Supervision method and device for data compliance risk, supervision equipment and storage medium

Abstract

The embodiment of the invention provides a data compliance risk supervision method and device, supervision equipment and a storage medium, and relates to the technical field of data processing. Obtaining to-be-analyzed data corresponding to the to-be-supervised business in each to-be-supervised mechanism according to the first business parameter of each to-be-supervised business; performing compliance risk analysis on the to-be-analyzed data corresponding to the to-be-supervised services in the to-be-supervised institutions according to the risk identification algorithms corresponding to the to-be-supervised services, and obtaining risk identification results of the to-be-supervised services in the to-be-supervised institutions; and according to the risk identification result, determining a target to-be-supervised service in the target to-be-supervised mechanism having the non-compliance risk, and according to the first service parameter of the target to-be-supervised service, the mechanism parameter of the target to-be-supervised mechanism and the risk identification result corresponding to the target to-be-supervised service, generating a risk event. Therefore, the centralized management degree of the data compliance risk of different business scenes and the judgment efficiency of the data compliance risk can be improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data compliance risk supervision method, apparatus, supervision equipment and storage medium. Background Art

[0002] At present, data compliance supervision will identify data compliance risks, match a data processing process or a certain data with compliance rules, and determine whether the process has compliance risks. However, this method can only identify compliance risks for one process or one type of data at a time. For example, it can only determine whether the data collection process has compliance issues. It is impossible to centrally manage data compliance risks in different business scenarios. Therefore, there are problems such as low efficiency in compliance risk judgment and poor centralized management. Summary of the invention

[0003] In view of this, the purpose of this application is to provide a data compliance risk supervision method, apparatus, supervision equipment and storage medium to solve the problems of low compliance risk judgment efficiency and poor centralized management in the prior art.

[0004] In order to achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows: In a first aspect, the present application provides a data compliance risk supervision method, which is applied to a supervision device, wherein the supervision device stores at least one first business parameter corresponding to a business to be supervised and a risk identification algorithm corresponding to each of the businesses to be supervised, wherein each of the businesses to be supervised corresponds to at least one supervision institution to be supervised, and the method includes: According to the first business parameters of each of the businesses to be regulated, respectively, obtaining the data to be analyzed corresponding to the business to be regulated in each of the agencies to be regulated; According to the risk identification algorithms corresponding to the businesses to be regulated, respectively, compliance risk analysis is performed on the data to be analyzed corresponding to the businesses to be regulated in each of the institutions to be regulated, to obtain risk identification results of the businesses to be regulated in each of the institutions to be regulated; The target business to be regulated in the target regulatory agency that has the risk of non-compliance is determined according to the risk identification result, and a risk event is generated according to the first business parameter of the target business to be regulated, the institutional parameter of the target regulatory agency and the risk identification result corresponding to the target business to be regulated.

[0005] In an optional implementation manner, generating a risk event according to the first business parameter of the target business to be regulated, the institutional parameter of the target regulatory agency, and the risk identification result corresponding to the target business to be regulated includes: Inputting the first business parameter of the target business to be regulated and the risk identification result into a pre-stored plan generation model for processing to obtain a risk plan for the risk event; Generate an event view corresponding to the risk event according to the first business parameter of the target business to be regulated, the institutional parameter of the target institution to be regulated, and the risk identification result, and determine the risk operation user according to the institutional parameter of the target institution to be regulated and the risk identification result; The risk event is generated according to the risk plan, the event view, the risk operation user, the risk identification result, the first business parameter of the target business to be regulated, and the institutional parameters of the target institution to be regulated.

[0006] In an optional implementation manner, the supervision device further stores a correspondence between the supervisor authority of each supervisor and the supervisory agency to be supervised, and the method further includes: Determine the target regulator according to the target regulator corresponding to the risk event and the corresponding relationship; Sending the risk event to the target regulator so that the target regulator can handle the risk event; Obtain the processing result corresponding to the risk event uploaded by the target supervisor, and delete the risk event if the processing result indicates that the risk event has been successfully processed.

[0007] In an optional embodiment, the method further comprises: Obtaining an evaluation instruction; the evaluation instruction includes an evaluation time range and a second business parameter of at least one business to be evaluated, wherein each business to be evaluated corresponds to at least one institution to be evaluated; For each of the businesses to be evaluated, obtaining risk identification results and risk event processing data corresponding to each institution to be evaluated within the evaluation time range according to the second business parameters; Based on the risk identification results corresponding to each to-be-assessed institution within the assessment time range, the processing data of risk events and the preset assessment model, a risk assessment report for each to-be-assessed business and / or each to-be-assessed institution within the assessment time range is generated.

