Data processing systems for generating and populating a data inventory

A computer system for populating a privacy-related data model comprising:

• at least one computer processor;
• a non-transitory computer-readable medium storing computer executable instructions that, when executed by the at least one computer processor, cause the at least one computer processor to perform operations comprising:
• accessing, by the at least one computer processor, a data model that defines one or more electronic links between a plurality of data assets, wherein the data model comprises a plurality of data inventories that each define one or more inventory attributes for a respective data asset of the plurality of data assets;
• identifying, by the at least one computer processor, one or more unpopulated inventory attributes of a first data inventory of the plurality of data inventories for a first data asset of the plurality of data assets;
• at least partially in response to identifying the one or more unpopulated inventory attributes of the first data inventory, automatically generating, by the at least one computer processor, a privacy questionnaire comprising:
• at least one question that, if properly answered, would result in a response that may be used to populate one or more of the one or more unpopulated inventory attributes of the first data inventory;
• and
• a user-selectable control associated with the at least one question;
• presenting, by the at least one computer processor on a video display device, a graphical user interface comprising the privacy questionnaire to at least one individual;
• receiving, by the at least one computer processor as input via the graphical user interface, a response to the questionnaire, the response comprising a respective answer to the at least one question and an indication of a user selection of the user-selectable control associated with the at least one question;
• at least partially in response to receiving, in the response, the respective answer to the at least one question, updating the data model by populating, by the at least one computer processor, the one or more of the one or more unpopulated inventory attributes of the first data inventory with the respective answer to the at least one question;
• at least partially in response to receiving, in the response, the indication of the user selection of the user-selectable control associated with the at least one question, updating the data model by associating, by the at least one computer processor, a flag with the one or more of the one or more unpopulated inventory attributes of the first data inventory;
• analyzing, by the at least one computer processor, the updated data model to determine a risk associated with the first data asset by:
• identifying the flag associated with the one or more of the one or more unpopulated inventory attributes of the first data inventory;
• determining, based at least in part on the flag associated with the one or more of the one or more unpopulated inventory attributes of the first data inventory, a first risk value for the one or more of the one or more unpopulated inventory attributes of the first data inventory;
• and
• calculating a risk level for the first data asset using the first risk level value for the one or more of the one or more unpopulated inventory attributes of the first data inventory;
• generating, by the at least one computer processor, a visual indication of the risk level for the first data asset;
• and
• presenting, by the at least one computer processor on the video display device, the visual indication of the risk level for the first data asset.

A non-transitory computer-readable medium storing computer-executable instructions for performing a processing activity assessment by:

• identifying, by one or more computer processors, for a particular processing activity, a plurality of processing activity attribute values;
• electronically linking, by one or more computer processors, each respective processing activity attribute value of the plurality of processing activity attribute values to each of:
• a respective question of a plurality of questions in a processing activity template;
• and
• a respective field of a plurality of fields in a processing activity inventory;
• storing, by one or more computer processors, an indication of the electronic linking in computer memory;
• generating, by one or more computer processors, a processing activity assessment based at least in part on the processing activity template, the processing activity assessment comprising the plurality of questions, the plurality of questions comprising:
• at least one question that, if properly answered, would result in a response that may be used to populate the at least one processing activity attribute value of the plurality of processing activity attribute values;
• and
• a user-selectable risk indicium associated with the at least one question;
• presenting, by one or more computer processors on a video display device, a graphical user interface comprising the processing activity assessment to at least one individual;
• receiving, by one or more computer processors as input via the graphical user interface, a response to the processing activity assessment, the response comprising a respective answer to the at least one question and an indication of a user selection of the user-selectable risk indicium;
• at least partially in response to receiving, in the response, the respective answer to the at least one question, populating, by one or more computer processors, the at least one processing activity attribute value of the plurality of processing activity attribute values with the respective answer to the at least one question;
• at least partially in response to receiving, in the response, the indication of the user selection of the user-selectable risk indicium, associating, by one or more computer processors, a flag with the at least one processing activity attribute value of the plurality of processing activity attribute values;
• and
• analyzing, by one or more computer processors, the processing activity inventory to determine a risk associated with the particular processing activity by:
• identifying the flag associated with the at least one processing activity attribute value of the plurality of processing activity attribute values;
• determining, based at least in part on the flag associated with the at least one processing activity attribute value of the plurality of processing activity attribute values, a first risk value for the at least one processing activity attribute value of the plurality of processing activity attribute values;
• and
• calculating a risk level for the particular processing activity using the first risk level value for the at least one processing activity attribute value of the plurality of processing activity attribute values.