Granted Patent B2

US 12,277,232 · App. 18/421,484 · Granted Apr 15, 2025

Inventors: Jonathan Blake Brannon (Smyrna, GA); Kevin Jones (Atlanta, GA); Saravanan Pitchaimani (Atlanta, GA); Dylan D. Patton-Kuhl (Atlanta, GA); Ramana Malladi (Atlanta, GA); Subramanian Viswanathan (San Ramon, CA)

Assignee: OneTrust, LLC

G06F21/577G06F21/602G06F21/6245G06N20/00G06V30/248G06F2221/033G06V30/2528

Abstract

Claims (54)

1. A method comprising:

identifying, by computing hardware, a plurality of data assets associated with a computing system;

scanning, by the computing hardware, the plurality of data assets to detect a subset of data assets in the plurality of data assets associated with target data by generating, using a first machine-learning model, first predictions for the data assets of the plurality of data assets that indicate a likelihood of being associated with the target data;

identifying a data processing activity that is associated with handling the target data for the computing system by generating, by the computing hardware using a second machine-learning model, second predictions for pairs of data assets of the subset of data assets that indicate a likelihood that the target data flows between a pair of data assets; and

causing, by the computing hardware, a performance of an action based on identifying the data processing activity is associated with handling the target data for the computing system.

2. The method of claim 1 , wherein:

the target data comprises personal data of individuals that is handled by the computing system; and

causing the performance of the action based on identifying the data processing activity is associated with handling the target data comprises determining whether the data processing activity is performed in a secure manner.

3. The method of claim 2 , wherein determining whether the data processing activity is performed in the secure manner comprises determining whether the data processing activity transfers the target data in an unencrypted state.

4. The method of claim 1 , wherein identifying the plurality of data assets associated with the computing system comprises installing software within the computing system that scans the computing system to identify the plurality of data assets.

5. The method of claim 1 , wherein identifying the data processing activity that is associated with handling the target data comprises identifying a data flow for the target data between the pair of data assets of the subset of data assets utilizing a rules-based model.

6. The method of claim 1 , wherein causing, by the computing hardware, the performance of an action based on identifying the data processing activity is associated with handling the target data comprises:

recording results indicating the data processing activity is associated with handling the target data for the computing system;

receiving a request to at least one of view, receive, access, revise, or delete the target data; and

responsive to receiving the request, processing the request by accessing the target data indicated in the request.

7. The method of claim 1 , wherein causing, by the computing hardware, the performance of an action based on identifying the data processing activity is associated with handling the target data comprises:

identifying a risk associated with the data processing activity handling the target data; and

responsive to identifying the risk, performing at least one of communicating the risk, initiating a process to suspend the data processing activity, or initiating a process to encrypt the target data.

8. The method of claim 1 , wherein generating, using the first machine-learning model, the first predictions for the data assets of the plurality of data assets that indicate the likelihood of being associated with the target data comprises utilizing a first classifier to generate a vector comprising a component for different types of the target data that indicates likelihood of being associated with the different types of the target data.

9. The method of claim 1 , wherein generating, by the computing hardware using the second machine-learning model, the second predictions for pairs of data assets of the subset of data assets that indicate the likelihood that the target data flows between the pair of data assets comprises utilizing a second classifier to generate the likelihood that the target data flows between the pair of data assets.

10. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by computing hardware, configure the computing hardware to perform operations comprising:

identifying a plurality of data assets associated with a computing system;

generating, using a first machine-learning model, first predictions for data assets of the plurality of data assets that indicate whether a given data asset is associated with target data;

identifying a subset of data assets in the plurality of data assets associated with the target data based on the first predictions;

generating, using a second machine-learning model, second predictions for pairs of data assets in the subset of data assets that indicate whether the target data flows between a given pair of data assets;

identifying a data processing activity that is associated with handling the target data for the computing system based on the second predictions; and

causing a performance of an action based on identifying the data processing activity is associated with handling the target data for the computing system.

11. The non-transitory computer-readable medium of claim 10 , wherein generating, using the first machine-learning model, the first predictions for the data assets of the plurality of data assets that indicate whether the given data asset is associated with the target data comprises utilizing a first classifier to generate a vector comprising a component for each of a plurality of different types of the target data that indicate a likelihood of the given data asset being associated with a given different type of the target data.

12. The non-transitory computer-readable medium of claim 10 , wherein generating, using the second machine-learning model, the second predictions for the pairs of data assets in the subset of data assets that indicate whether the target data flows between the given pair of data assets comprises utilizing a second classifier to generate a likelihood that the target data flows between the given pair of data assets.

13. The non-transitory computer-readable medium of claim 10 , wherein causing the performance of the action comprises:

receiving a request from an individual to at least one of view, receive, access, revise, or delete the target data for the individual from the computing system;

identifying, based on the data processing activity that is associated with handling the target data for the computing system, the target data found in the computing system for the individual; and

processing the request to provide, revise, or delete the target data found in the computing system for the individual.

14. The non-transitory computer-readable medium of claim 10 , wherein the operations further comprise:

injecting test data into the computing system to cause a propagation of the test data through the plurality of data assets for the computing system; and

identifying, based on the propagation of the test data through the plurality of data assets, a data flow for the target data between data assets.

15. The non-transitory computer-readable medium of claim 10 , wherein:

the target data comprises personal data of individuals that is handled by the computing system; and

causing the performance of the action comprises determining whether the data processing activity is performed in a secure manner.

16. A system comprising:

a non-transitory computer-readable medium storing instructions; and

a processing device communicatively coupled to the non-transitory computer-readable medium,

wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:

identifying a subset of data assets associated with target data from a plurality of data assets;

identifying a data processing activity that is associated with handling the target data by generating, using a machine-learning model, predictions for pairs of data assets of the subset of data assets that indicate a likelihood that the target data flows between a pair of data assets; and

causing a performance of an action based on identifying the data processing activity is associated with handling the target data.

17. The system of claim 16 , wherein identifying the subset of data assets in the plurality of data assets associated with target data comprises generating, using a first classifier, predictions for the data assets of the plurality of data assets that indicate a likelihood of being associated with the target data.

18. The system of claim 16 , wherein:

the target data comprises personal data of individuals; and

causing the performance of the action based on identifying the data processing activity is associated with handling the target data comprises determining whether the data processing activity transfers the target data in an unencrypted state.

19. The system of claim 16 , wherein the operations further comprise:

injecting test data into the system to cause a propagation of the test data through the plurality of data assets; and

identifying, based on the propagation of the test data through the plurality of data assets, a data flow for the target data between data assets.

20. The system of claim 16 , wherein identifying the data processing activity that is associated with handling the target data comprises identifying a data flow for the target data between the pair of data assets of the subset of data assets utilizing a rules-based model.

Assignments (2)

Continuity (5)

References Cited (400)