Enterprise policy language knowledge base construction method and device, equipment and storage medium

Abstract

The application discloses a construction method of an enterprise policy language knowledge base, comprising the following steps: obtaining actual businesses in a target enterprise privacy policy, and determining each target personal information processing category contained in the actual businesses; respectively searching for each target attention factor corresponding to each target personal information processing category from a processing category and attention factor comparison table; searching for an audit item corresponding to each target personal information processing category from a processing category and audit item comparison table; combining each audit item and the actual businesses to construct a vocabulary table corresponding to each target attention factor; constructing a policy language in a key-value form according to each target attention factor of each target personal information processing category and the corresponding vocabulary table, and obtaining the enterprise policy language knowledge base. The application greatly reduces the difficulty of compliance audit work on the situation of enterprise processing personal information, and saves manual time and effort. The application also discloses a device, equipment and storage medium, which have corresponding technical effects.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method, apparatus, device, and computer-readable storage medium for constructing an enterprise strategy language knowledge base. Background Technology

[0002] In recent years, mobile applications (APPs) have been widely used in people's daily lives and studies. While bringing convenience, these applications frequently force users to agree to their privacy policies and collect various kinds of personal information, seriously threatening personal information security. Therefore, it is necessary to establish relevant regulations to urge companies to collect and use this data in compliance with regulations.

[0003] Auditing whether a company complies with relevant regulations based on the personal information it processes presents two main challenges: First, the technical and non-quantitative descriptions in the relevant regulations, along with the highly abstract concepts, make it impossible to define a set of finite rules for all scenarios, leading to difficulties in compliance auditing. Second, corporate privacy policies are typically lengthy documents, and currently, compliance audits require comparing each of the company's activities with its privacy policy and audit items, wasting a significant amount of human time and effort.

[0004] In conclusion, effectively addressing the difficulties in conducting compliance audits of enterprises' handling of personal information, which wastes a significant amount of human time and energy, is a pressing issue that those skilled in the art urgently need to resolve. Summary of the Invention

[0005] The purpose of this application is to provide a method for constructing an enterprise strategy language knowledge base, which greatly reduces the difficulty of compliance auditing of enterprises' handling of personal information and saves manpower, time and effort; another purpose of this application is to provide an apparatus, device and computer-readable storage medium for constructing an enterprise strategy language knowledge base.

[0006] To solve the above-mentioned technical problems, this application provides the following technical solution:

[0007] A method for constructing an enterprise strategy language knowledge base, comprising:

[0008] Obtain the actual business operations contained in the target company's privacy policy, and determine the target personal information processing categories included in the actual business operations;

[0009] Find the target's target attention elements corresponding to each target's personal information processing category from the table of processing categories and attention elements;

[0010] Find the audit item corresponding to each of the target personal information processing categories from the processing category and audit item comparison table;

[0011] Construct a vocabulary for each of the aforementioned audit items and the aforementioned actual business processes, respectively;

[0012] Based on the target focus elements and corresponding vocabularies for each target personal information processing category, a key-value form of strategy language is constructed to obtain the enterprise strategy language knowledge base.

[0013] In one specific embodiment of this application, determining the target personal information processing categories included in the actual business includes:

[0014] The personal information-related content and processing activities in the actual business are labeled to obtain labeling information;

[0015] The target personal information processing categories included in the actual business are determined based on the labeled information.

[0016] In one specific embodiment of this application, after obtaining the enterprise strategy language knowledge base, the method further includes:

[0017] When changes are detected in the actual business operations of the target enterprise's privacy policy, the enterprise policy language knowledge base is updated according to the changes.

[0018] In one specific embodiment of this application, before updating the enterprise strategy language knowledge base according to the changes, the method further includes:

[0019] Determine whether the changes include new personal information processing categories other than the target personal information processing categories or reduced personal information processing categories.

[0020] If so, then perform the step of updating the enterprise strategy language knowledge base according to the changes.

[0021] In one specific embodiment of this application, when it is determined that the changed content includes a new personal information processing category in addition to each of the target personal information processing categories, the enterprise strategy language knowledge base is updated according to the changed content, including:

[0022] Find the newly added elements of interest corresponding to the newly added personal information processing category from the table of processing categories and elements of interest.

