# US 2021/0240855 A1 · Data processing systems for orphaned data identification and deletion and related methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240855 A1 - Document ID: US20210240855A1 - Status: Published application - Kind: A1 - Application number: 17/216,436 - Filed: 2021-03-29 - Published: 2021-08-05 - Earliest claimed: 2018-09-07 - Assignees: OneTrust, LLC - Applicants: OneTrust, LLC - Inventors: Jonathan Blake Brannon; Kevin Jones; Dylan D. Patton-Kuhl; Bryan Patrick Kveen; Nicholas Ian Pavlichek; Eliza Rose Crawford - Web page: https://patentgrep.com/patent/US20210240855A1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In particular embodiments, an Orphaned Data Action System is configured to analyze one or more data systems (e.g., data assets), identify one or more pieces of personal data that are one or more pieces of personal data that are not associated with one or more privacy campaigns of the particular organization, and notify one or more individuals of the particular organization of the one or more pieces of personal data that are one or more pieces of personal data that are not associated with one or more privacy campaigns of the particular organization. ## Claims ### Claim 1 A computer-implemented data processing method for identifying one or more pieces of personal data that are not associated with one or more privacy campaigns of a particular entity, the method comprising: accessing, by one or more processors, via one or more computer networks, one or more data assets of the particular entity; scanning, by one or more processors, the one or more data assets to generate a catalog of one or more privacy campaigns and one or more pieces of personal information associated with one or more individuals; storing, by the one or more processors, the generated catalog in computer memory; scanning, by one or more processors, the one or more data assets based at least in part on the generated catalog to identify a first portion of the one or more pieces of personal data that are one or more pieces of personal data that are not associated with the one or more privacy campaigns; automatically removing, by the one or more processors, the first portion of the one or more pieces of personal data that are not associated with the one or more privacy campaigns of the particular entity from the one or more data assets. ### Claim 2 (depends on 1) The computer-implemented data processing method of claim 1, the method further comprising: presenting, to a privacy officer associated with the particular entity, data associated with the first portion of the one or more pieces of personal data that are one or more pieces of personal data that are not associated with the one or more privacy campaigns; receiving, from the privacy officer, a request to maintain the first portion of the one or more pieces of personal data that are not associated with the one or more privacy campaigns of the particular entity on the one or more data assets; and in response to receiving the request, maintaining the first portion of the one or more pieces of personal data that are not associated with the one or more privacy campaigns of the particular entity on the one or more data assets. ### Claim 3 (depends on 1) The computer-implemented data processing method of claim 1, further comprising: determining that a particular privacy campaign of the one or more privacy campaigns has not been utilized in a period of time; and in response to determining that a particular privacy campaign of the one or more privacy campaigns has not been utilized in a period of time, terminating the particular privacy campaign. ### Claim 4 (depends on 3) The computer-implemented data processing method of claim 3, further comprising: identifying a second portion of the one or more pieces of personal data that are associated with the particular privacy campaign; and in response to terminating the particular privacy campaign, automatically removing the second portion of the one or more pieces of personal data from the one or more data assets. ### Claim 5 (depends on 4) The computer-implemented data processing method of claim 4, wherein the period of time is ninety or more days. ### Claim 6 (depends on 1) The computer-implemented data processing method of claim 1, wherein presenting the indication to the one or more individuals associated with the particular entity further comprises: receiving, by one or more processors, a selection, by the one or more individuals associated with the particular entity, of a first set of the one or more pieces of personal data of the first portion of the one or more pieces of personal data to retain based on one or more bases to retain the first set of the one or more pieces of personal data; prompting, by one or more processors, the one or more individuals to provide one or more bases to retain the first set of the one or more pieces of personal data of the first portion of the one or more pieces of personal data that are not associated with the one or more privacy campaigns; receiving, by one or more processors, the provided one or more bases to retain the first set of the one or more pieces of personal data of the first portion of the one or more pieces of personal data from the one or more individuals associated with the particular entity; retaining, by one or more processors, the first set of the one or more pieces of personal data of the first portion of the one or more pieces of personal data from the one or more individuals associated with the particular entity; and removing a second set of the one or more pieces of personal data of the first portion of the one or more pieces of personal data that are not associated with the one or more privacy campaigns from the one or more data assets, wherein the second set of the one or more pieces of personal data is different from the first set of the one or more pieces of personal data and the first portion of the one or more pieces of personal data comprises the first set of the one or more pieces of personal data and the second set of the one or more pieces of personal data. ### Claim 7 (depends on 6) The computer-implemented data processing method of claim 6, further comprising: in response to receiving the provided one or more bases to retain the first set of the one or more pieces of personal data from the one or more individuals associated with the particular entity, submitting the provided one or more bases to retain the first set of the one or more pieces of personal data to one or more second individuals associated with the particular entity for authorization. ### Claim 8 (depends on 6) The computer-implemented data processing method of claim 6, wherein the second set of the one or more pieces of personal data does not include one or more pieces of personal data. ### Claim 9 A computer-implemented data processing method for generating a privacy data report of a particular entity, the method comprising: accessing, by one or more processors, via one or more computer networks, one or more data models that map an association between (i) one or more pieces of personal information of one or more individuals stored within one or more data assets of the particular entity and (ii) one or more privacy campaigns of the particular entity; accessing, by one or more processors; a data collection policy of the particular entity that is based at least in part on one or more collection parameters defining how one or more pieces of personal data of one or more individuals is collected by the particular entity and one or more storage parameters associated with storing the one or more pieces of personal data of the one or more individuals, and one or more data retention metrics of the particular entity that are based at least in part on the collection and storage by the particular entity of the one or more pieces of personal data of the one or more individuals; analyzing, by one or more processors, the one or more data models