Data processing systems for assessing readiness for responding to privacy-related incidents
Data processing systems and methods, according to various embodiments, are adapted for mapping various questions regarding a data breach from a master questionnaire to a plurality of territory-specific data breach disclosure questionnaires. The answers to the questions in the master questionnaire are used to populate the territory-specific data breach disclosure questionnaires and determine whether disclosure is required in territory. The system can automatically notify the appropriate regulatory bodies for each territory where it is determined that data breach disclosure is required.
1. A method comprising:
receiving, by computing hardware, information on a data breach incident involving a processing activity executed by a computing system associated with an entity;
identifying, by the computing hardware and based on the information, a data structure mapping a set of attributes to the processing activity;
determining, by the computing hardware using the data structure, a geographic location associated with the computing system, wherein the set of attributes identifies the geographic location;
determining, by the computing hardware and based on the geographic location, a required activity to address the data breach incident;
configuring, by the computing hardware, a graphical user interface to display a mechanism for the required activity, wherein the mechanism is configured so that an indication can be provided for the required activity;
receiving, by the computing hardware, the indication via the mechanism for the required activity, wherein the indication corresponds to a progress of completion of the required activity; and
responsive to receiving the indication:
generating, by the computing hardware, data breach response data identifying the progress of completion of the required activity; and
configuring, by the computing hardware and based on the data breach response data, the graphical user interface to display (i) a readiness indicator representing a readiness of the entity to address the data breach incident and (ii) a plurality of comparison readiness indicators in which each comparison readiness indicator of the plurality of comparison readiness indicators represents a readiness of a different entity to address the data breach incident.
2. The method of claim 1 , wherein the data breach response data indicates an urgency of addressing the data breach incident for the geographic location.
3. The method of claim 2 , wherein the processing activity is further executed by a second computing system, and the method further comprises:
determining, by the computing hardware using the data structure, a second geographic location associated with the second computing system, wherein the set of attributes identifies the second geographic location;
determining, by the computing hardware and based on the second geographic location, a second required activity to address the data breach incident;
configuring, by the computing hardware, the graphical user interface to display a second mechanism for the second required activity, wherein the second mechanism is configured so that a second indication can be provided for the second required activity;
receiving, by the computing hardware, the second indication via the second mechanism for the second required activity, wherein the second indication corresponds to a progress of completion of the second required activity; and
responsive to receiving the second indication:
generating, by the computing hardware, second data breach response data based on the progress of completion of the second required activity, wherein the second data breach response data indicates an urgency of addressing the data breach incident for the second geographic location; and
configuring, by the computing hardware and based on the second data breach response data, the graphical user interface to display the urgency of addressing the data breach incident for the second geographic location is higher than the urgency of addressing the data breach incident for the geographic location.
4. The method of claim 1 , wherein the data breach response data comprises at least one of whether a relevant deadline for completion of the required activity or whether the required activity was performed properly.
5. The method of claim 1 further comprising determining, by the computing hardware, a relative ranking of each readiness of the different entity to address the data breach incident, wherein the plurality of comparison readiness indicators are displayed according to the relative ranking of each readiness.
6. The method of claim 1 further comprising configuring, by the computing hardware, the graphical user interface to display an upload mechanism, wherein the upload mechanism is configured to facilitate uploading of at least one of data that has been reported to a second entity, data that has been collected for compliance, or data regarding a third entity responsible for the data breach incident.
7. The method of claim 1 , wherein:
the indication corresponding to the progress of completion of the required activity indicates a completion of the required activity, and
the method further comprises, responsive to the indication indicting the completion of the required activity, configuring, by the computing hardware, the graphical user interface to no longer display the mechanism for the required activity.
8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
receiving information on a data breach incident involving a data asset associated with a computing system for an entity;
identifying, based on the information, a data structure mapping a set of attributes to the data asset;
determining, using the data structure, a type of data handled by the data asset, wherein the set of attributes identifies the type of data;
determining, based on the type of data, a required activity to address the data breach incident;
configuring a graphical user interface to display a mechanism for the required activity, wherein the mechanism is configured so that an indication can be provided for the required activity;
receiving the indication via the mechanism for the required activity, wherein the indication corresponds to a progress of completion of the required activity; and
responsive to receiving the indication:
generating data breach response data identifying the progress of completion of the required activity; and
configuring, based on the data breach response data, the graphical user interface to display (i) a readiness indicator representing a readiness of the entity to address the data breach incident and (ii) a plurality of comparison readiness indicators in which each comparison readiness indicator of the plurality of comparison readiness indicators represents a readiness of a different entity to address the data breach incident.
9. The system of claim 8 , wherein the data breach response data indicates an urgency of addressing the data breach incident for the data asset.