[0023] Find the new audit item corresponding to the new personal information processing category from the table of processing categories and audit items;

[0024] By combining the newly added audit items and the changes, a new vocabulary list corresponding to each of the newly added attention elements shall be constructed.

[0025] Based on the newly added attention elements and corresponding newly added vocabularies of the newly added personal information processing category, construct a new strategy language in key-value form, and add the new strategy language to the enterprise strategy language knowledge base.

[0026] In one specific embodiment of this application, when it is determined that the change content includes a reduction of personal information processing categories for each of the target personal information processing categories, the enterprise strategy language knowledge base is updated according to the change content, including:

[0027] Search the enterprise strategy language knowledge base for the strategy language corresponding to the reduced personal information processing category, and delete the found strategy language from the enterprise strategy language knowledge base.

[0028] In one specific embodiment of this application, after obtaining the enterprise strategy language knowledge base, the method further includes:

[0029] Obtain information about the target company's processing activities of personal information data, which are subject to the target company's privacy policy.

[0030] The enterprise policy language knowledge base is used to conduct compliance audits of the enterprise's processing activities.

[0031] An apparatus for constructing an enterprise strategy language knowledge base, comprising:

[0032] The category determination module is used to obtain the actual business in the target enterprise's privacy policy and determine the target personal information processing categories included in the actual business;

[0033] The element search module is used to find the target interest elements corresponding to each target personal information processing category from the processing category and interest element comparison table;

[0034] The audit item lookup module is used to find the audit items corresponding to each of the target personal information processing categories from the processing category and audit item mapping table;

[0035] The vocabulary building module is used to construct a vocabulary corresponding to each of the target concern elements by combining each of the audit items and the actual business;

[0036] The knowledge base acquisition module is used to construct a key-value strategy language based on the target attention elements and corresponding vocabularies of each target personal information processing category, thereby obtaining an enterprise strategy language knowledge base.

[0037] An apparatus for constructing an enterprise strategy language knowledge base, comprising:

[0038] Memory, used to store computer programs;

[0039] A processor, used to execute the computer program, implements the steps of the method for constructing the enterprise strategy language knowledge base as described above.

[0040] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method for constructing an enterprise strategy language knowledge base as described above.

[0041] The method for constructing the enterprise strategy language knowledge base provided in this application involves: obtaining the actual business of the target enterprise's privacy policy and determining the target personal information processing categories included in the actual business; searching for the target concern elements corresponding to each target personal information processing category from the processing category and concern element comparison table; searching for the audit items corresponding to each target personal information processing category from the processing category and audit item comparison table; constructing a vocabulary corresponding to each target concern element by combining each audit item and the actual business; and constructing a key-value form strategy language based on each target concern element of each target personal information processing category and the corresponding vocabulary to obtain the enterprise strategy language knowledge base.

[0042] As can be seen from the above technical solution, by pre-establishing a comparison table of processing categories and key concerns, as well as a comparison table of processing categories and audit items, based on relevant regulations for enterprises' handling of personal information, after determining the actual business operations within the target enterprise's privacy policy for each target personal information processing category, the corresponding key concerns are found in the comparison table of processing categories and key concerns, and the corresponding audit items are found in the comparison table of processing categories and audit items. A vocabulary corresponding to each key concern is constructed by combining each audit item and the actual business operations. Based on the key concerns of each target personal information processing category and the corresponding vocabulary, a key-value policy language is constructed, resulting in an enterprise policy language knowledge base. This provides reliable and feasible analytical data for compliance audits of enterprises' handling of personal information. Before conducting compliance audits of enterprises' data processing activities, the actual processing activities of the enterprise are converted into policy language, and rule matching is performed with the relevant policy language in the knowledge base to obtain compliance audit analysis results. This significantly reduces the difficulty of compliance audits of enterprises' handling of personal information, saving manpower, time, and effort.

[0043] Accordingly, this application also provides an apparatus, device, and computer-readable storage medium for constructing an enterprise strategy language knowledge base, which corresponds to the above-mentioned method for constructing an enterprise strategy language knowledge base and has the aforementioned technical effects, which will not be elaborated here. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating the implementation of a method for constructing an enterprise strategy language knowledge base in this application.

