System for intrafirm tracking of personally identifiable information

A computer system for tracking use of personally identifiable information (PII) by a computer asset of a firm, the computer system comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions that, when executed by the processor, cause the computer system to:
• receive identification of two or more data elements utilized by the computer asset, wherein each of the two or more data elements is a category of personal information, and wherein each of the two or more data elements corresponds to one of a plurality of risk categories;
• receive identification of an individual type associated with the two or more data elements, wherein the individual types is a category of persons;
• determine whether the computer asset utilizes PII based on the two or more data elements individually or as a combination;
• and
• upon determining that the computer asset utilizes PII:
• determine a sensitivity level of the PII based on a sensitivity classification for the two or more data elements identified for the computer asset;
• determine whether enhanced data control is necessary for the computer asset based on the two or more data elements identified for the computer asset and based on the sensitivity level for the PII, wherein the enhanced data control modifies access parameters to the PII from the computer asset, and wherein the memory stores instructions that, when executed by the processor, cause the process to determine whether the enhanced data control is necessary by:
• categorizing each of the two or data elements into its corresponding risk category;
• and
• determining whether the enhanced data control is necessary by determining an applicable rule from a set of rules, wherein a subset of rules in the set of rules corresponds to an enhanced data control, where the applicable rule is determined based on a combination of quantities of the two or more data elements categorized to each of the plurality of risk categories and based on the sensitivity classification for the two or more data elements, such that at least one rule in the set of rule is applicable to the two or more data elements upon a determination that the quantities of the two or more data elements categorized to each of the plurality of risk categories is greater than zero;
• and
• record the individual type, whether enhanced data control is necessary, and the sensitivity level of the PII in association with the computer asset in a database communicably coupled to the computer system.