Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design
Computer implemented methods, according to various embodiments, comprise: (1) integrating a privacy management system with DLP tools; (2) using the DLP tools to identify sensitive information that is stored in computer memory outside of the context of the privacy management system; and (3) in response to the sensitive data being discovered by the DLP tool, displaying each area of sensitive data to a privacy officer (e.g., similar to pending transactions in a checking account that have not been reconciled). A designated privacy officer may then select a particular entry and either match it up (e.g., reconcile it) with an existing data flow or campaign in the privacy management system, or trigger a new privacy assessment to be done on the data to capture the related privacy attributes and data flow information.
1. A method comprising:
identifying, by computing hardware, a plurality of pieces of data across a plurality of data sources associated with a data subject in a data map;
determining, by the computing hardware, that the plurality of pieces of data comprise sensitive data;
determining, by the computing hardware, that a first portion of the sensitive data exactly matches privacy campaign data stored in a privacy campaign data record for a data processing activity; and
reconciling, by the computing hardware based on determining that the first portion of the sensitive data exactly matches the privacy campaign data, the plurality of pieces of data with a data flow for the data processing activity by:
determining whether each of the plurality of pieces of data is represented in the data flow;
in response to determining that at least one of the plurality of pieces of data is not represented in the data flow, updating the data flow by associating the at least one of the plurality of pieces of data with the data flow; and
defining, in the data flow, a privacy related attribute for the at least one of the plurality of pieces of data, the privacy related attribute including an indication of the data subject.
2. The method of claim 1 , further comprising:
facilitating, by the computing hardware using the data flow, performance of network operations for retrieving data responsive to a query related to one or more data repositories identified in the data flow, the query including a request to identify personal data associated with the data subject.
3. The method of claim 1 , wherein:
reconciling the plurality of pieces of data with the data flow for the data processing activity further comprises:
generating a user interface comprising a respective interactive element for each of the plurality of pieces of data;
providing the user interface for display on a computing device; and
receiving, via each respective interactive element, an indication of an inclusion status of each of the plurality of pieces of data in the data flow; and
determining whether each of the plurality of pieces of data is represented in the data flow comprises determining whether each of the plurality of pieces of data is represented in the data flow based on the indication of the inclusion status.
4. The method of claim 2 , further comprising in response to determining that at least one of the plurality of pieces of data is not represented in the data flow, initiating a risk assessment for the data processing activity.
5. The method of claim 1 , further comprising:
generating, by the computing hardware, a graphical user interface that comprises a visual representation of the data flow by:
configuring a first visual indication of a first data asset in the data flow,
configuring a second visual indication of a second data asset in the data flow,
configuring a third visual indication of an exchange of the at least one of the plurality of pieces of data between the first data asset and the second data asset based on the data flow; and
providing, by the computing hardware, the graphical user interface for display on a computing device.
6. The method of claim 5 , wherein:
the method further comprises determining, by the computing hardware, an encryption status of the at least one of the plurality of pieces of data; and
the third visual indication reflects the encryption status.
7. The method of claim 6 , further comprising modifying, by the computing hardware, the encryption status of the at least one of the plurality of pieces of data in response to determining that the at least one of the plurality of pieces of data is not represented in the data flow.
8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
identifying a plurality of pieces of data across a plurality of data sources associated with a data subject in a data map;
determining that the plurality of pieces of data comprise sensitive data;
determining that a first portion of the sensitive data exactly matches privacy campaign data stored in a privacy campaign data record for a data processing activity; and
reconciling, based on determining that the first portion of the sensitive data exactly matches the privacy campaign data, the plurality of pieces of data with a data flow for the data processing activity by:
determining whether each of the plurality of pieces of data is represented in the data flow;
in response to determining that at least one of the plurality of pieces of data is not represented in the data flow, updating the data flow by associating the at least one of the plurality of pieces of data with the data flow; and
defining, in the data flow, a privacy related attribute for the at least one of the plurality of pieces of data, the privacy related attribute including an indication of the data subject.
