BACKGROUND

Over the past years, privacy and security policies, and related operations have become increasingly important. Breaches in security, leading to the unauthorized access of personal data (which may include sensitive personal data) have become more frequent among companies and other organizations of all sizes. Such personal data may include, but is not limited to, personally identifiable information (PII), which may be information that directly (or indirectly) identifies an individual or entity. Examples of PII include names, addresses, dates of birth, social security numbers, and biometric identifiers such as a person's fingerprints or picture. Other personal data may include, for example, customers' Internet browsing habits, purchase history, or even their preferences (e.g., likes and dislikes, as provided or obtained through social media).

Many organizations that obtain, use, and transfer personal data, including sensitive personal data, have begun to address these privacy and security issues. To manage personal data, many companies have attempted to implement operational policies and processes that comply with legal and industry requirements. However, there is an increasing need for improved systems and methods to manage personal data in a manner that complies with such policies.

Similarly, as individuals have become more aware of the risks associated with the theft or misuse of their personal data, they have sought additional tools to help them manage which entities process their personal data. There is currently a need for improved tools that would allow individuals to minimize the number of entities that process their personal data—especially entities that the individual doesn't actively do business with.

Different jurisdictions around the world have different personal data handling requirements with which companies dealing with private user data must comply. Such organizations need to be aware of such requirements and have the ability to comply with them. Therefore, there is an increasing need for systems and methods that facilitate the ability of an organization to comply with personal data handling requirements.

SUMMARY

In general, aspects of the present disclosure provide methods, apparatus, systems, computing devices, computing entities, and/or the like. In accordance with one aspect, a method is provided. According to particular aspects, the method involves: determining, by computing hardware, at least one of (a) a type of operation executed by one or more computing systems associated with an entity or (b) a geographic location associated with the one or more computing systems; generating, by the computing hardware, a first data structure having a first set of attributes indicating control actions applicable to the at least one of the type of operation or the geographic location; obtaining, by the computing hardware, a questionnaire having metadata mapping questions of the questionnaire to the first set of attributes in the first data structure; providing, by the computing hardware, the questionnaire for display on a graphical user interface to a user, wherein displaying the questionnaire on the graphical user interface involves providing a first prompt to the user requesting a first answer to a first one of the questions; receiving, by the computing hardware, the first answer; determining, by the computing hardware, a similarly situated entity based on the at least one of the type of operation or the geographic location; generating, by the computing hardware, an ontology mapping the first answer to a second answer used to populate an attribute from a second set of attributes indicating the control actions in a second data structure for the similarly situated entity; performing, by the computing hardware using the ontology, a comparison of the first answer to the second answer to determine the entity does not implement a particular control action of the control actions and the similarly situated entity does implement the particular control action of the control actions; generating, by the computing hardware and based on the comparison, a relative readiness for the entity; and providing, by the computing hardware, an indication of the relative readiness for display on the graphical user interface to the user, wherein the indication of the relative readiness identifies the similarly situated entity does implement the particular control action and the entity does not implement the particular control action.

According particular embodiments, the method further comprises: generating, by the computing hardware and based on the questionnaire, the graphical user interface, wherein generating the graphical user interface comprises configuring the first prompt for requesting the first answer to the first question. According to particular embodiments, the method further comprises: receiving, by the computing hardware, supporting data associated with the first answer; and determining, by the computing hardware and based on the supporting data, a confidence level for the first answer.

In some embodiments, the particular control action comprises at least one of: (a) a location for storing personal data; (b) a length of time for storing the personal data; (c) a type of the personal data; (d) a type of data subject associated with the personal data; or (e) a multifactor user authentication requirement. In addition, in some embodiments, the particular control action is required for compliance with a particular privacy standard, the graphical user interface is configured to display a list of privacy standards, and the method further comprises receiving, by the computing hardware, a second indication originating from the graphical user interface of a selection of the particular privacy standard from the list of privacy standards. Further, in some embodiments, determining the confidence level for the first answer is based on a source of the supporting data. In addition, in some embodiments, the relative readiness for the entity comprises a percentage representing a number of the control actions implemented by the entity as compared to a number of the control actions implemented by the similarly situated entity.