[0008] In an optional embodiment, the risk identification algorithm is generated by the following steps: Obtaining rule information corresponding to at least one rule uploaded by a user; Perform semantic analysis on the rule information according to a preset semantic analysis model to obtain risk points corresponding to each rule; Processing each of the risk points according to a preset risk identification model to obtain a risk identification algorithm corresponding to each of the risk points; In response to the user's binding operation, an association relationship between each of the risk identification algorithms and each of the businesses to be regulated is generated.

[0009] In an optional implementation, after performing semantic analysis on the rule information according to a preset semantic analysis model to obtain risk points corresponding to each rule, the method further includes: Generate a correlation map between each of the risk points and each of the rules.

[0010] In an optional embodiment, the method further comprises: Process each of the risk points according to a preset risk classification model to obtain a risk type corresponding to each of the risk points; The risk score of the risk point is calculated according to the rule score corresponding to each risk point and the risk score of the risk point; the risk score represents the risk level of the risk point.

[0011] In a second aspect, the present application provides a data compliance risk supervision device, which is applied to a supervision device, wherein the supervision device stores at least one first business parameter corresponding to a business to be supervised and a risk identification algorithm corresponding to each of the businesses to be supervised, wherein each of the businesses to be supervised corresponds to at least one supervision agency to be supervised, and the device includes: An acquisition module, used for acquiring the data to be analyzed corresponding to the business to be regulated in each of the to-be-regulated institutions according to the first business parameters of each of the to-be-regulated businesses; An analysis module, used to perform compliance risk analysis on the to-be-analyzed data corresponding to the to-be-regulated business in each of the to-be-regulated institutions according to the risk identification algorithms corresponding to the to-be-regulated businesses, and obtain risk identification results of the to-be-regulated businesses in each of the to-be-regulated institutions; A generation module is used to determine the target business to be regulated in the target institution to be regulated that has non-compliance risks based on the risk identification results, and generate a risk event based on the first business parameter of the target business to be regulated, the institutional parameters of the target institution to be regulated and the risk identification results corresponding to the target business to be regulated.

[0012] In a third aspect, the present application provides a supervision device, including a processor and a memory, wherein the memory stores a computer program that can be executed by the processor, and the processor can execute the computer program to implement any of the methods described in the aforementioned embodiments.

[0013] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements a method as described in any of the foregoing embodiments.

[0014] The data compliance risk supervision method, device, supervision equipment and storage medium provided in the embodiment of the present application can store at least one first business parameter corresponding to the business to be supervised and the risk identification algorithm corresponding to each business to be supervised, and each business to be supervised corresponds to at least one supervision agency, then the supervision equipment can obtain the data to be analyzed corresponding to the business to be supervised in each supervision agency according to the first business parameter of each supervision agency, and then perform compliance risk analysis on the data to be analyzed corresponding to the business to be supervised in each supervision agency according to the risk identification algorithm corresponding to each business to be supervised, so as to obtain the risk identification results of the business to be supervised in each supervision agency, on this basis, the supervision equipment can determine the target business to be supervised in the target supervision agency with non-compliance risk according to the risk identification result, and generate risk events according to the first business parameter of the target business to be supervised, the institutional parameters of the target supervision agency and the risk identification results corresponding to the target business to be supervised. Through this method, the supervision equipment can supervise the data compliance risks of multiple businesses to be supervised and multiple supervision agencies at the same time, so that the data compliance risks of different business scenarios can be centrally managed, the degree of centralized management can be improved, and the judgment efficiency of data compliance risks can also be improved.

[0015] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A block diagram of a monitoring device provided in an embodiment of the present application is shown; Figure 2 A schematic diagram of a process for supervising data compliance risks provided by an embodiment of the present application is shown; Figure 3 A functional module diagram of a data compliance risk supervision device provided in an embodiment of the present application is shown.

[0018] Icon: 10 - monitoring device; 100 - memory; 110 - processor; 120 - communication module; 200 - acquisition module; 210 - analysis module; 220 - generation module. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0020] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0021] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0022] Figure 1 For a block diagram of the monitoring device 10 provided in the embodiment of the present application, please refer to Figure 1 The supervisory device 10 includes a memory 100, a processor 110, and a communication module 120. The memory 100, the processor 110, and the communication module 120 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0023] The memory 100 is used to store computer programs or data that can be executed by the processor. The memory 100 can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc.

[0024] The processor 110 is used to read / write data or computer programs stored in the memory, and execute the computer program to implement the data compliance risk supervision method provided in the embodiment of the present application.