9. The system of claim 8 , wherein the operations further comprise facilitating, using the data flow, performance of network operations for retrieving data responsive to a query related to one or more data repositories identified in the data flow, the query including a request to identify personal data associated with the data subject.
10. The system of claim 8 , wherein:
reconciling the plurality of pieces of data with the data flow for the data processing activity further comprises:
generating a user interface comprising a respective interactive element for each of the plurality of pieces of data;
providing the user interface for display on a computing device; and
receiving, via each respective interactive element, an indication of an inclusion status of each of the plurality of pieces of data in the data flow; and
determining whether each of the plurality of pieces of data is represented in the data flow comprises determining whether each of the plurality of pieces of data is represented in the data flow based on the indication of the inclusion status.
11. The system of claim 8 , wherein the operations further comprise, in response to determining that at least one of the plurality of pieces of data is not represented in the data flow, initiating a risk assessment for the data processing activity.
12. The system of claim 11 , wherein the operations further comprise defining at least a second privacy related attribute for the at least one of the plurality of pieces of data based on data responsive to the risk assessment for the data processing activity.
13. The system of claim 8 , wherein the operations further comprise:
generating a graphical user interface that comprises a visual representation of the data flow by:
configuring a first visual indication of a first data asset in the data flow,
configuring a second visual indication of a second data asset in the data flow,
configuring a third visual indication of an exchange of the at least one of the plurality of pieces of data between the first data asset and the second data asset based on the data flow; and
providing the graphical user interface for display on a computing device.
14. The system of claim 13 , wherein:
the operations further comprise determining an encryption status of the at least one of the plurality of pieces of data; and
the third visual indication reflects the encryption status.
15. The system of claim 14 , wherein the operations further comprise modifying the encryption status of the at least one of the plurality of pieces of data in response to determining that the at least one of the plurality of pieces of data is not represented in the data flow.
16. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
identifying a plurality of pieces of data across a plurality of data sources associated with a data subject in a data map;
determining that the plurality of pieces of data comprise sensitive data;
determining that a first portion of the sensitive data exactly matches privacy campaign data stored in a privacy campaign data record for a data processing activity; and
reconciling, based on determining that the first portion of the sensitive data exactly matches the privacy campaign data, the plurality of pieces of data with a data flow for the data processing activity by:
determining whether each of the plurality of pieces of data is represented in the data flow;
in response to determining that at least one of the plurality of pieces of data is not represented in the data flow, updating the data flow by associating the at least one of the plurality of pieces of data with the data flow; and
defining, in the data flow, a privacy related attribute for the at least one of the plurality of pieces of data, the privacy related attribute including an indication of the data subject.
17. The non-transitory computer-readable medium of claim 16 , wherein:
reconciling the plurality of pieces of data with the data flow for the data processing activity further comprises:
generating a user interface comprising a respective interactive element for each of the plurality of pieces of data;
providing the user interface for display on a computing device; and
receiving, via each respective interactive element, an indication of an inclusion status of each of the plurality of pieces of data in the data flow; and
determining whether each of the plurality of pieces of data is represented in the data flow comprises determining whether each of the plurality of pieces of data is represented in the data flow based on the indication of the inclusion status.
18. The non-transitory computer-readable medium of claim 16 , wherein the operations further comprise, in response to determining that at least one of the plurality of pieces of data is not represented in the data flow, initiating a risk assessment for the data processing activity.
19. The non-transitory computer-readable medium of claim 18 , wherein the operations further comprise defining at least a second privacy related attribute for the at least one of the plurality of pieces of data based on data responsive to the risk assessment for the data processing activity.
20. The non-transitory computer-readable medium of claim 16 , wherein the operations further comprise:
generating a graphical user interface that comprises a visual representation of the data flow by:
configuring a first visual indication of a first data asset in the data flow,
configuring a second visual indication of a second data asset in the data flow,
configuring a third visual indication of an exchange of the at least one of the plurality of pieces of data between the first data asset and the second data asset based on the data flow; and
providing the graphical user interface for display on a computing device.