated with at least one of the first piece of data and the second piece of data to include the data inventory for the one or more data repositories.
9. The computer-implemented data processing method of claim 8 , wherein generating the data inventory for the one or more data repositories comprises populating, by one or more computer processors, one or more inventory attributes of the data inventory for the one or more data repositories with one or more of the first type of personal data and the second type of personal data.
10. The computer-implemented data processing method of claim 8 , wherein generating the data inventory for the one or more data repositories comprises populating, by one or more computer processors, one or more inventory attributes of the data inventory for the one or more data repositories with an indication of the one or more data sources.
11. The computer-implemented data processing method of claim 8 , wherein generating the data inventory for the one or more data repositories comprises populating, by one or more computer processors, one or more inventory attributes of the data inventory for the one or more data repositories with an indication of one or more processing activities associated with at least one of the first piece of data and the second piece of data.
12. The computer-implemented data processing method of claim 8 , further comprising:
categorizing, by one or more computer processors, the first piece of data and the second piece of data; and
soliciting, by one or more computer processors, user confirmation of the categorizing of the first piece of data and the second piece of data.
13. The computer-implemented data processing method of claim 8 , further comprising soliciting, by one or more computer processors, user confirmation of the association of the one or more data attributes associated with at least one of the first piece of data and the second piece of data.
14. The computer-implemented data processing method of claim 8 , wherein one or more of the one or more data attributes associated with at least one of the first piece of data and the second piece of data are selected from a group consisting of:
(a) transfer data;
(b) personal data; and
(c) storage data.
15. A non-transitory computer-readable medium storing computer-executable instructions for scanning one or more data repositories to identify related data stored at the one or more data repositories, the computer-executable instructions comprising computer-executable instructions for:
establishing, by one or more computer processors, a communication channel with one or more data assets configured to store one or more pieces of data;
scanning, by one or more computer processors via the communication channel, the one or more data assets to identify a first piece of data of a first data type and a second piece of data of a second data type, wherein the first data type is distinct from the second data type;
determining, by one or more computer processors, that the first piece of data and the second piece of data are associated with a particular data subject;
determining, by one or more computer processors, based at least in part on determining that the first piece of data and the second piece of data are associated with the particular data subject, an association between the first piece of data and the second piece of data;
generating, by one or more computer processors, a catalog comprising the first piece of data, the second piece of data, an indication of the association between the first piece of data and the second piece of data, and an indication of the particular data subject;
scanning, by one or more computer processors, one or more data repositories using the catalog to identify one or more data attributes associated with at least one of the first piece of data, the second piece of data, and the particular data subject;
at least partially in response to identifying the one or more data attributes associated with at least one of the first piece of data, the second piece of data, and the particular data subject, determining by one or more computer processors, whether a data model associated with at least one of the first piece of data, the second piece of data, and the particular data subject includes a data inventory associated with the one or more data repositories; and
at least partially in response to determining that the data model associated with at least one of the first piece of data, the second piece of data, and the particular data subject does not include the data inventory associated with the one or more data repositories:
generating, by one or more computer processors, the data inventory for the one or more data repositories; and
populating, by one or more computer processors, one or more inventory attributes of the data inventory for the one or more data repositories with the indication of the particular data subject.
16. The non-transitory computer-readable medium of claim 15 , wherein one or more of the one or more data assets are selected from a group consisting of:
(a) a storage asset;
(b) a transfer asset; and
(c) a collection asset.
17. The non-transitory computer-readable medium of claim 15 , wherein one or more of the first data type and the second data type is a particular type of personal data.
18. The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further comprise instructions for:
identifying, by one or more computer processors, a source of one or more pieces of data stored at the one or more data repositories and associated with the one or more data attributes associated with at least one of the first piece of data, the second piece of data, and the particular data subject; and
populating, by one or more computer processors, one or more of the one or more inventory attributes of the data inventory for the one or more data repositories with an indication of the source of the one or more pieces of data stored at the one or more data repositories.
19. The non-transitory computer-readable medium of claim 15 , wherein scanning the one or more data repositories using the catalog to identify the one or more data attributes associated with at least one of the first piece of data, the second piece of data, and the particular data subject comprises analyzing one or more of a system log and an access log configured at the one or more data repositories using the catalog to identify the one or more data attributes associated with at least one of the first piece of data, the second piece of data, and the particular data subject.
20. The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions further comprise instructions for modifying a data inventory for the one or more data assets with an indication of the one or more data repositories.