[0046] Figure 2 This is a schematic diagram of a comparison table of processing categories and elements of interest in an embodiment of this application;

[0047] Figure 3 This is a schematic diagram of a vocabulary list in an embodiment of this application;

[0048] Figure 4 This is a schematic diagram of another vocabulary list in an embodiment of this application;

[0049] Figure 5 This is a flowchart illustrating the implementation of another method for constructing an enterprise strategy language knowledge base in this application embodiment;

[0050] Figure 6 This is a structural block diagram of a device for constructing an enterprise strategy language knowledge base according to an embodiment of this application;

[0051] Figure 7 This is a structural block diagram of a device for constructing an enterprise strategy language knowledge base according to an embodiment of this application;

[0052] Figure 8 This is a schematic diagram of the specific structure of a device for constructing an enterprise strategy language knowledge base provided in this embodiment. Detailed Implementation

[0053] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] See Figure 1 , Figure 1 This is a flowchart illustrating an implementation method for constructing an enterprise strategy language knowledge base according to an embodiment of this application. The method may include the following steps:

[0055] S101: Obtain the actual business operations in the target company's privacy policy and determine the target personal information processing categories included in the actual business operations.

[0056] The target company's privacy policy includes actual business requirements. For example, when you register a game account, we need to collect your mobile phone number, login password, and login information (if you use WeChat, QQ, or Weibo to authorize login, we will collect your unique WeChat, QQ, and Weibo identifiers to save your login information so you can log in on different devices). Login passwords are considered sensitive information. We collect this information to help you complete the registration of your game account and protect your account security. If you do not provide this information, we will be unable to create an account for you and provide you with normal services.

[0057] The data processing categories in corporate regulations regarding the handling of personal information include data collection, data storage, data use / processing, data provision / sharing, data transmission, data disclosure, and data deletion. We need to obtain the actual business operations outlined in the target company's privacy policy and determine the specific personal information processing categories included within those operations. Continuing with the example above, its actual business operations include data collection as a target personal information processing category.

[0058] S102: Find the target attention elements corresponding to each target personal information processing category from the processing category and attention element comparison table.

[0059] See Figure 2 , Figure 2 This is a schematic diagram of a processing category and focus element comparison table in an embodiment of this application. The focus elements for each personal information processing category are different. The focus elements required by the strategy language for each personal information processing category are sorted out in advance, and a processing category and focus element comparison table is established in advance. After determining the target personal information processing categories included in the actual business, the target focus elements corresponding to each target personal information processing category are found in the processing category and focus element comparison table.

[0060] S103: Find the audit items corresponding to each target personal information processing category from the processing category and audit item comparison table.

[0061] Establish a pre-defined table of processing categories and audit items. For example, for the data collection category (personal information processing), the corresponding audit item could be the collection of sensitive personal information without separate consent. For the collection of sensitive personal information, confirm that separate consent has been obtained from the individual. For the data storage category (personal information processing), the corresponding audit item could be the lack of encryption and de-identification. The organization failed to take security measures such as encryption and de-identification when storing personal information, leading to its leakage. For the data use / processing category (personal information processing), the corresponding audit item could be the unreasonable use of legally disclosed personal information. The organization failed to use legally disclosed personal information within a reasonable scope. For the data provision / sharing category (personal information processing), the corresponding audit item could be providing information beyond the scope of consent. The provision of personal information exceeds the scope of the individual's consent. For the data transmission category (personal information processing), the corresponding audit item could be unauthorized and unapproved transmission. The organization failed to verify personal information, which may have been maliciously altered during transmission. For the data disclosure category (personal information processing), the corresponding audit item could be public disclosure without separate consent. The organization released the individual's personal information to the public or unspecified groups without their separate consent. For the personal information processing category of data deletion, the corresponding audit item can be the failure to proactively delete information. This means the organization failed to proactively and promptly delete relevant personal information.

[0062] After identifying the target personal information processing categories included in the actual business, find the corresponding audit items for each target personal information processing category from the table of processing categories and audit items.

[0063] S104: Construct a glossary corresponding to each objective focus element by combining each audit item and actual business.

[0064] After obtaining the actual business operations in the target company's privacy policy and finding the audit items corresponding to each category of personal information processing, a glossary corresponding to each target's focus elements is constructed by combining each audit item with the actual business operations.

[0065] See Figure 3 and Figure 4 , Figure 3 This is a schematic diagram of a vocabulary list in an embodiment of this application. Figure 4 This is a schematic diagram of another vocabulary list in an embodiment of this application. Continuing from the example in step S102, for the element of interest of personal information (data category), the constructed vocabulary list includes content such as identity information, mobile phone number, login information, WeChat, QQ, and Weibo. For the element of interest of processing activity (purpose), the constructed vocabulary list includes content such as login and registration.

