# US 2021/0241215 A1 · Data processing systems for generating and populating a data inventory > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0241215 A1 - Document ID: US20210241215A1 - Status: Published application - Kind: A1 - Application number: 17/222,556 - Filed: 2021-04-05 - Published: 2021-08-05 - Earliest claimed: 2016-06-10 - Assignees: OneTrust, LLC - Applicants: OneTrust, LLC - Inventors: Kabir A. Barday; Mihir S. Karanjkar; Steven W. Finch; Ken A. Browne; Nathan W. Heard; Aakash H. Patel; Jason L. Sabourin; Richard L. Daniel; Dylan D. Patton-Kuhl; Jonathan Blake Brannon - Web page: https://patentgrep.com/patent/US20210241215A1 ## CPC - G06Q 10/087: Inventory or stock management, e.g. order filling, procurement or balancing against orders - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). For example, a first data asset may include any software or device (e.g., server or servers) utilized by a particular entity for such data collection, processing, transfer, storage, etc. ## Claims ### Claim 1 A data processing system for generating a data inventory, the system comprising: one or more computer processors; and computer memory; and a non-transitory computer-readable medium storing computer-executable instructions that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising: generating a data model mapping one or more relationships between a plurality of data assets, the data model comprising one or more data inventories, wherein each data inventory of the one or more data inventories is associated with a respective data asset of the plurality of data assets; identifying a primary data asset from among the plurality of data assets that collects or stores personal data of one or more data subjects; generating a data inventory for the primary data asset, the data inventory storing one or more primary data asset inventory attributes comprising transfer data associated with the primary data asset; modifying the data model to include the data inventory for the primary data asset; using the transfer data associated with the primary data asset to identify an application programming interface key associated with the primary data asset; analyzing the application programming interface key associated with the primary data asset to identify a transfer data asset from among the plurality of data assets; at least partially in response to identifying the transfer data asset by analyzing the application programming interface key associated with the primary data asset: modifying the data inventory for the primary data asset to include the transfer data asset; and modifying a data inventory for the transfer data asset to include the primary data asset; digitally storing the modified data inventory for the primary data asset and the modified data inventory for the transfer data asset in computer memory; and electronically linking the primary data asset and the transfer data asset in the data model. ### Claim 2 (depends on 1) The data processing system of claim 1, wherein the operations further comprise: generating a visual representation of the data model, the visual representation of the data model comprising: a visual representation of the primary data asset; a visual representation of the transfer data asset; and a visual representation of a flow of data between the primary data asset and the transfer data asset. ### Claim 3 (depends on 2) The data processing system of claim 2, wherein: the visual representation of the primary data asset is comprised in a visual representation of a geographic location of the primary data asset; the visual representation of the transfer data asset is comprised in a visual representation of a geographic location of the transfer data asset; and the visual representation of the flow of data between the primary data asset and the transfer data asset comprises a visual representation of a flow of data between the geographic location of the primary data asset and the geographic location of the transfer data asset. ### Claim 4 (depends on 2) The data processing system of claim 2, wherein the visual representation of the data model further comprises a visual indication of a risk level associated with the flow of data between the primary data asset and the transfer data asset. ### Claim 5 (depends on 1) The data processing system of claim 1, wherein the operations further comprise: determining one or more individuals permitted to access the personal data of the one or more data subjects collected or stored by the primary data asset; and modifying the one or more primary data asset inventory attributes to include access data that identifies the one or more individuals permitted to access to the personal data of the one or more data subjects collected or stored by the primary data asset. ### Claim 6 (depends on 1) The data processing system of claim 1, wherein the operations further comprise: determining one or more software applications that collect the personal data of the one or more data subjects for storage in the primary data asset; and modifying the one or more primary data asset inventory attributes to include processing activity data that identifies the one or more software applications that collect the personal data of the one or more data subjects for storage in the primary data asset. ### Claim 7 (depends on 1) The data processing system of claim 1, wherein the one or more primary data asset inventory attributes further comprise one or more types of personal data collected or stored by the primary data asset. ### Claim 8 A computer-implemented data processing method for generating a data inventory, the method comprising: accessing, by one or more computer processors, a first data asset; identifying, by one or more computer processors, one or more access logs stored on the first data asset; analyzing, by one or more computer processors, the one or more access logs to identify: a transfer data asset that exchanges personal data with the first data asset; and a type of personal data exchanged by the transfer data asset and the first data asset; at least partially in response to identifying the transfer data asset, accessing, by one or more computer processors, a data model comprising a data inventory for the transfer data asset, the data inventory for the transfer data asset comprising one or more transfer data asset inventory attributes; generating, by one or more computer processors, a data inventory for the first data asset, the data inventory for the first data asset comprising one or more first data asset inventory attributes wherein one or more of the one or more first data asset inventory attributes are unpopulated; populating, by one or more computer processors, a first attribute of the one or more first data asset inventory attributes with an indication of the transfer data asset; populating, by one or more computer processors, a second attribute of the one or more first data asset inventory attributes with an indication of the type of personal data exchanged by the transfer data asset and the first data asset; and populating, by one or more computer processors, one or more unpopulated attributes of the one or more first data asset inventory attributes with one or more respective attributes of the one or more transfer data asset inventory attributes; populating, by one or more computer processors, a first attribute of the one or more transfer data asset inventory attributes with an indication of the first data asset; storing, by one or more computer processors in computer memory, the data inventory