Data processing systems for identifying and modifying processes that are subject to data subject access requests
In particular embodiments, in response a data subject submitting a request to delete their personal data from an organization's systems, the system may: (1) automatically determine where the data subject's personal data is stored; (2) in response to determining the location of the data (which may be on multiple computing systems), automatically facilitate the deletion of the data subject's personal data from the various systems; and (3) determine a cause of the request to identify one or more processing activities or other sources that result in a high number of such requests.
1. A method comprising:
analyzing, by computing hardware for each of a plurality of data subject access requests, metadata for the data subject access request to identify a type of data involved in the data subject access request;
identifying, by the computing hardware, a plurality of processing activities associated with the plurality of data subject access requests by, for each of the plurality of data subject access requests:
accessing a data model identifying electronic links between data assets and processing activities, wherein the electronic links represent data transfers among the data assets and involving the processing activities; and
scanning the data assets to identify at least one of the plurality of processing activities from the processing activities, wherein the at least one of the plurality of processing activities is associated with the type of data;
identifying, by the computing hardware and based on a set of rules, a particular processing activity from the plurality of processing activities, wherein the set of rules defines a threshold with respect to an association the particular processing activity has with the plurality of data subject access requests and the particular processing activity satisfies the threshold; and
in response to identifying the particular processing activity, causing performance, by the computing hardware, of an action with respect to the particular processing activity.
2. The method of claim 1 , wherein causing performance of the action with respect to the particular processing activity comprises causing a modification of the type of data collected as part of the particular processing activity.
3. The method of claim 1 , wherein causing performance of the action with respect to the particular processing activity comprises:
generating a graphical user interface by configuring a presentation element configured for presenting data related to the particular processing activity and the plurality of data subject access requests based on the set of rules; and
transmitting an instruction to a user device to retrieve and present the graphical user interface on the user device.
4. The method of claim 1 , wherein the threshold defines a frequency of an occurrence of the particular processing activity in the plurality of processing activities.
5. The method of claim 1 , wherein causing performance of the action with respect to the particular processing activity comprises causing suspension of the particular processing activity.
6. The method of claim 1 , wherein:
the method further comprises identifying, by the computing hardware, a data subject for whom the type of data has been collected as part of the particular processing activity; and
causing performance of the action with respect to the particular processing activity comprises initiating a data subject access request on behalf of the data subject with respect to the type of data.
7. The method of claim 1 , wherein:
the method further comprises identifying, by the computing hardware, a data subject for whom the type of data has been collected as part of the particular processing activity; and
causing performance of the action with respect to the particular processing activity comprises causing a recapture of consent by the data subject related to the particular processing activity.
8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
analyzing, for each of a plurality of data subject access requests, metadata for the data subject access request to identify a type of data involved in the data subject access request;
identifying a plurality of processing activities associated with the plurality of data subject access requests by, for each of the plurality of data subject access requests:
accessing a data model identifying electronic links between data assets and processing activities, wherein the electronic links represent data transfers among the data assets and involving the processing activities; and
scanning the data assets to identify at least one of the plurality of processing activities from the processing activities, wherein the at least one of the plurality of processing activities is associated with the type of data;
identifying, based on a set of rules, a particular processing activity from the plurality of processing activities, wherein the set of rules defines a threshold with respect to an association the particular processing activity has with the plurality of data subject access requests and the particular processing activity satisfies the threshold; and
in response to identifying the particular processing activity, performing an action with respect to the particular processing activity.
9. The system of claim 8 , wherein performing the action with respect to the particular processing activity comprises at least one of:
modifying the type of data collected as part of the particular processing activity;
suspending the particular processing activity; or
generating a graphical user interface by configuring a presentation element configured for presenting data related to the particular processing activity and the plurality of data subject access requests based on the set of rules and transmitting an instruction to a user device to retrieve and present the graphical user interface on the user device.
10. The system of claim 8 , wherein:
the operations further comprise identifying a data subject for whom the type of data is collected as part of the particular processing activity; and
performing the action with respect to the particular processing activity comprises recapturing consent from the data subject related to the particular processing activity.
11. The system of claim 8 , wherein:
the operations further comprise identifying a data subject for whom the type of data is collected as part of the particular processing activity; and
performing the action with respect to the particular processing activity comprises initiating a data subject access request on behalf of the data subject with respect to the type of data.
12. The system of claim 11 , wherein initiating the data subject access request on behalf of the data subject comprises initiating a request to delete the type of data associated with the data subject and the particular processing activity.
13. The system of claim 8 , wherein the threshold defines a frequency of an occurrence of the particular processing activity in the plurality of processing activities.
14. The system of claim 8 , wherein identifying the particular processing activity based on the set of rules comprises:
determining a number of occurrences of each of the plurality of processing activities associated with the plurality of data subject access requests; and
identifying the particular processing activity based on the number of occurrences satisfying the threshold.
15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
analyzing, for each of a plurality of data subject access requests, metadata for the data subject access request to identify a type of data involved in the data subject access request;
identifying a plurality of processing activities associated with the plurality of data subject access requests by, for the plurality of data subject access requests:
accessing a data model identifying electronic links between data assets and processing activities, wherein the electronic links represent data transfers among the data assets and involving the processing activities; and
scanning the data assets to identify at least one of the plurality of processing activities from the processing activities, wherein the at least one of the plurality of processing activities is associated with the type of data;
identifying, based on a set of rules, a particular processing activity from the plurality of processing activities, wherein the set of rules defines a threshold with respect to an association the particular processing activity has with the plurality of data subject access requests and the particular processing activity satisfies the threshold; and
based on identifying the particular processing activity, causing performance of an action with respect to the particular processing activity.
16. The non-transitory computer-readable medium of claim 15 , wherein causing the performance of the action with respect to the particular processing activity comprises at least one of:
causing modification of the type of data collected as part of the particular processing activity; or
causing suspension of the particular processing activity.
17. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
generating a graphical user interface by configuring a presentation element configured for presenting data related to the particular processing activity and the plurality of data subject access requests based on the set of rules; and
transmitting an instruction to a user device to retrieve and present the graphical user interface on the user device.
18. The non-transitory computer-readable medium of claim 15 , wherein
the operations further comprise identifying a data subject for whom the type of data is collected as part of the particular processing activity; and
causing performance of the action with respect to the particular processing activity comprises initiating a data subject access request on behalf of the data subject with respect to the type of data.
19. The non-transitory computer-readable medium of claim 15 , wherein:
the operations further comprise identifying a data subject for whom the type of data has been collected as part of the particular processing activity; and
causing performance of the action with respect to the particular processing activity comprises causing a recapture of consent by the data subject related to the particular processing activity.
20. The non-transitory computer-readable medium of claim 15 , wherein:
the threshold defines a frequency of an occurrence of the particular processing activity in the plurality of processing activities; and
identifying the particular processing activity based on the set of rules comprises:
determining a number of occurrences of each of the plurality of processing activities associated with the plurality of data subject access requests; and
identifying the particular processing activity based on the number of occurrences satisfying the threshold.