# US 2022/0035945 A1 · Data processing systems for fulfilling data subject access requests and related methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0035945 A1 - Document ID: US20220035945A1 - Status: Published application - Kind: A1 - Application number: 17/499,582 - Filed: 2021-10-12 - Published: 2022-02-03 - Earliest claimed: 2016-06-10 - Assignees: OneTrust, LLC - Applicants: OneTrust, LLC - Inventors: Kabir A. Barday; Jason L. Sabourin; Jonathan Blake Brannon; Mihir S. Karanjkar; Kevin Jones - Web page: https://patentgrep.com/patent/US20220035945A1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/31: User authentication - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A privacy management system that is adapted for, in the course of processing a particular data subject access request, automatically determining a type of the data subject access request, such as: (1) a request to delete personal data of the requestor that is being stored by a particular organization; (2) a request to provide, to the requestor, personal data of the requestor that is being stored by the particular organization; (3) a request to update personal data of the requestor that is being stored by the particular organization; and (4) a request to opt out of having the particular organization use the requestor's personal information in one or more particular ways. After making this determination, the system may determine, based on the determined type of data subject access request, a particular workflow to follow in authenticating the data subject before fulfilling the data subject access request. ## Claims ### Claim 1 A method comprising: receiving, by computing hardware, a data subject access request from a data subject access requestor to perform an action with regard to personal data associated with the data subject access requestor; determining, by the computing hardware, a type of the data subject access request, the type comprising at least one of: (1) a request to delete the personal data, (2) a request to provide the personal data, (3) a request to opt out of having the personal data processed, or (4) a request to update the personal data; determining, by the computing hardware based on the type, a computer-implemented workflow for processing the data subject access request; determining, by the computing hardware based on the computer-implemented workflow, an authentication methodology that is to be used to verify an identity of the data subject access requestor; using the authentication methodology, by the computing hardware, to verify the identity of the data subject access requestor; and responsive to verifying the identity of the data subject access requestor, processing, by the computing hardware, the data subject access request according to the computer-implemented workflow. ### Claim 2 (depends on 1) The method of claim 1, wherein processing the data subject access request according to the computer-implemented workflow comprises performing at least one of deleting, providing, or updating the personal data by using a data model to identify a storage location for the personal data. ### Claim 3 (depends on 1) The method of claim 1, wherein processing the data subject access request according to the computer-implemented workflow comprises completing the data subject access request on an expedited basis. ### Claim 4 (depends on 1) The method of claim 1, wherein using the authentication methodology to verify the identity of the data subject access requestor comprises requiring the data subject access requestor to transmit a copy of at least one of an identification document for the data subject access requestor or a particular legal document. ### Claim 5 (depends on 1) The method of claim 1, wherein using the authentication methodology to verify the identity of the data subject access requestor comprises: prompting the data subject access requestor to log in to an authentication system for an entity storing the personal data using credentials of the data subject access requestor; and responsive to the data subject access requestor successfully logging in to the authentication system, verifying the identity of the data subject access requestor. ### Claim 6 (depends on 1) The method of claim 1, wherein the data subject access request includes information on the data subject access requestor and using the authentication methodology to verify the identity of the data subject access requestor comprises: accessing, via a computer network, a third-party data aggregation system; receiving, from the third-party data aggregation system, third-party derived information associated with the data subject access requestor; and comparing the third-party derived information with the information on the data subject access requestor included in the data subject access request to verify the identity of the data subject access requestor. ### Claim 7 (depends on 1) The method of claim 1, wherein using the authentication methodology to verify the identity of the data subject access requestor comprises: generating, based on information received via a third-party data aggregation system, a threshold identity confirmation question; prompting the data subject access requestor to provide a response to the threshold identity confirmation question; and comparing the response to the information received via the third-party data aggregation system to verify the identity of the data subject access requestor. ### Claim 8 A system comprising: a non-transitory computer-readable medium storing instructions; and a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising: providing a graphical user interface for display on a computing device, the graphical user interface configured to receive a data subject access request; receiving, via the graphical user interface, the data subject access request from a data subject access requestor to perform an action with regard to personal data; determining a type of the data subject access request, the type comprising at least one of: (1) a request to delete the personal data, (2) a request to provide the personal data, (3) a request to opt out of having the personal data processed, or (4) a request to update the personal data; determining, based on the type, a computer-implemented workflow for processing the data subject access request, wherein the computer-implemented workflow identifies an authentication methodology used to verify an identity of the data subject access requestor; using the authentication methodology to verify the identity of the data subject access requestor; and responsive to verifying the identity of the data subject access requestor, processing the data subject access request according to the computer-implemented workflow. ### Claim 9 (depends on 8) The system of claim 8, wherein processing the data subject access request according to the computer-implemented workflow comprises performing at least one of deleting, providing, or updating the personal data by using a data model to identify a storage location for the personal data. ### Claim 10 (depends on 8) The system of claim 8, wherein processing the data subject access request according to the computer-implemented workflow comprises completing the data subject access request on an expedited basis. ### Claim 11 (depends on 8) The system of claim 8, wherein using the authentication methodology to verify the identity of the data subject access requestor comprises requiring the data subject access requestor to transmit a copy of at least one of an identification document for the data subject access requestor or a particular legal document. ### Claim 12 (depends on 8) The system of claim 8, wherein using the authentication methodology to verify the identity of the data subject access requestor comprises: prompting the data subject access requestor to log into an authentication system for an entity storing the personal data using credentials of the data subject access requestor; and responsive to the data subject access requestor successfully logging into the authentication system, verifying the identity the data subject access requestor. ### Claim 13 (depends on 8) The system of claim 8, wherein the data subject access request includes information on the data subject access requestor and using the authentication methodology to verify the identity of the data subject access requestor comprises: accessing, via a computer network, a third-party data aggregation system; receiving, from the third-party data aggregation system, third-party derived information associated with the data subject access requestor; and comparing the third-party derived information with the information on the data subject access requestor included in the data subject access request to verify the identity of the data subject access requestor. ### Claim 14 (depends on 8) The system of claim 8, wherein using the authentication methodology to verify the identity of the data subject access requestor comprises: generating, based on information received via a third-party data aggregation system, a threshold identity confirmation question; prompting the data subject access requestor to provide a response to the threshold identity confirmation question; and comparing the response to the information received via the third-party data aggregation system to verify the identity of the data subject access requestor. ### Claim 15 A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising: receiving a data subject access request from a data subject access requestor to perform an action with regard to personal data associated with a data subject; determining a type of the data subject access request, the type comprising at least one of: (1) a request to delete the personal data, (2) a request to provide the personal data, (3) a request to opt out of having the personal data processed, or (4) a request to update the personal data; determining, based on the type, a computer-implemented workflow for processing the data subject access request, wherein the computer-implemented workflow identifies an authentication methodology; using the authentication methodology to verify an identity of the data subject access requestor; and responsive to verifying the identity of the data subject access requestor, processing the data subject access request according to the computer-implemented workflow. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the authentication methodology specifies how many different types of authentication information are required to verify the identity of the data subject access requestor. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the personal data has been obtained from the data subject and stored on a data asset of an entity receiving the data subject access request. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the data subject access requestor is the data subject. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein processing the data subject access request according to the computer-implemented workflow comprises performing at least one of deleting, providing, or updating the personal data by using a data model to identify a storage location for the personal data. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein processing the data subject access request according to the computer-implemented workflow comprises completing the data subject access request on an expedited basis.