[0066] S105: Construct a key-value strategy language based on the target focus elements and corresponding vocabularies for each target personal information processing category, and obtain the enterprise strategy language knowledge base.

[0067] Different personal information processing categories correspond to different strategy languages. After constructing the vocabulary corresponding to each target focus element, a key-value strategy language is constructed based on each target focus element of each target personal information processing category and the corresponding vocabulary, resulting in an enterprise strategy language knowledge base.

[0068] For example, according to a company's privacy policy, the specific policy language for audit items under the "data collection" category can be described in the following format:

[0069] {

[0070] "Data Category": ["Name", "ID Number"],

[0071] "Purpose": ["Purpose 1", "Purpose 2"],

[0072] "Data Processor": ["Enterprise"],

[0073] "Collection Method": ["Direct Collection"],

[0074] "Consent Method": ["Consent by proxy"],

[0075] Security Measures: [Audit on the Impact of Personal Information Security]

[0076] }

[0077] For example, according to a company's privacy policy, the audit policy for the "Data Usage / Processing" category can be described in the following format:

[0078] {

[0079] "Data Category": ["Name"],

[0080] "Purpose": ["Purpose"],

[0081] "Data Processor": ["Enterprise"],

[0082] "Usage / Processing Method": ["Query"],

[0083] "Usage / Processing Environment": ["Development Environment"],

[0084] Security Measures: ["Personal Information Security Impact Audit", "De-identification"]

[0085] }

[0086] By building a corporate strategy language knowledge base to audit corporate activities related to the processing of personal information, it is possible to effectively protect the rights and interests of personal information, standardize corporate processing of personal information, and promote the rational use of corporate personal information.

[0087] As can be seen from the above technical solution, by pre-establishing a comparison table of processing categories and key concerns, as well as a comparison table of processing categories and audit items, based on relevant regulations for enterprises' handling of personal information, after determining the actual business operations within the target enterprise's privacy policy for each target personal information processing category, the corresponding key concerns are found in the comparison table of processing categories and key concerns, and the corresponding audit items are found in the comparison table of processing categories and audit items. A vocabulary corresponding to each key concern is constructed by combining each audit item and the actual business operations. Based on the key concerns of each target personal information processing category and the corresponding vocabulary, a key-value policy language is constructed, resulting in an enterprise policy language knowledge base. This provides reliable and feasible analytical data for compliance audits of enterprises' handling of personal information. Before conducting compliance audits of enterprises' data processing activities, the actual processing activities of the enterprise are converted into policy language, and rule matching is performed with the relevant policy language in the knowledge base to obtain compliance audit analysis results. This significantly reduces the difficulty of compliance audits of enterprises' handling of personal information, saving manpower, time, and effort.

[0088] It should be noted that, based on the above embodiments, this application also provides corresponding improvement solutions. In subsequent embodiments, steps that are the same as or corresponding to those in the above embodiments can be referred to each other, and the corresponding beneficial effects can also be referred to each other. These improvements will not be elaborated upon in the following improved embodiments.

[0089] In one specific embodiment of this application, after step S105, the method may further include the following steps:

[0090] When changes to the actual business practices within a target company's privacy policy are detected, the company's policy language knowledge base is updated based on these changes.

[0091] Corporate privacy policies generally do not change frequently. If a corporate privacy policy does change, only the corresponding modifications to the corporate policy language knowledge base (CLP) are needed to reflect the changes in the actual business operations within the target company's privacy policy. When changes to the actual business operations within the target company's privacy policy are detected, the CLP is updated accordingly. By promptly updating the CLP based on these changes, a comprehensive audit of the company's activities related to the handling of personal information is ensured.

[0092] In one specific embodiment of this application, before updating the enterprise strategy language knowledge base according to the changes, the method may further include the following steps:

[0093] Step 1: Determine whether the changes include new personal information processing categories other than the target personal information processing categories, or reductions in the personal information processing categories of each target personal information processing category. If yes, proceed to Step 2; otherwise, do not process.

[0094] Step 2: Update the enterprise strategy language knowledge base according to the changes.

[0095] For ease of description, the two steps above can be combined for explanation.

