DATA SUBJECT REQUEST TIERING
A method of providing a data disclosure to a requester can include: receiving a data subject request from a requester, the data subject request including a request for stored personal data; categorizing the element data into one of a plurality of tiers based on a sensitivity level of the element data; assigning an assigned tier to the element data and associated data values; determining a level of detail of the associated data values for each of the element data to provide based on the assigned tier; and providing a data disclosure report to the requester, wherein the data disclosure report includes the level of detail of data values for each of the element data based on the assigned tier.
1 . A system for categorizing personal data held by a business, the system comprising:
a processor; and
a system memory encoding instructions which, when executed by the processor, cause the system to:
receive a data subject request from a requester, the data subject request including a request for stored personal data held by an entity about the requester;
receive the personal data associated with the stored personal data from at least one source application of the entity, wherein at least one aspect of the personal data includes sensitive data;
assign, using a tiering logic, a tier level to the at least one aspect of the personal data; and
upon receiving a request for a data disclosure report, provide a predetermined level of detail of the personal data on the based on the tier level.
2 . The system of claim 1 , wherein if the at least one aspect of the personal data is categorized in a first tier, the predetermined level of detail of the personal data provided includes an element data and no specific data values.
3 . The system of claim 1 , wherein if the at least one aspect of the personal data is categorized in a second tier, the predetermined level of detail of the personal data provided includes an element data and a redacted set of data values.
4 . The system of claim 1 , wherein if the at least one aspect of the personal data is categorized in a third tier, the predetermined level of detail of the personal data provided includes an element data and a set of data values.
5 . The system of claim 1 , wherein the system is further configured to store the personal data, including an element data and associated data values for each aspect of the personal data received from the at least one source application.
6 . The system of claim 5 , wherein the system stores the personal data, including the element data and associated data values, for a predetermined period of time.
7 . The system of claim 1 , wherein providing the predetermined level of detail of the personal data requires a receipt of a user authentication.
8 . The system of claim 1 , wherein the system is further configured to associate usage information to the personal data, including a reason that the at least one source application of the entity stores the personal data.
9 . The system of claim 1 , wherein a level of detail of data values provided in the data disclosure report is dependent on a user authentication protocol.
10 . The system of claim 9 , wherein the user authentication protocol is a user login on a user interface or a user authenticated phone call.
11 . A method for categorizing personal data held by a business, the method comprising:
receiving a data subject request from a requester, the data subject request including a request for stored personal data held by an entity about the requester;
receiving personal data associated with the stored personal data from at least one source application of the entity, wherein at least one aspect of the personal data includes sensitive data;
assigning, using a tiering logic, a tier level to the at least one aspect of the personal data; and
upon receiving a request for a data disclosure report, providing a predetermined level of detail of the personal data on the based on the tier level.
12 . The method of claim 11 , wherein if the at least one aspect of the personal data is categorized in a first tier, the predetermined level of detail of the personal data provided includes an element data and no specific data values.
13 . The method of claim 11 , wherein if the at least one aspect of the personal data is categorized in a second tier, the predetermined level of detail of the personal data provided includes an element data and a redacted set of data values.
14 . The method of claim 11 , wherein if the at least one aspect of the personal data is categorized in a third tier, the predetermined level of detail of the personal data provided includes an element data and a set of data values.
15 . The method of claim 11 , further comprising storing the personal data including an element data and associated data values for each aspect of the personal data received from the at least one source application.
16 . The method of claim 15 , wherein the system stores the personal data, including the element data and associated data values, for a predetermined period of time.
17 . The method of claim 11 , wherein providing the predetermined level of detail of the personal data requires a receipt of a user authentication.
18 . The method of claim 11 , further comprising associating usage information to the personal data, including a reason that the at least one source application of the entity stores the personal data.
19 . The method of claim 11 , wherein a level of detail of data values provided in the data disclosure report is dependent on a user authentication protocol.
20 . The method of claim 19 , wherein the user authentication protocol is a user login on a user interface or a user authenticated phone call.