for the first data asset and the data inventory for the transfer data asset; and electronically linking, by one or more computer processors in the computer memory, the first data asset and the transfer data asset. ### Claim 9 (depends on 8) The computer-implemented data processing method of claim 8, further comprising populating, by one or more computer processors, one or more unpopulated attributes of the one or more first data asset inventory attributes with one or more attributes selected from a group consisting of: (a) an encryption status of the personal data exchanged by the transfer data asset and the first data asset; (b) a location of the first data asset; (c) an amount of data stored on the first data asset; and (d) one or more processing activities associated with the first data asset. ### Claim 10 (depends on 8) The computer-implemented data processing method of claim 8, further comprising: generating, by one or more computer processors, a visual representation of the data inventory for the first data asset, the visual representation comprising: a visual indication of the first data asset; a visual indication of the transfer data asset; a visual indication of the type of personal data exchanged by the transfer data asset and the first data asset; and a visual indication of a flow of the personal data exchanged by the transfer data asset and the first data asset; and displaying, on a graphical user interface, the visual representation of the data inventory for the first data asset. ### Claim 11 (depends on 10) The computer-implemented data processing method of claim 10, further comprising: determining, by one or more computer processors, a particular entity that operates the first data asset; and populating, by one or more computer processors, a third attribute of the one or more first data asset inventory attributes with an indication of a type of the particular entity that operates the first data asset. ### Claim 12 (depends on 11) The computer-implemented data processing method of claim 11, further comprising: determining, by one or more computer processors, one or more departments within the particular entity that are responsible for the first data asset; and populating, by one or more computer processors, each of one or more attributes of the one or more first data asset inventory attributes with a respective indication of one of the one or more departments within the particular entity that are responsible for the first data asset. ### Claim 13 (depends on 8) The computer-implemented data processing method of claim 8, wherein generating the data inventory for the first data asset comprises: detecting, by one or more computer processors, the initiation of a privacy campaign; and at least partially in response to detecting the initiation of the privacy campaign, generating, by one or more computer processors, the data inventory for the first data asset. ### Claim 14 (depends on 13) The computer-implemented data processing method of claim 13, further comprising: at least partially in response to detecting the initiation of the privacy campaign, generating, by one or more computer processors, a questionnaire comprising one or more questions, wherein one or more of the one or more questions are associated with one or more respective attributes of the one or more first data asset inventory attributes; presenting, by one or more computer processors, the questionnaire to a user; receiving, by one or more computer processors, from the user, one or more answers corresponding to the one or more of the one or more questions associated with the one or more respective attributes of the one or more first data asset inventory attributes; and populating, by one or more computer processors, the one or more respective attributes of the one or more first data asset inventory attributes based at least in part on the one or more answers. ### Claim 15 A non-transitory computer-readable medium for generating a data inventory, the non-transitory computer-readable medium storing computer-executable instructions for: identifying, by one or more computer processors, a first data asset that collect or stores personal data for one or more data subjects; generating, by one or more computer processors, a data inventory for the first data asset, the data inventory comprising a plurality of first data asset inventory attributes, wherein one or more of the plurality of first data asset inventory attributes are unpopulated first data asset inventory attributes; determining, by one or more computer processors, first data asset transfer data comprising remote system access data; analyzing, by one or more computer processors, the remote system access data; identifying, by one or more computer processors, based at least in part on analyzing the remote system access data, a remote system associated with an exchange of data between the first data asset and the remote system; identifying, by one or more computer processors, based at least in part on analyzing the remote system access data, a type of data that the first data asset exchanges with the remote system; populating, by one or more computer processors, a first attribute of the unpopulated first data asset inventory attributes with an indication of the remote system with which the first data asset exchanges data; populating, by one or more computer processors, a second attribute of the unpopulated first data asset inventory attributes with an indication of the type of data that the first data asset exchanges with the remote system; storing, by one or more computer processors in computer memory, the data inventory for the first data asset; linking, by one or more computer processors in the computer memory, the first data asset and the remote system; generating, by one or more computer processors, a visual representation of a flow of data between the first data asset and the remote system, wherein the visual representation comprises a visual indication of the first data asset, a visual indication of the remote system, and a visual indication of the flow of data between the first data asset and the remote system; and presenting, by one or more computer processors on a graphical user interface, the visual representation of the flow of data between the first data asset and the remote system. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the remote system access data comprises one or more uniform resource locators associated with the remote system. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the exchange of data between the first data asset and the remote system comprises a transfer of personal data from the first data asset to the remote system. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the exchange of data between the first data asset and the remote system comprises a transfer of personal data from the remote system to the first data asset. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the computer-executable instructions further comprise instructions for populating, by one or more computer processors, one or more of the unpopulated first data asset inventory attributes with answers responsive to a questionnaire associated with a particular privacy campaign. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the computer-executable instructions further comprise instructions for populating, by one or more computer processors, one or more of the unpopulated first data asset inventory attributes with information obtained from an application using an application programming interface.