[0096] Before updating the enterprise policy language knowledge base based on changes, it is first determined whether the changes include new personal information processing categories other than the target personal information processing categories, or reductions in the target personal information processing categories. If so, it indicates that the target personal information processing categories included in the actual business of the target enterprise privacy policy have changed, and the corresponding policy language has also changed. The enterprise policy language knowledge base is then updated based on the changes. If not, it indicates that the target personal information processing categories included in the actual business of the target enterprise privacy policy have not changed, and the corresponding policy language remains unchanged; no processing is required. By detecting changes in the actual business of the target enterprise privacy policy and determining whether the changes include new personal information processing categories other than the target personal information processing categories, or reductions in the target personal information processing categories, and then determining whether an update to the enterprise policy language knowledge base is necessary, invalid changes to the enterprise policy language knowledge base are avoided.

[0097] In one specific embodiment of this application, when it is determined that the changes include new personal information processing categories in addition to the target personal information processing categories, updating the enterprise strategy language knowledge base according to the changes may include the following steps:

[0098] Step 1: Find the corresponding new attention elements for the new personal information processing category from the table of processing categories and attention elements;

[0099] Step 2: Locate the new audit item corresponding to the newly added personal information processing category in the table of processing categories and audit items;

[0100] Step 3: Construct a new glossary for each newly added focus element by combining the new audit items and changes;

[0101] Step 4: Construct a new strategy language in key-value format based on each new focus element and corresponding new vocabulary for the new personal information processing category, and add the new strategy language to the enterprise strategy language knowledge base.

[0102] For ease of description, the four steps above can be combined for explanation.

[0103] When the changes involve new personal information processing categories beyond the existing target categories, it indicates a need to add policy language to the enterprise policy language knowledge base. The process involves retrieving the new attention elements corresponding to the new personal information processing categories from the processing category-attention element mapping table, and retrieving the new audit items corresponding to the new personal information processing categories from the processing category-audit item mapping table. Combining the new audit items and the changes, a new vocabulary list is constructed for each new attention element. Based on the new attention elements and corresponding new vocabulary lists for the new personal information processing categories, a key-value format policy language is constructed and added to the enterprise policy language knowledge base. This ensures timely updates of the policy language in the enterprise policy language knowledge base and guarantees comprehensive auditing of the enterprise's personal information processing activities.

[0104] In one specific embodiment of this application, when it is determined that the change includes a reduction in the personal information processing categories for each target personal information processing category, updating the enterprise strategy language knowledge base according to the change may include the following steps:

[0105] Search the Enterprise Strategy Language Knowledge Base for the strategy language corresponding to the reduction of personal information processing category, and delete the found strategy language from the Enterprise Strategy Language Knowledge Base.

[0106] When it is determined that the changes include reductions in the personal information processing categories of each target personal information processing category, it indicates that some policy language in the enterprise policy language knowledge base needs to be deleted. The policy language corresponding to the reduced personal information processing category is retrieved from the enterprise policy language knowledge base and then deleted. By promptly deleting the corresponding policy language from the enterprise policy language knowledge base after determining that the actual business changes in the target enterprise privacy policy include reductions in the personal information processing categories of each target personal information processing category, over-auditing of the enterprise's personal information processing activities is avoided.

[0107] In one specific embodiment of this application, after step S105, the method may further include the following steps:

[0108] Step 1: Obtain information about the target company's processing activities of personal information data, in accordance with the target company's privacy policy.

[0109] Step 2: Conduct a compliance audit of the company's operations using the Enterprise Strategy Language Knowledge Base.

[0110] For ease of description, the two steps above can be combined for explanation.

[0111] After constructing a knowledge base of corporate policy language, the system obtains information on the target company's handling of personal information data, in accordance with its privacy policy. The knowledge base is then used to conduct a compliance audit of these activities. This effectively protects the rights and interests of individuals, standardizes the handling of personal information by companies, and promotes the rational use of personal information.

[0112] See Figure 5 , Figure 5 This is a flowchart illustrating an implementation method for constructing an enterprise strategy language knowledge base in this application. The method may include the following steps:

[0113] S501: Obtain the actual business information in the target company's privacy policy.

[0114] S502: Label the personal information-related content and processing activities in actual business operations to obtain labeling information.