[0025] The communication module 120 is used to establish a communication connection between the monitoring device and other communication terminals through the network, and to send and receive data through the network.

[0026] Optionally, the supervision device may store at least one first service parameter corresponding to a service to be supervised and a risk identification algorithm corresponding to each service to be supervised, and each service to be supervised corresponds to at least one supervision agency to be supervised.

[0027] It should be understood that Figure 1 The structure shown is only a schematic diagram of the structure of the monitoring device. The monitoring device may also include Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0028] Next, the above Figure 1 The supervision device shown is the execution entity, and the data compliance risk supervision method provided in the embodiment of the present application is exemplarily introduced in combination with the flow chart.

[0029] Specifically, Figure 2 A flowchart of a method for supervising data compliance risks provided in an embodiment of the present application is shown in FIG. Figure 2 , the method can be implemented through steps S20 to S22.

[0030] Step S20: acquiring the data to be analyzed corresponding to the business to be regulated in each agency to be regulated according to the first business parameters of each business to be regulated.

[0031] Optionally, the monitoring device may obtain the data to be analyzed in real time.

[0032] Optionally, the first service parameter may include attribute parameters of the service to be regulated and agency parameters of the agency to be regulated corresponding to the service to be regulated.

[0033] In one possible implementation, the first business parameter may include the business name of the business to be regulated, the corresponding agency name to be regulated, the system name of the associated system, the corresponding data table name and field name, the data collection path to be analyzed, etc.

[0034] Optionally, the business to be supervised may be a data processing process, a manager's operation process or management activity, the data itself, etc. For example, the business to be supervised may be a data collection process, a data analysis process, a data transmission process, personal privacy data, cross-border data, a manager's unauthorized situation, etc.

[0035] Optionally, depending on the specific business to be supervised, the data to be analyzed may include log data, network data, business data itself, management data, and legal and regulatory data, etc.

[0036] In this embodiment, the electronic device can query the data of the corresponding regulatory agency in the associated system according to the data collection path to be analyzed in the first business parameter, and obtain the corresponding data to be analyzed according to the data table name and field name.

[0037] For example, if the business to be regulated is a data collection process for personal privacy data, the data to be analyzed may include all log data, management data, etc. in the process of the corresponding regulatory agency collecting personal privacy data of each user.

[0038] In this embodiment, the user may configure the first business data of the to-be-supervised business that needs to be supervised for data compliance risk in advance according to actual application conditions, and store the first business data in the supervision device.

[0039] Step S21 , performing compliance risk analysis on the data to be analyzed corresponding to the businesses to be regulated in each agency to be regulated according to the risk identification algorithms corresponding to the businesses to be regulated, and obtaining risk identification results for the businesses to be regulated in each agency to be regulated.

[0040] Optionally, the risk identification algorithm may be generated in advance and stored in an electronic device.

[0041] It is understandable that since the risks that may exist in each business to be regulated are different, the risk identification algorithms corresponding to each business to be regulated may also be different.

[0042] Optionally, considering that the format of the data to be analyzed directly obtained may be inconsistent with the format that can be recognized by the risk identification algorithm, in order to ensure the smooth execution of compliance risk analysis, the electronic device can also convert the format of the data to be analyzed obtained into a format that can be recognized by a preset risk identification algorithm.

[0043] Optionally, in order to avoid interference caused by possible duplicate data, the electronic device may also perform cleaning operations such as data screening on the data.

[0044] In this embodiment, the electronic device can determine the risk identification results of the businesses to be regulated in each regulated institution through compliance risk analysis.

[0045] Optionally, the risk identification result may include whether there are non-compliance risks in the business to be regulated in the regulatory agency, specific risk points, risk levels, etc.

[0046] Optionally, the risk level refers to the severity of the non-compliance risk, including high risk, medium risk, and low risk.

[0047] Step S22, determining the target business to be regulated in the target institution to be regulated that has non-compliance risk based on the risk identification result, and generating a risk event based on the first business parameter of the target business to be regulated, the institutional parameters of the target institution to be regulated, and the risk identification result corresponding to the target business to be regulated.

[0048] Optionally, after determining the target institution to be regulated and the target business to be regulated that have non-compliance risks, the supervision device may generate corresponding risk events so that the user can handle the risks in a timely manner.

[0049] In one example, if the business to be regulated includes a data collection process and a data transmission process, and the data collection process and the data transmission process both correspond to regulator 1 and regulator 2, the electronic device can respectively obtain the first data to be analyzed corresponding to the data collection process in regulator 1 and the second data to be analyzed corresponding to the data transmission process, as well as the third data to be analyzed corresponding to the data collection process in regulator 2 and the fourth data to be analyzed corresponding to the data transmission process.