10. The system of claim 9 , wherein the operations further comprises:
determining, using the data structure, a second data asset associated with the computing system and used in handling the type of data, wherein the data structure provides a mapping a second set of attributes to the second data asset and the second set of attributes identify the type of data;
determining, based on the second data asset, a second required activity to address the data breach incident;
configuring the graphical user interface to display a second mechanism for the second required activity, wherein the second mechanism is configured so that a second indication can be provided for the second required activity;
receiving the second indication via the second mechanism for the second required activity, wherein the second indication corresponds to a progress of completion of the second required activity; and
responsive to receiving the second indication:
generating second data breach response data based on the progress of completion of the second required activity, wherein the second data breach response data indicates an urgency of addressing the data breach incident for the second data asset; and
configuring, based on the second data breach response data, the graphical user interface to display the urgency of addressing the data breach incident for the second data asset is higher than the urgency of addressing the data breach incident for the data asset.
11. The system of claim 8 , wherein the data breach response data comprises at least one of whether a relevant deadline for completion of the required activity or whether the required activity was performed properly.
12. The system of claim 8 , wherein the operations further comprise determining a relative ranking of each readiness of the different entity to address the data breach incident, and the plurality of comparison readiness indicators are displayed according to the relative ranking of each readiness.
13. The system of claim 8 , wherein the operations further comprise configuring the graphical user interface to display an upload mechanism configured to facilitate uploading of at least one of data that has been reported to a second entity, data that has been collected for compliance, or data regarding a third entity responsible for the data breach incident.
14. The system of claim 8 , wherein:
the indication corresponding to the progress of completion of the required activity indicates a completion of the required activity, and
the operations further comprise, responsive to the indication indicting the completion of the required activity, configuring the graphical user interface to no longer display the mechanism for the required activity.
15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
receiving information on a data breach incident involving a processing activity executed by a computing system associated with an entity;
identifying, based on the information, a data structure mapping a set of attributes to the processing activity;
determining, using the data structure, at least one of a type of data involves in the processing activity or a geographic location associated with the computing system, wherein the set of attributes identifies at least one of the type of data or the geographic location;
determining, based on at least one of the type of data or the geographic location, a required activity to address the data breach incident;
configuring a graphical user interface to display a mechanism for the required activity, wherein the mechanism is configured so that an indication can be provided for the required activity;
receiving the indication via the mechanism for the required activity, wherein the indication corresponds to a progress of completion of the required activity; and
responsive to receiving the indication:
generating data breach response data identifying the progress of completion of the required activity; and
configuring, based on the data breach response data, the graphical user interface to display (i) a readiness indicator representing a readiness of the entity to address the data breach incident and (ii) a plurality of comparison readiness indicators in which each comparison readiness indicator of the plurality of comparison readiness indicators represents a readiness of a different entity to address the data breach incident.
16. The non-transitory computer-readable medium of claim 15 , wherein:
the data breach response data indicates an urgency of addressing the data breach incident for the geographic location,
the processing activity is further executed by a second computing system, and
the operations further comprise:
determining, using the data structure, a second geographic location associated with the second computing system, wherein the set of attributes identifies the second geographic location;
determining, based on the second geographic location, a second required activity to address the data breach incident;
configuring the graphical user interface to display a second mechanism for the second required activity, wherein the second mechanism is configured so that a second indication can be provided for the second required activity;
receiving the second indication via the second mechanism for the second required activity, wherein the second indication corresponds to a progress of completion of the second required activity; and
responsive to receiving the second indication:
generating second data breach response data based on the progress of completion of the second required activity, wherein the second data breach response data indicates an urgency of addressing the data breach incident for the second geographic location; and
configuring, based on the second data breach response data, the graphical user interface to display the urgency of addressing the data breach incident for the second geographic location is higher than the urgency of addressing the data breach incident for the geographic location.
17. The non-transitory computer-readable medium of claim 15 , wherein the data breach response data comprises at least one of whether a relevant deadline for completion of the required activity or whether the required activity was performed properly.
18. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise determining a relative ranking of each readiness of the different entity to address the data breach incident, and the plurality of comparison readiness indicators are displayed according to the relative ranking of each readiness.
19. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise configuring the graphical user interface to display an upload mechanism configured to facilitate uploading of at least one of data that has been reported to a second entity, data that has been collected for compliance, or data regarding a third entity responsible for the data breach incident.
20. The non-transitory computer-readable medium of claim 15 , wherein:
the indication corresponding to the progress of completion of the required activity indicates a completion of the required activity, and
the operations further comprise, responsive to the indication indicting the completion of the required activity, configuring the graphical user interface to no longer display the mechanism for the required activity.