[0115] After obtaining the actual business operations in the target company's privacy policy, the personal information-related content and processing activities in the actual business operations are labeled to obtain labeled information.

[0116] Following the example of step S102 above, the labeled information may include: mobile phone number, login password, login information, WeChat, QQ, Weibo, login password, account registration, etc.

[0117] S503: Determine the categories of target personal information processing included in the actual business based on the labeled information.

[0118] After obtaining the annotation information, the categories of target personal information processing included in the actual business are determined based on the annotation information.

[0119] Following the examples above, actual business operations include data collection, a category of personal information processing.

[0120] By labeling the personal information-related content and processing activities in actual business operations, and determining the target personal information processing categories included in the actual business operations based on the labeling information, the convenience and accuracy of determining the target personal information processing categories included in the actual business operations are improved.

[0121] S504: Find the target's target attention elements corresponding to each target's personal information processing category from the processing category and attention element comparison table.

[0122] S505: Locate the audit item corresponding to each target personal information processing category from the processing category and audit item comparison table.

[0123] S506: Construct a glossary corresponding to each objective focus element by combining each audit item and actual business.

[0124] S507: Construct a key-value strategy language based on the target focus elements and corresponding vocabularies for each target information processing category, thus obtaining the enterprise strategy language knowledge base.

[0125] Corresponding to the above method embodiments, this application also provides an apparatus for constructing an enterprise strategy language knowledge base. The apparatus for constructing an enterprise strategy language knowledge base described below and the method for constructing an enterprise strategy language knowledge base described above can be referred to in correspondence with each other.

[0126] See Figure 6 , Figure 6 This is a structural block diagram of a device for constructing an enterprise strategy language knowledge base according to an embodiment of this application. The device may include:

[0127] Category determination module 61 is used to obtain the actual business of the target enterprise's privacy policy and determine the target personal information processing categories included in the actual business;

[0128] The element search module 62 is used to search for each target's personal information processing category and corresponding target interest elements from the processing category and interest element comparison table;

[0129] The audit item lookup module 63 is used to find the audit items corresponding to each target personal information processing category from the processing category and audit item comparison table;

[0130] The vocabulary building module 64 is used to build vocabulary lists corresponding to each target focus element by combining each audit item and actual business;

[0131] The knowledge base acquisition module 65 is used to construct a key-value strategy language based on the target attention elements and corresponding vocabularies of each target's personal information processing category, thereby obtaining an enterprise strategy language knowledge base.

[0132] As can be seen from the above technical solution, by pre-establishing a comparison table of processing categories and key concerns, as well as a comparison table of processing categories and audit items, based on relevant regulations for enterprises' handling of personal information, after determining the actual business operations within the target enterprise's privacy policy for each target personal information processing category, the corresponding key concerns are found in the comparison table of processing categories and key concerns, and the corresponding audit items are found in the comparison table of processing categories and audit items. A vocabulary corresponding to each key concern is constructed by combining each audit item and the actual business operations. Based on the key concerns of each target personal information processing category and the corresponding vocabulary, a key-value policy language is constructed, resulting in an enterprise policy language knowledge base. This provides reliable and feasible analytical data for compliance audits of enterprises' handling of personal information. Before conducting compliance audits of enterprises' data processing activities, the actual processing activities of the enterprise are converted into policy language, and rule matching is performed with the relevant policy language in the knowledge base to obtain compliance audit analysis results. This significantly reduces the difficulty of compliance audits of enterprises' handling of personal information, saving manpower, time, and effort.

[0133] In one specific embodiment of this application, the category determination module 61 includes:

[0134] The annotation information acquisition submodule is used to annotate personal information-related content and processing activities in actual business operations to obtain annotation information;

[0135] The category determination submodule is used to determine the categories of target personal information processing included in the actual business based on the annotation information.

[0136] In one specific embodiment of this application, the device may further include:

[0137] The knowledge base update module is used to update the enterprise policy language knowledge base after obtaining the enterprise policy language knowledge base, when changes are detected in the actual business of the target enterprise's privacy policy, based on the changes.

[0138] In one specific embodiment of this application, the device may further include:

[0139] The judgment module is used to determine whether the changes to the enterprise strategy language knowledge base include new personal information processing categories other than the target personal information processing categories or reduced personal information processing categories, before updating the enterprise strategy language knowledge base based on the changes.