In accordance with another aspect, a system comprising a non-transitory computer-readable medium storing instructions and a processing device communicatively coupled to the non-transitory computer-readable medium. Accordingly, the processing device is configured to execute the instructions and thereby perform operations comprising: receiving a first indication of at least one of (a) a type of operation executed by a computing system associated with an entity or (b) a geographic location associated with the computing system; obtaining a questionnaire having metadata mapping questions of the questionnaire to a first set of attributes in a first data structure, wherein the first set of attributes indicate control actions applicable to the at least one of the type of operation or the geographic location; providing the questionnaire for display on a graphical user interface to a user, wherein displaying the questionnaire on the graphical user interface involves providing a first prompt to the user requesting a first answer to a first one of the questions; receiving the first answer; generating an ontology mapping the first answer to a second answer used to populate an attribute from a second set of attributes indicating the control actions in a second data structure for a similarly situated entity, wherein the similarly situated entity is based on the at least one of the type of operation or the geographic location; performing, using the ontology, a comparison of the first answer to the second answer to determine the entity does not implement a particular control action of the control actions and the similarly situated entity does implement the particular control action of the control actions; generating, based on the comparison, a relative readiness for the entity; and providing a second indication of the relative readiness for display on the graphical user interface to the user, wherein the second indication of the relative readiness identifies the similarly situated entity does implement the particular control action and the entity does not implement the particular control action.

According to particular embodiments, the operations further comprise generating, based on the questionnaire, the graphical user interface, wherein generating the graphical user interface comprises configuring the first prompt for requesting the first answer to the first question. In addition, according to particular embodiments, the operations further comprise anonymizing the similarly situated entity so that an identity of the similarly situated entity is not displayed on the graphical user interface. Further, according to particular embodiments, the operations further comprise: receiving supporting data associated with the first answer; and determining, based on the supporting data, a confidence level for the first answer.

In some embodiments, the particular control action comprises at least one of: (a) a location for storing personal data; (b) a length of time for storing the personal data; (c) a type of the personal data; (d) a type of data subject associated with the personal data; or (e) a multifactor user authentication requirement. In addition, in some embodiments, the supporting data comprises at least one of unsubstantiated data provided by the entity, substantiated data based on a remote interview with the entity, or substantiated data based on an audit of the entity. Further, in some embodiments, the relative readiness for the entity comprises a score representing a percentage of the control actions implemented by the entity as compared to a percentage of the control actions implemented by the similarly situated entity.

In accordance with yet another aspect, a non-transitory computer-readable medium is provided. The non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising: receiving a first indication of at least one of (a) a type of operation executed by a computing system associated with an entity or (b) a geographic location associated with the computing system; providing a questionnaire for display on a graphical user interface to a user, wherein: the questionnaire comprises metadata mapping questions of the questionnaire to a first set of attributes in a first data structure, the first set of attributes indicating control actions applicable to the at least one of the type of operation or the geographic location, and displaying the questionnaire on the graphical user interface involves providing a first prompt to the user requesting a first answer to a first one of the questions; receiving the first answer; generating an ontology mapping the first answer to a second answer used to populate an attribute from a second set of attributes indicating the control actions in a second data structure for a similarly situated entity, wherein the similarly situated entity is based on the at least one of the type of operation or the geographic location; performing, using the ontology, a comparison of the first answer to the second answer to determine the entity does not implement a particular control action of the control actions and the similarly situated entity does implement the particular control action of the control actions; generating, based on the comparison, a relative readiness for the entity; and providing a second indication of the relative readiness for display on the graphical user interface to the user, wherein the second indication of the relative readiness identifies the similarly situated entity does implement the particular control action and the entity does not implement the particular control action.

According to particular embodiments, the operations further comprise generating, based on the questionnaire, the graphical user interface, wherein generating the graphical user interface comprises configuring the first prompt for requesting the first answer to the first question. In addition, according to particular embodiments, the operations further comprise: receiving supporting data associated with the first answer; and determining, based on the supporting data, a confidence level for the first answer.

In some embodiments, the particular control action comprises at least one of: (a) a location for storing personal data; (b) a length of time for storing the personal data; (c) a type of the personal data; (d) a type of data subject associated with the personal data; or (e) a multifactor user authentication requirement. In addition, in some embodiments, the supporting data comprises at least one of unsubstantiated data provided by the entity, substantiated data based on a remote interview with the entity, or substantiated data based on an audit of the entity. Further, in some embodiments, the relative readiness for the entity comprises a grade representing a number of the control actions implemented by the entity as compared to a number of the control actions implemented by the similarly situated entity.

The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter may become apparent from the description, the drawings, and the claims.