[0050] In this example, the regulatory device can perform compliance risk analysis on the first data to be analyzed and the third data to be analyzed according to the risk identification algorithm corresponding to the data collection process, and perform compliance risk analysis on the second data to be analyzed and the fourth data to be analyzed according to the risk identification algorithm corresponding to the data transmission process, thereby obtaining the risk identification results of the data collection process and the data transmission process in the regulatory agency 1, as well as the risk identification results of the data collection process and the data transmission process in the regulatory agency 2.

[0051] In this example, if the risk identification result of the second data to be analyzed is non-compliant, it can be determined that there is a non-compliance risk in the data transmission process in the supervision agency 1. Therefore, the supervision device can generate a risk event for the data transmission process in the supervision agency 1 based on the first business parameters of the data transmission process, the institutional parameters of the supervision agency 1, and the risk identification result corresponding to the second data to be analyzed.

[0052] The data compliance risk supervision method provided by the embodiment of the present application can store at least one first business parameter corresponding to a business to be supervised and a risk identification algorithm corresponding to each business to be supervised in the supervision device, and each business to be supervised corresponds to at least one supervision agency to be supervised, then the supervision device can obtain the data to be analyzed corresponding to the business to be supervised in each supervision agency according to the first business parameter of each supervision agency, and then perform compliance risk analysis on the data to be analyzed corresponding to the business to be supervised in each supervision agency according to the risk identification algorithm corresponding to each business to be supervised, so as to obtain the risk identification results of the business to be supervised in each supervision agency, on this basis, the supervision device can determine the target business to be supervised in the target supervision agency with non-compliance risk according to the risk identification result, and generate risk events according to the first business parameter of the target business to be supervised, the institutional parameters of the target supervision agency and the risk identification results corresponding to the target business to be supervised. Through this method, the supervision device can supervise the data compliance risks of multiple businesses to be supervised and multiple supervision agencies at the same time, so that the data compliance risks of different business scenarios can be centrally managed, the degree of centralized management can be improved, and at the same time, the judgment efficiency of data compliance risks can also be improved.

[0053] Optionally, before supervising data compliance risks, the supervision device needs to first generate a risk identification algorithm and bind the business to be supervised with the risk identification algorithm.

[0054] In one possible implementation, when generating a risk identification algorithm, it is necessary to first determine the possible risk points.

[0055] Specifically, the supervision device can obtain rule information corresponding to at least one rule uploaded by the user, and perform semantic analysis on the rule information according to a preset semantic analysis model to obtain risk points corresponding to each rule, and then process each risk point according to the preset risk identification model to obtain a risk identification algorithm corresponding to each risk point.

[0056] Optionally, the rule may be some laws, regulations, rules and regulations for the business to be regulated, or may be a rule customized by the user according to actual application conditions.

[0057] In one possible implementation, the rules may include laws and regulations, industry norms, internal systems and treaty obligations. Among them, laws and regulations are laws and regulations with legal effect; industry norms refer to standards, specifications, guidelines, etc. set by industry organizations or social groups; internal systems refer to data management systems formulated by data management entities; treaty obligations refer to treaties, specifications, guidelines, etc. jointly observed or advocated by domestic and foreign organizations or associations.

[0058] In one possible implementation, the rule information may include a rule name, a rule type, an issuing agency, a rule introduction, and rule clauses.

[0059] Optionally, the electronic device may perform semantic analysis on the rule information according to a natural language processing algorithm, thereby obtaining risk points corresponding to each rule.

[0060] Optionally, the risk identification model may be a model generated by performing machine learning on risk point description information.

[0061] Optionally, the risk identification algorithm may include an algorithm name, an input data format, an output data format, and specific risk identification logic.

[0062] Optionally, since different risks may exist in different businesses to be regulated, that is, different businesses to be regulated may correspond to different risk points, the user also needs to determine the corresponding risk point according to the business to be regulated, so as to bind the business to be regulated with the risk identification algorithm corresponding to the risk point.

[0063] Specifically, the supervision device may also generate association relationships between various risk identification algorithms and various businesses to be supervised in response to a binding operation by the user.

[0064] In this embodiment, one business to be regulated may correspond to multiple risk identification algorithms, and each risk identification algorithm can be used to identify a risk point that may exist in the business to be regulated.

[0065] In an example, the data collection process may have risk points such as failure to obtain individual consent when collecting personal information, failure to fulfill the obligation to inform when collecting personal information, and collection of personal information beyond the scope. Therefore, the data collection process can be bound to the personal information authorization identification algorithm, the personal information processing notification content identification algorithm, the personal information collection scope identification algorithm, etc., to identify these risk points.