[0140] The knowledge base update module is specifically designed to update the enterprise strategy language knowledge base when changes include the addition of new personal information processing categories in addition to the target personal information processing categories, or the reduction of personal information processing categories in the target personal information processing categories.

[0141] In one specific embodiment of this application, the knowledge base update module includes:

[0142] The new element search submodule is used to search for each new element of interest corresponding to the new personal information processing category from the processing category and element of interest comparison table when it is determined that the changed content includes a new personal information processing category other than the target personal information processing categories.

[0143] The newly added audit item search submodule is used to find the new audit item corresponding to the new personal information processing category from the processing category and audit item mapping table;

[0144] A new vocabulary building submodule is added, which is used to build new vocabulary lists for each newly added focus element by combining the new audit items and the changes.

[0145] The Strategy Language Addition Submodule is used to construct key-value pairs of new strategy languages ​​based on the newly added focus elements and corresponding new vocabularies of the newly added personal information processing categories, and add the new strategy languages ​​to the enterprise strategy language knowledge base.

[0146] In one specific embodiment of this application, the knowledge base update module is specifically a module that, when it is determined that the change content includes a reduction of the personal information processing category for each target personal information processing category, searches for the strategy language corresponding to the reduced personal information processing category in the enterprise strategy language knowledge base, and deletes the searched strategy language from the enterprise strategy language knowledge base.

[0147] In one specific embodiment of this application, the device may further include:

[0148] The Enterprise Processing Activity Acquisition Module is used to acquire the enterprise processing activities of the target enterprise regarding personal information data, which are governed by the target enterprise's privacy policy.

[0149] The compliance audit module is used to conduct compliance audits of corporate activities using a corporate strategy language knowledge base.

[0150] For the method embodiments described above, see [link to relevant documentation]. Figure 7 , Figure 7 A schematic diagram of the device for constructing the enterprise strategy language knowledge base provided in this application is shown. The device may include:

[0151] Memory 332 is used to store computer programs;

[0152] The processor 322 is configured to implement the steps of the method for constructing the enterprise strategy language knowledge base in the above method embodiment when executing a computer program.

[0153] For details, please refer to Figure 8 , Figure 8 This is a schematic diagram illustrating the specific structure of a device for building an enterprise strategy language knowledge base according to this embodiment. The device can vary significantly depending on its configuration or performance. It may include a processor (central processing unit, CPU) 322 (e.g., one or more processors) and a memory 332. The memory 332 stores one or more computer programs 342 or data 344. The memory 332 can be temporary or persistent storage. The program stored in the memory 332 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the data processing device. Furthermore, the processor 322 may be configured to communicate with the memory 332 and execute the series of instruction operations stored in the memory 332 on the enterprise strategy language knowledge base building device 301.

[0154] The device 301 for building the enterprise strategy language knowledge base may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341.

[0155] The steps in the construction method of the enterprise strategy language knowledge base described above can be implemented by the structure of the construction device for the enterprise strategy language knowledge base.

[0156] Corresponding to the above method embodiments, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the following steps:

[0157] Obtain the actual business operations within the target enterprise's privacy policy and determine the target personal information processing categories included in the actual business operations; find the target concern elements corresponding to each target personal information processing category from the processing category and concern element mapping table; find the audit items corresponding to each target personal information processing category from the processing category and audit item mapping table; construct a vocabulary for each target concern element by combining each audit item and the actual business operations; construct a key-value policy language based on each target concern element of each target personal information processing category and the corresponding vocabulary, thus obtaining the enterprise policy language knowledge base.

[0158] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0159] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0160] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatuses, devices, and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to in the method section.

[0161] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the technical solutions and core ideas of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for constructing an enterprise strategy language knowledge base, characterized in that, include: Obtain the actual business operations contained in the target company's privacy policy, and determine the target personal information processing categories included in the actual business operations; Find the target focus elements corresponding to each target personal information processing category from the processing category and focus element comparison table; the focus elements are different for each personal information processing category; sort out the focus elements required for the strategy language for each personal information processing category in advance, and establish a processing category and focus element comparison table in advance. After determining the target personal information processing categories included in the actual business, find the target focus elements corresponding to each target personal information processing category from the processing category and focus element comparison table. Find the audit item corresponding to each of the target personal information processing categories from the processing category and audit item comparison table; Construct a vocabulary for each of the aforementioned audit items and the aforementioned actual business processes, respectively; A key-value strategy language knowledge base is obtained by constructing a strategy language in key-value form based on the target focus elements and corresponding vocabularies for each target personal information processing category. Different personal information processing categories correspond to different strategy languages. After constructing the vocabularies corresponding to each target focus element, a key-value strategy language knowledge base is obtained by constructing a strategy language in key-value form based on the target focus elements and corresponding vocabularies for each target personal information processing category.

