System and method to analyse impact of data breaches on sensitive data

A computer implemented system to analyse an impact of data breaches on sensitive data, the system comprising:

• a hardware processor;
• and
• a memory coupled to the hardware processor, wherein the memory comprises a set of program instructions in the form of a processing subsystem, configured to be executed by the hardware processor, wherein the processing subsystem is hosted on a server and is configured to execute on a network to control bidirectional communications among a plurality of modules comprising:
• a data collection module configured to:
• retrieve impacted data sources, including structured and unstructured data, upon interfacing with various data repositories and breach detection sub-systems;
• and
• enrich impacted data with additional contextual information for subsequent analysis upon integrating with customer or employee databases;
• a data identification module configured to:
• scan files for personal information linked to individuals using a combination of data loss prevention (DLP) techniques and named entity recognition (NER) techniques;
• and
• enhance detection accuracy by filtering false positives, identifying missed detections, and resolving ambiguities in data classification upon utilizing generative large language models (LLMs);
• an identity deduplication module configured to:
• consolidate multiple references to a same individual across diverse datasets upon applying a multi-step deduplication process involving both deterministic and probabilistic matching techniques;
• leverage data enrichment from external sources to enhance confidence of identity matching;
• and
• compute linking confidence scores, with configurable thresholds to trigger manual review for ambiguous or low-confidence matches upon implementing statistical analysis;
• a residency inference module configured to:
• infer explicit, implicit, and potential residency information for identified individuals upon employing machine learning techniques and heuristic rules;
• analyse both impacted and enrichment data sources to determine geographical jurisdictions associated with the identified individuals;
• and
• generate probabilistic residency estimations that account for data uncertainties and possible discrepancies in the explicit, implicit, and potential residency information;
• an analysis module configured to:
• evaluate a number of impacted individuals, their residency information, types of breached data, and operating locations of an organization to identify applicable legal obligations and regulations;
• apply identity deduplication and residency inference to calculate a likelihood of relevance for each applicable law upon performing a multi-dimensional analysis incorporating uncertainties in data detection;
• and
• estimate potential fines associated with a breach event by simulating various scenarios, considering statutory penalties, and applying probabilistic models to account for uncertainties in the data;
• an automation module configured to:
• automate generation of breach notification messages for governmental authorities and regulatory agencies, ensuring compliance with jurisdiction-specific requirements;
• and
• flag identities or documents for manual review in cases where data ambiguities or low confidence levels are detected upon implementing decision rules.