to identify one or more pieces of personal data that are not associated with the one or more privacy campaigns; generating, by one or more processors, a privacy data report based at least in part on (i) analyzing the one or more data models to identify the one or more pieces of personal data that are not associated with the one or more privacy campaigns, (ii) the data collection policy of the particular entity, and (iii) the one or more data retention metrics of the particular entity; providing, by one or more processors, the privacy data report to one or more individuals associated with the particular entity; receiving, from the one or more individuals, a request to remove the one or more pieces of personal data that are not associated with the one or more privacy campaigns from the one or more data assets; and in response to receiving the request to remove the one or more pieces of personal data that are not associated with the one or more privacy campaigns from the one or more data assets, automatically removing the one or more pieces of personal data that are not associated with the one or more privacy campaigns from the one or more data assets. ### Claim 10 (depends on 9) The computer-implemented data processing method of claim 9, wherein the privacy data report comprises a comparison of the data collection policy and the one or more data retention metrics of the particular entity to one or more industry standard data collection policies and one or more industry standard data retention metrics. ### Claim 11 (depends on 9) The computer-implemented data processing method of claim 9, wherein generating the privacy data report further comprises: calculating a data risk score for the particular entity based at least in part on (i) analyzing the one or more data models to identify one or more pieces of personal data that are not associated with the one or more privacy campaigns, (ii) the data collection policy of the particular entity, and (iii) the one or more data retention metrics of the particular entity. ### Claim 12 (depends on 11) The computer-implemented data processing method of claim 11, further comprising: comparing the data risk score for the particular entity to a threshold data risk score; determining that the data risk score for the particular entity is less than the threshold data risk score; in response to determining that the data risk score for the particular entity is less than the threshold data risk score, generating a notification to indicate that the data risk score for the particular entity is less than the threshold data risk score; and providing the notification to the one or more individuals associated with the particular entity. ### Claim 13 (depends on 11) The computer-implemented data processing method of claim 11, further comprising: comparing the data risk score for the particular entity to a threshold data risk score; determining that the data risk score for the particular entity is greater than or equal to the threshold data risk score; in response to determining that the data risk score for the particular entity is greater than the threshold data risk score, generating a notification to indicate that the data risk score for the particular entity is greater than the threshold data risk score; and providing the notification to the one or more individuals associated with the particular entity. ### Claim 14 A computer-implemented data processing method for removing one or more pieces of personal data that are not associated with one or more privacy campaigns of a particular entity, the method comprising: accessing, by one or more processors, via one or more computer networks, one or more data models that map an association between (i) one or more pieces of personal data associated with one or more individuals stored within one or more data assets of the particular entity and (ii) one or more privacy campaigns of the particular entity; analyzing, by one or more processors, the one or more data models to identify a first portion of the one or more pieces of personal data that are one or more pieces of personal data that are not associated with the one or more privacy campaigns of the particular entity; and automatically removing the first portion of the one or more pieces of personal data that are not associated with the one or more privacy campaigns of the particular entity from the one or more data assets. ### Claim 15 (depends on 14) The computer-implemented data processing method of claim 14, further comprising: receiving, by one or more processors, an indication of a new privacy campaign initiated by the particular entity; in response to receiving the indication of the new privacy campaign initiated by the particular entity, modifying the one or more data models to map an association between (i) one or more pieces of personal data associated with one or more individuals obtained in connection with the new privacy campaign and (ii) the new privacy campaign initiated by the particular entity. ### Claim 16 (depends on 14) The computer-implemented data processing method of claim 14, further comprising: determining that one or more privacy campaigns have been terminated within the one or more data assets of the particular entity; analyzing, by one or more processors, the one or more data models to identify one or more second pieces of personal data that are one or more pieces of personal data that are associated with the terminated one or more privacy campaigns; and generating an indication that the one or more pieces of personal data that are associated with the terminated one or more privacy campaigns are included in the first portion of the one or more pieces of personal data and displaying the indication to a data privacy officer via a graphical user interface. ### Claim 17 (depends on 16) The computer-implemented data processing method of claim 16, further comprising: determining that one or more privacy campaigns of the particular entity have not been utilized in a period of time; and terminating the one or more privacy campaigns of the particular entity that have not been utilized in the period of time. ### Claim 18 (depends on 17) The computer-implemented data processing method of claim 17, wherein the period of time is ninety or more days. ### Claim 19 (depends on 16) The computer-implemented data processing method of claim 16, further comprising: receiving, from the data privacy officer, a request to remove the one or more second pieces of personal data that are one or more pieces of personal data that are associated with the terminated one or more privacy campaigns from the one or more data assets; and in response to the request to remove the one or more second pieces of personal data that are one or more pieces of personal data that are associated with the terminated one or more privacy campaigns from the one or more data assets, automatically removing the one or more second pieces of personal data from the one or more data assets. ### Claim 20 (depends on 19) The computer-implemented data processing method of claim 19, further comprising: receiving, from the data privacy officer, a second request to maintain the one or more second pieces of personal data that are one or more pieces of personal data that are associated with the terminated one or more privacy campaigns on the one or more data assets; in response to receiving the second request, prompting the privacy officer to provide a basis for maintaining the one or more second pieces of personal data that are one or more pieces of personal data that are associated with the terminated one or more privacy campaigns; and in response to receiving the second request: maintaining the one or more second pieces of personal data that are one or more pieces of personal data that are associated with the terminated one or more privacy campaigns on the one or more data assets along with an indication of the basis for maintaining the one or more second pieces of personal data.