# US 2021/0344720 A1 · Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344720 A1 - Document ID: US20210344720A1 - Status: Published application - Kind: A1 - Application number: 17/334,948 - Filed: 2021-05-31 - Published: 2021-11-04 - Earliest claimed: 2016-06-10 - Assignees: OneTrust, LLC - Applicants: OneTrust, LLC - Inventors: Kabir A. Barday; Mihir S. Karanjkar; Steven W. Finch; Ken A. Browne; Nathan W. Heard; Aakash H. Patel; Jason L. Sabourin; Richard L. Daniel; Dylan D. Patton-Kuhl; Jonathan Blake Brannon - Web page: https://patentgrep.com/patent/US20210344720A1 ## CPC - G06Q 10/0635: Risk analysis of enterprise or organisation activities - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling - G06Q 10/10: Office automation; Time management - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/0414: {during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication} - H04L 63/1433: {Vulnerability analysis} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In various embodiments, a data map generation system is configured to receive a request to generate a privacy-related data map for particular computer code, and, at least partially in response to the request, determine a location of the particular computer code, automatically obtain the particular computer code based on the determined location, and analyze the particular computer code to determine privacy-related attributes of the particular computer code, where the privacy-related attributes indicate types of personal information that the particular computer code collects or accesses. The system may be further configured to generate and display a data map of the privacy-related attributes to a user. ## Claims ### Claim 1 A method comprising: monitoring, by computing hardware, a location where computer code is located; identifying, by the computing hardware, a new instance of the computer code at the location; comparing, by the computing hardware, the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code; responsive to identifying the change, analyzing, by the computing hardware, the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses; modifying, by the computing hardware, a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code; and providing, by the computing hardware, the data map for display to a user. ### Claim 2 (depends on 1) The method of claim 1, wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior. ### Claim 3 (depends on 1) The method of claim 1, wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying a change in information displayed on the website. ### Claim 4 (depends on 3) The method of claim 3, wherein the change in information comprises at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy. ### Claim 5 (depends on 1) The method of claim 1, wherein the computer code is an application and identifying the new instance of the computer code involves identifying a new version of the application is available at the location. ### Claim 6 (depends on 1) The method of claim 1, wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses. ### Claim 7 (depends on 1) The method of claim 1, wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses. ### Claim 8 A system comprising: a non-transitory computer-readable medium storing instructions; and a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations, upon a new instance of a computer code being identified at a location being monitored where the computer code is located, comprising: comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code; responsive to identifying the change, analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses; modifying a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code; and providing the data map for display to a user. ### Claim 9 (depends on 8) The system of claim 8, wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior. ### Claim 10 (depends on 8) The system of claim 8, wherein the privacy-related attribute represents at least one of a storage location of the type of personal information or an access permission of the type of personal information. ### Claim 11 (depends on 8) The system of claim 8, wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy. ### Claim 12 (depends on 8) The system of claim 8, wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses. ### Claim 13 (depends on 8) The system of claim 8, wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses. ### Claim 14 A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations, upon a new instance of a computer code being identified at a location being monitored where the computer code is located, comprising: comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code; responsive to identifying the change, analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses; and modifying a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code, wherein the data map is provided for display to a user. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the privacy-related attribute represents at least one of a storage location of the type of personal information or an access permission of the type of personal information. ### Claim 17 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy. ### Claim 18 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses. ### Claim 19 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses. ### Claim 20 A system, wherein upon a new instance of a computer code being identified at a location being monitored where the computer code is located comprises: means for comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code; and responsive to identifying the change, means for analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, wherein the privacy-related attribute indicates a type of personal information that the new instance of the computer code at least one of collects or accesses and a data map representing processing of the personal information is modified to reflect the privacy-related attribute identified for the new instance of the computer code to be provided for display to a user.