Data processing systems for data transfer risk identification and related methods

A data processing system for assessing a risk associated with one or more accesses of data stored at a data asset, the system comprising:

• one or more computer processors;
• and
• computer memory storing computer-executable instructions that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
• identifying two or more data assets;
• analyzing the two or more data assets to identify one or more data elements stored in the identified two or more data assets by using at least one data model to identify the one or more data elements stored in the identified two or more data assets, the at least one data model comprising:
• a respective digital inventory for each of the two or more data assets, each respective digital inventory comprising transfer data associated with each respective data asset and one or more inventory attributes selected from the group consisting of:
• one or more processing activities associated with each respective data asset;
• and
• one or more pieces of personal data associated with each respective data asset;
• and
• a data map identifying one or more electronic associations between at least two of the two or more data assets;
• and
• defining a plurality of physical locations and identifying, for each of the identified two or more data assets, a respective particular physical location of the plurality of physical locations;
• analyzing the identified one or more data elements to determine one or more data accesses of a first data asset of the identified two or more data assets by a second data asset of the identified two or more data assets, wherein the first data asset and the second data asset are in different particular physical locations, and wherein analyzing the identified one or more data elements to determine the one or more data accesses of the first data asset by the second data asset comprises analyzing the identified one or more data elements to determine the one or more data accesses based at least in part on the transfer data;
• accessing a data transfer record for an access of data of the first data asset by the second data asset;
• accessing a set of data transfer rules that are associated with the data transfer record, wherein the set of data transfer rules comprise:
• one or more privacy law frameworks of one or more of a first particular physical location of the first data asset and a second particular physical location of the second data asset, and
• one or more entity frameworks of one or more of (i) a first entity associated with the first data asset and (ii) a second entity associated with the second data asset;
• performing a data transfer assessment based at least in part on applying the set of data transfer rules on the data transfer record;
• identifying one or more data transfer risks associated with the data transfer record, based at least in part on the data transfer assessment;
• calculating a risk score for the access of data based at least in part on the one or more data transfer risks associated with the data transfer record;
• digitally storing the risk score for the access of data;
• comparing the risk score for the access of data to a threshold risk score;
• determining whether the risk score for the access of data is a greater risk than the threshold risk score;
• and
• in response to determining that the risk score for the access of data is a greater risk than the threshold risk score, taking one or more actions selected from the group consisting of:
• providing the data transfer record to one or more individuals for review of the data transfer record;
• and
• automatically terminating the access of data.

A non-transitory computer-readable medium storing computer-executable instructions for assessing a risk associated with accesses of data stored at a data asset by:

• identifying, by one or more computer processors, two or more data assets;
• analyzing, by one or more computer processors, the two or more data assets to identify one or more data elements stored in the identified two or more data assets by using at least one data model to identify the one or more data elements stored in the identified two or more data assets, the at least one data model comprising:
• a respective digital inventory for each of the two or more data assets, each respective digital inventory comprising transfer data associated with each respective data asset and one or more inventory attributes selected from the group consisting of:
• one or more processing activities associated with each respective data asset;
• and
• one or more pieces of personal data associated with each respective data asset;
• and
• a data map identifying one or more electronic associations between at least two of the two or more data assets;
• and
• defining, by one or more computer processors, a plurality of physical locations and identifying, for each of the identified two or more data assets, a respective particular physical location of the plurality of physical locations;
• analyzing, by one or more computer processors, the identified one or more data elements to determine one or more data accesses of a first data asset of the two or more data assets by a second data asset of the two or more data assets, wherein:
• the first data asset of the two or more data assets and the second data asset of the two or more data assets are in different particular physical locations of the plurality of physical locations;
• and
• analyzing the identified one or more data elements to determine the one or more data accesses of the first data asset of the two or more data assets by the second data asset of the two or more data assets comprises analyzing the identified one or more data elements to determine the one or more data accesses based at least in part on the transfer data;
• accessing, by one or more computer processors, a data transfer record for an access of data of the first data asset of the two or more data assets by the second data asset of the two or more data assets;
• accessing, by one or more computer processors, a set of data transfer rules that are associated with the data transfer record;
• performing, by one or more computer processors, a data transfer assessment based at least in part on applying the set of data transfer rules on the data transfer record;
• identifying, by one or more computer processors, one or more data transfer risks associated with the data transfer record, based at least in part on the data transfer assessment;
• calculating a risk score for the access of data based at least in part on the one or more data transfer risks associated with the data transfer record;
• digitally storing the risk score for the access of data;
• comparing the risk score for the access of data to a threshold risk score;
• determining whether the risk score for the access of data is a greater risk than the threshold risk score;
• and
• in response to determining that the risk score for the access of data is a greater risk than the threshold risk score, taking one or more actions selected from the group consisting of:
• providing the data transfer record to one or more individuals for review of the data transfer record;
• and
• automatically terminating the access of data.