Back to results
US 10,949,567 B2Granted
Data processing systems for fulfilling data subject access requests and related methods
AssigneeOneTrust, LLC
InventorsKabir A. Barday, Jason L. Sabourin, Jonathan Blake Brannon, Mihir S. Karanjkar, Kevin Jones
Life of this patent
Estimating the term…
Abstract
Responding to a data subject access request includes receiving the request and identifying the requestor and source. In response to identifying the requestor and source, a computer processor determines whether the data subject access request is subject to fulfillment constraints, including whether the requestor or source is malicious. If so, then the computer processor denies the request or requests a processing fee prior to fulfillment. If not, then the computer processor fulfills the request.
Claims20
A computer-implemented data processing method for responding to a data subject access request, the method comprising:
- receiving, by one or more computer processors, the data subject access request from a requestor comprising one or more request parameters, wherein the one or more request parameters comprise one or more pieces of personal data associated with the requestor;
- validating, by the one or more computer processors, the requestor based at least in part on the one or more request parameters;
- at least partially in response to validating the requestor, determining, by the one or more computer processors, based at least in part on fulfillment constraint data, whether the data subject access request is subject to one or more response fulfillment constraints associated with the requestor, wherein determining whether the data subject access request is subject to the one or more response fulfillment constraints comprises determining whether the data subject access request comprises one of a threshold quantity of data subject access requests from the requestor within a threshold time period;
- at least partially in response to determining that the data subject access request is subject to the one or more response fulfillment constraints, determining, by the one or more computer processors, based at least in part on historical data associated with the requestor, whether to fulfill the data subject access request;
- at least partially in response to determining, based at least in part on the historical data associated with the requestor, not to fulfill the data subject access request, taking, by the one or more computer processors, one or more actions selected from a group of actions comprising:
- (a) denying the data subject access request;
- and
- (b) requesting, from the requestor, one or more processing fees prior to fulfilling the request;
- at least partially in response to determining, based at least in part on the historical data associated with the requestor, to fulfill the data subject access request, fulfilling, by the one or more computer processors, the data subject access request;
- and
- at least partially in response to determining that the data subject access request is not subject to the one or more response fulfillment constraints, fulfilling, by the one or more computer processors, the data subject access request.
8 more elements
A non-transitory computer-readable medium storing computer-executable instructions for responding to a data subject access request by:
- receiving, by one or more computer processors, the data subject access request from a source of the data subject access request comprising one or more request parameters, wherein the one or more request parameters comprise one or more pieces of personal data associated with a requestor;
- identifying, by the one or more computer processors, the requestor based at least in part on the one or more request parameters;
- at least partially in response to identifying the requestor, determining, by the one or more computer processors, based at least in part on fulfillment constraint data, whether the data subject access request is subject to one or more response fulfillment constraints associated with the requestor, wherein determining whether the data subject access request is subject to the one or more response fulfillment constraints comprises determining whether the data subject access request comprises one of a threshold quantity of data subject access requests from the requestor within a threshold time period;
- at least partially in response to determining that the data subject access request is subject to the one or more response fulfillment constraints, determining, by the one or more computer processors, based at least in part on historical data associated with the requestor, whether to fulfill the data subject access request;
- at least partially in response to determining, based at least in part on the historical data associated with the requestor, not to fulfill the data subject access request:
- notifying, by the one or more computer processors, the requestor that the data subject access request is subject to one or more limitations;
- and
- taking, by the one or more computer processors, one or more actions selected from a group of actions consisting of:
- (a) denying the data subject access request;
- and
- (b) requesting, from the requestor, one or more processing fees prior to fulfilling the request;
- at least partially in response to determining, based at least in part on the historical data associated with the requestor, to fulfill the data subject access request, fulfilling, by the one or more computer processors, the data subject access request;
- and
- updating the fulfillment constraint data, by the one or more computer processors in a computer memory, to reflect that the data subject access request was received.
11 more elements
A system for processing data subject access requests, the system comprising:
- one or more computer processors;
- and
- a computer memory comprising a non-transitory computer-readable medium that stores computer-executable instructions for processing data subject access requests that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
- receiving, by the one or more computer processors, a data subject access request from a requestor comprising one or more request parameters, wherein the one or more request parameters comprise one or more pieces of personal data associated with the requestor;
- validating, by the one or more computer processors, the requestor based at least in part on the one or more request parameters;
- at least partially in response to validating the requestor, determining, by the one or more computer processors, based at least in part on fulfillment constraint data, whether the data subject access request is subject to one or more response fulfillment constraints associated with the requestor, wherein the one or more response fulfillment constraints comprise a threshold quantity of data subject access requests from the requestor within a threshold time period;
- at least partially in response to determining that the data subject access request is subject to the one or more response fulfillment constraints, determining, by the one or more computer processors, that a quantity of data subject access requests received from the requestor within the threshold period of time exceeds the threshold quantity of data subject access requests;
- at least partially in response to determining that the quantity of data subject access requests received from the requestor within the threshold period of time exceeds the threshold quantity of data subject access requests, determining, by the one or more computer processors, based at least in part on historical data associated with the requestor, whether to fulfill the data subject access request;
- at least partially in response to determining, based at least in part on the historical data associated with the requestor, not to fulfill the data subject access request, taking, by the one or more computer processors, one or more actions comprising:
- (a) denying the data subject access request;
- (b) notifying the requestor that the data subject access request is subject to one or more limitations;
- and
- (c) requesting, from the requestor, one or more processing fees prior to fulfilling the request;
- at least partially in response to determining, based at least in part on the historical data associated with the requestor, to fulfill the data subject access request, fulfilling, by the one or more computer processors, the data subject access request;
- and
- at least partially in response to determining that the data subject access request is not subject to the one or more response fulfillment constraints, fulfilling, by the one or more computer processors, the data subject access request.
13 more elements
Dependencies are inferred from the claim text.