2. The method for constructing an enterprise strategy language knowledge base according to claim 1, characterized in that, The categories of target personal information processing included in the actual business operations are determined, including: The personal information-related content and processing activities in the actual business are labeled to obtain labeling information; The target personal information processing categories included in the actual business are determined based on the labeled information.

3. The method for constructing an enterprise strategy language knowledge base according to claim 1 or 2, characterized in that, After obtaining the enterprise strategy language knowledge base, it also includes: When changes are detected in the actual business operations of the target enterprise's privacy policy, the enterprise policy language knowledge base is updated according to the changes.

4. The method for constructing an enterprise strategy language knowledge base according to claim 3, characterized in that, Before updating the enterprise strategy language knowledge base according to the changes, the following steps are also included: Determine whether the changes include new personal information processing categories other than the target personal information processing categories or reduced personal information processing categories. If so, then perform the step of updating the enterprise strategy language knowledge base according to the changes.

5. The method for constructing an enterprise strategy language knowledge base according to claim 4, characterized in that, When it is determined that the changes include new personal information processing categories in addition to the aforementioned target personal information processing categories, the enterprise strategy language knowledge base is updated according to the changes, including: Find the newly added elements of interest corresponding to the newly added personal information processing category from the table of processing categories and elements of interest. Find the new audit item corresponding to the new personal information processing category from the table of processing categories and audit items; By combining the newly added audit items and the changes, a new vocabulary list corresponding to each of the newly added attention elements shall be constructed. Based on the newly added attention elements and corresponding newly added vocabularies of the newly added personal information processing category, construct a new strategy language in key-value form, and add the new strategy language to the enterprise strategy language knowledge base.

6. The method for constructing an enterprise strategy language knowledge base according to claim 4, characterized in that, When it is determined that the changes include a reduction of personal information processing categories for each of the target personal information processing categories, the enterprise strategy language knowledge base is updated according to the changes, including: Search the enterprise strategy language knowledge base for the strategy language corresponding to the reduced personal information processing category, and delete the found strategy language from the enterprise strategy language knowledge base.

7. The method for constructing an enterprise strategy language knowledge base according to claim 1, characterized in that, After obtaining the enterprise strategy language knowledge base, it also includes: Obtain information about the target company's processing activities of personal information data, which are subject to the target company's privacy policy. The enterprise policy language knowledge base is used to conduct compliance audits of the enterprise's processing activities.

8. A device for constructing an enterprise strategy language knowledge base, characterized in that, include: The category determination module is used to obtain the actual business in the target enterprise's privacy policy and determine the target personal information processing categories included in the actual business; The element lookup module is used to find the target focus elements corresponding to each target personal information processing category from the processing category and focus element comparison table. The focus elements are different for each personal information processing category. The focus elements required for the strategy language are sorted out in advance for each personal information processing category. The processing category and focus element comparison table is established in advance. After determining the target personal information processing categories included in the actual business, the module finds the target focus elements corresponding to each target personal information processing category from the processing category and focus element comparison table. The audit item lookup module is used to find the audit items corresponding to each of the target personal information processing categories from the processing category and audit item mapping table; The vocabulary building module is used to construct a vocabulary corresponding to each of the target concern elements by combining each of the audit items and the actual business; The knowledge base acquisition module is used to construct a key-value strategy language based on the target attention elements and corresponding vocabularies for each target personal information processing category, thereby obtaining an enterprise strategy language knowledge base. Different personal information processing categories correspond to different strategy languages. After constructing the vocabularies corresponding to each target attention element, the module constructs a key-value strategy language based on the target attention elements and corresponding vocabularies for each target personal information processing category, thereby obtaining an enterprise strategy language knowledge base.

9. A device for constructing an enterprise strategy language knowledge base, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the method for constructing an enterprise strategy language knowledge base as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for constructing an enterprise strategy language knowledge base as described in any one of claims 1 to 7.

Images