Privacy management systems and methods

A computer-implemented data processing method for performing data breach response activities comprising:

• determining, by one or more computer processors, a first jurisdiction affected by a data breach;
• determining, by the one or more computer processors, a second jurisdiction affected by the data breach;
• retrieving, by the one or more computer processors based on the first jurisdiction, the first reporting requirement for the first jurisdiction from a data structure using an ontology mapping the first reporting requirement for the first jurisdiction to a second reporting requirement for the second jurisdiction;
• retrieving, by the one or more computer processors based on the ontology mapping the first reporting requirement for the first jurisdiction to the second reporting requirement for the second jurisdiction, the second reporting requirement for the second jurisdiction from the data structure using the ontology;
• retrieving, by the one or more computer processors based on the first jurisdiction, a first enforcement parameter from the data structure using the ontology, wherein the first enforcement parameter indicates a first number of enforcement actions associated with the first reporting requirement for the first jurisdiction performed in a particular time period;
• retrieving, by the one or more computer processors based on the second jurisdiction, a second enforcement parameter from the data structure using the ontology, wherein the second enforcement parameter indicates a second number of enforcement actions associated with the second reporting requirement for the second jurisdiction performed in a particular time period;
• determining, by the one or more computer processors, a first reporting score for the first jurisdiction based on a first business value for the first jurisdiction and the first enforcement parameter;
• determining, by the one or more computer processors, a second reporting score for the second jurisdiction based on a second business value for the second jurisdiction and the second enforcement parameter;
• determining, by the one or more computer processors, that performing both the first reporting requirement for the first jurisdiction and the second reporting requirement for the second jurisdiction is not possible;
• in response to determining that performing both the first reporting requirement for the first jurisdiction and performing the second reporting requirement for the second jurisdiction is not possible, automatically, by the one or more computer processors:
• calculating a first risk level associated with not performing the first reporting requirement for the first jurisdiction using the first reporting score for the first jurisdiction, wherein calculating the first risk level comprises determining a first penalty for not satisfying the first reporting requirement for the first jurisdiction;
• and
• calculating a second risk level associated with not performing the second reporting requirement for the second jurisdiction using the second reporting score for the second jurisdiction, wherein calculating the second risk level comprises determining a second penalty for not satisfying the second reporting requirement for the second jurisdiction;
• performing, by the one or more computer processors, a comparison of the first risk level with the second risk level to determine that the first risk level is higher than the second risk level;
• determining, by the one or more computer processors based on determining that the first risk level is higher than the second risk level, to perform the first reporting requirement for the first jurisdiction;
• mapping, by the one or more computer processors, the first reporting requirement for the first jurisdiction to a master question in a master questionnaire and not mapping the second reporting requirement for the second jurisdiction to a question in the master questionnaire;
• electronically generating, by the one or more computer processors, a graphical user interface comprising the master questionnaire;
• electronically receiving, by the one or more computer processors, data responsive to the master question via the graphical user interface;
• generating, by the one or more computer processors, an electronic link associating the data responsive to the master question with the first reporting requirement for the first jurisdiction in the data structure using the ontology;
• and
• automatically performing, by the one or more computer processors, the first reporting requirement for the first jurisdiction.

A data breach response system comprising:

• one or more processors;
• and
• computer memory, wherein the data breach response system is configured for:
• generating a data breach information interface soliciting a first affected jurisdiction, a second affected jurisdiction, and data breach information;
• presenting the data breach information interface to a user;
• receiving, from the user via the data breach information interface, an indication of the first affected jurisdiction, an indication of the second affected jurisdiction, and the data breach information;
• retrieving, based on the first affected jurisdiction and the data breach information, a first data breach response requirement for the first affected jurisdiction from a data structure using an ontology mapping the first data breach response requirement for the first affected jurisdiction to a second data breach response requirement for the second affected jurisdiction;
• retrieving, based on the second affected jurisdiction, the ontology mapping the first data breach response requirement for the first affected jurisdiction to the second data breach response requirement for the second affected jurisdiction, and the data breach information, the second data breach response requirement for the second affected jurisdiction from the data structure using the ontology;
• retrieving, based on the first affected jurisdiction, a first enforcement parameter from the data structure using the ontology, wherein the first enforcement parameter indicates a first number of enforcement actions associated with the first data breach response requirement for the first affected jurisdiction in a particular time period;
• retrieving, based on the second affected jurisdiction, a second parameter from the data structure using the ontology, wherein the second enforcement parameter indicates a second number of enforcement actions associated with the second data breach response requirement enforcement for the second affected jurisdiction in the particular time period;
• determining a first reporting score for the first affected jurisdiction based on a first business value for the first affected jurisdiction and the first enforcement parameter;
• determining a second reporting score for the second affected jurisdiction based on a second business value for the second affected jurisdiction and the second enforcement parameter;
• determining that performing both the first data breach response requirement for the first affected jurisdiction and the second data breach response requirement for the second affected jurisdiction is not possible;
• and
• in response to determining that performing both the first data breach response requirement for the first affected jurisdiction and the second data breach response requirement for the second affected jurisdiction is not possible:
• calculating a first risk level associated with not performing the first data breach response requirement for the first affected jurisdiction using the first reporting score for the first affected jurisdiction;
• and
• calculating a second risk level associated with not performing the second data breach response requirement for the second affected jurisdiction using the second reporting score for the second affected jurisdiction;
• performing a comparison of the first risk level with the second risk level to determine that the first risk level is higher than the second risk level;
• generating a master questionnaire comprising a master question;
• mapping the first data breach response requirement for the first affected jurisdiction to the master question in the ontology and not mapping the second data breach response requirement for the second affected jurisdiction to a question in the master questionnaire;
• generating a graphical user interface comprising the master questionnaire;
• electronically receiving data responsive to the master question via the graphical user interface;
• generating an electronic link associating the data responsive to the master question with the first data breach response requirement for the first affected jurisdiction in the data structure using the ontology;
• generating a first data breach disclosure report for the first affected jurisdiction, the first data breach disclosure report comprising the data responsive to the master question, wherein:
• the first reporting score for the first affected jurisdiction is further based at least in part on a first penalty associated with not satisfying a first reporting requirement for the first affected jurisdiction;
• and
• the second reporting score for the second affected jurisdiction is further based at least in part on a second penalty associated with not satisfying a second reporting requirement for the second affected jurisdiction.