# US 12,602,511 B1 · Data privacy context management system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,511 B1 - Document ID: US12602511B1 - Status: Granted - Kind: B1 - Application number: 18/911,611 - Filed: 2024-10-10 - Published: 2026-04-16 - Granted: 2026-04-14 - Earliest claimed: 2024-10-10 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Sharath Jois; Girish Sainath; Aruna K - Web page: https://patentgrep.com/patent/US12602511B1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are provided for analyzing an event received from an application to determine that a new system process has been created and generating a privacy context for the new system process, in real time from receiving the event from the application. For example, the systems and methods analyze application metadata associated with the new system process to determine a process definition for the new system process, extract process flow details for the process definition, analyze the extracted process flow details to determine entities associated with the new system process and data categories associated with the new system process and generate the privacy context based on the entities associated with the new system process and the data categories associated with the new system process, the privacy context linking a data controller, one or more data categories and a role. ## Claims ### Claim 1 A computer-implemented method comprising: receiving an event from an application; analyzing the event to determine that a new system process has been created; generating a privacy context for the new system process, in real time from receiving the event from the application, by performing operations comprising: analyzing application metadata associated with the new system process to determine a process definition for the new system process; extracting process flow details for the process definition; analyzing the extracted process flow details to determine entities associated with the new system process and data categories associated with the new system process; and generating the privacy context based on the entities associated with the new system process and the data categories associated with the new system process, the privacy context linking a data controller, one or more data categories and a role; and storing the privacy context for the new system process. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein determining data categories associated with the new system process from the extracted process flow details comprises: identifying a subset of data that comprises or is associated with personal data; and associating a data category for each of the subset of data that comprises or is associated with personal data. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the data controller is an entity responsible for the privacy context and means for processing data that includes personal information or other private or confidential data. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein one or more data categories include categories of personal data. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: causing display of the privacy context in a user interface on a computing device; receiving changes to the privacy context via the user interface on the computing device; and storing an updated privacy context including the changes to the privacy context. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: determining systems associated with the new system process; and mapping the systems associated with the new system process to the privacy context. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein only one or more specified systems associated with the new system process have authorization to access personal data associated with the new system process. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, comprising: receiving a second event from a second application; analyzing the event to determine that an existing system process has been updated; and generating an updated privacy context for the existing system process, in real time from receiving the event from the second application, by performing operations comprising: analyzing application metadata associated with the existing system process to determine a process definition for the existing system process; extracting process flow details for the process definition for the existing system process; associated with the existing system process and data categories associated with the existing system process; and generating the updated privacy context based on the entities associated with the existing system process and the data categories associated with the existing system process, the updated privacy context linking a data controller, one or more data categories and a role; and storing the updated privacy context for the existing system process. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from a computing system, a request to access to data associated with the new system process; analyzing the request to determine whether the computing system is authorized to access the data associated with the new system process based on the stored privacy context for the new system process; based on determining that the computing system is not authorized to access the data associated with the new system process, denying access; and based on determining that the computing system is authorized to access the data associated with the new system process, granting access. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein analyzing the request further comprises: determining whether the request is for data categories of the stored privacy context that are associated with personal or other confidential data; and granting access to access data associated with the new system process based on determining that the request is for data categories of the stored privacy context that are not associated with personal or other confidential data. ### Claim 11 A system comprising: a memory that stores instructions; and one or more processors configured by the instructions to perform operations comprising: receiving an event from an application; analyzing the event to determine that a new system process has been created; generating a privacy context for the new system process, in real time from receiving the event from the application, by performing operations comprising: analyzing application metadata associated with the new system process to determine a process definition for the new system process; extracting process flow details for the process definition; analyzing the extracted process flow details to determine entities associated with the new system process and data categories associated with the new system process; and generating the privacy context based on the entities associated with the new system process and the data categories associated with the new system process, the privacy context linking a data controller, one or more data categories and a role; and storing the privacy context for the new system process. ### Claim 12 (depends on 11) The system of claim 11, wherein determining data categories associated with the new system process from the extracted process flow details comprises: identifying a subset of data that comprises or is associated with personal data; and associating a data category for each of the subset of data that comprises or is associated with personal data. ### Claim 13 (depends on 11) The system of claim 11, wherein the data controller is an entity responsible for the privacy context and means for processing data that includes personal information or other private or confidential data. ### Claim 14 (depends on 11) The system of claim 11, wherein one or more data categories include categories of personal data. ### Claim 15 (depends on 11) The system of claim 11, the operations further comprising: causing display of the privacy context in a user interface on a computing device; receiving changes to the privacy context via the user interface on the computing device; and storing an updated privacy context including the changes to the privacy context. ### Claim 16 (depends on 11) The system of claim 11, the operations further comprising: determining systems associated with the new system process; and mapping the systems associated with the new system process to the privacy context. ### Claim 17 (depends on 16) The system of claim 16, wherein only one or more specified systems associated with the new system process have authorization to access personal data associated with the new system process. ### Claim 18 (depends on 11) The system of claim 11, the operations comprising: receiving a second event from a second application; analyzing the event to determine that an existing system process has been updated; generating an updated privacy context for the existing system process, in real time from receiving the event from the second application, by performing operations comprising: analyzing application metadata associated with the existing system process to determine a process definition for the existing system process; extracting process flow details for the process definition for the existing system process; associated with the existing system process and data categories associated with the existing system process; and generating the updated privacy context based on the entities associated with the existing system process and the data categories associated with the existing system process, the updated privacy context linking a data controller, one or more data categories and a role; and storing the updated privacy context for the existing system process. ### Claim 19 (depends on 11) The system of claim 11, the operations further comprising: receiving, from a computing system, a request to access to data associated with the new system process; analyzing the request to determine whether the computing system is authorized to access the data associated with the new system process based on the stored privacy context for the new system process; based on determining that the computing system is not authorized to access the data associated with the new system process, denying access; and based on determining that the computing system is authorized to access the data associated with the new system process, granting access. ### Claim 20 A non-transitory computer-readable medium comprising instructions stored thereon that are executable by at least one processor to cause a computing device to perform operations comprising: receiving an event from an application; analyzing the event to determine that a new system process has been created; generating a privacy context for the new system process, in real time from receiving the event from the application, by performing operations comprising: analyzing application metadata associated with the new system process to determine a process definition for the new system process; extracting process flow details for the process definition; associated with the new system process and data categories associated with the new system process; and generating the privacy context based on the entities associated with the new system process and the data categories associated with the new system process, the privacy context linking a data controller, one or more data categories and a role; and storing the privacy context for the new system process.