[0066] The data compliance risk supervision method provided in the embodiment of the present application is that the supervision device can determine the corresponding risk point and the risk identification algorithm corresponding to the risk point according to the rule information uploaded by the user. Therefore, compared with the prior art method that requires users to identify risk points and configure risk identification algorithms by themselves, it can further reduce labor costs and improve management efficiency.

[0067] Optionally, in order to facilitate users to understand the relationship between risk points and rules and simplify the process of locating risk points or rules, the supervision device can also generate an association map between each risk point and each rule after obtaining the risk point corresponding to each rule.

[0068] In this embodiment, the supervision device can generate the association graph through knowledge graph technology.

[0069] It can be understood that based on this, the user can perform association retrieval on risk points and rules through the association map, and can also understand the relationship between risk points and rules through the visual presentation of the association map.

[0070] Optionally, in order to further refine the relevant information of the risk point, the supervision device may also classify each risk point and calculate a risk score for each risk point.

[0071] Specifically, the supervision device can also process each risk point according to a preset risk classification model, obtain the risk type corresponding to each risk point, and calculate the risk score of the risk point according to the rule score corresponding to each risk point and the risk score of the risk point; the risk score represents the risk level of the risk point.

[0072] Optionally, the risk classification model may be a model generated by machine learning technology.

[0073] Optionally, the risk type may include a first type and a second type, and the second type may be a subtype of the first type.

[0074] In one example, the risk types may be as shown in Table 1.

[0075] Table 1 Risk Type Table

[0076] Optionally, the supervision device may calculate the risk score according to the rule score associated with the risk point and the consequence score corresponding to the risk point.

[0077] In a possible implementation, the risk score G can be calculated by the following formula: G=ax+by Among them, x represents the rule score associated with the risk point, y represents the consequence score corresponding to the risk point, a and b represent the rule weight and consequence weight respectively, and the sum of a and b is 1.

[0078] Optionally, the specific values ​​of a and b can be set by the user according to actual application conditions.

[0079] Optionally, the risk score may represent a risk level.

[0080] In one possible implementation, a score range may be set, with different score ranges corresponding to low risk, medium risk, and high risk, respectively.

[0081] Optionally, after determining the risk type and risk score of each risk point, the risk type and risk score may be bound to the risk point as attribute information of the risk point.

[0082] In this embodiment, the supervision device performs compliance risk analysis on the data to be analyzed corresponding to the businesses to be supervised in each supervision agency through a risk identification algorithm, and can directly output the result of whether the data to be analyzed has non-compliance risk.

[0083] In one example, the result can be represented by 0 or 1, for example, 0 represents the existence of non-compliance risk, and 1 represents the absence of non-compliance risk. In this embodiment, the supervision device can determine the risk point that may exist at this time based on the risk identification algorithm that outputs the result of non-compliance risk, and determine the corresponding risk type and risk score, that is, the risk level, based on the risk point.

[0084] In addition, the risk identification result may also include risk consequences, rule information associated with the risk point, and cases related to the risk point.

[0085] Optionally, the risk score may also be used to determine whether a risk warning needs to be issued.

[0086] In one possible implementation, if the regulatory device determines that a regulated business in a regulated institution has a non-compliance risk, and the risk score indicates that its risk level is high risk, it is necessary to issue a risk warning message to the relevant risk operation user or the regulated institution.

[0087] Optionally, the risk warning information may include information on the business to be regulated, risk identification results, and risk determination time.

[0088] It can be understood that the information of the business to be regulated here refers to the record corresponding to the agency to be regulated in the first business information of the business to be regulated.

[0089] Optionally, after determining the risk identification results of the businesses to be regulated in each institution to be regulated, the supervision device may also generate risk events for the target institutions to be regulated and the target businesses to be regulated that have non-compliance risks.

[0090] In this embodiment, the electronic device may generate a risk event according to the first service parameter of the target service to be regulated, the institution parameter of the target institution to be regulated, and the risk identification result corresponding to the target service to be regulated.

[0091] Specifically, the supervision device may input the first business parameter and the risk identification result of the target business to be supervised into a pre-stored plan generation model for processing to obtain a risk plan for the risk event.

[0092] Optionally, the plan generation model can be generated in advance based on machine learning technology.

[0093] Optionally, the risk plan refers to a recommended approach to the risk event.

[0094] In this embodiment, the supervision device can generate an event view corresponding to the risk event based on the first business parameters of the target business to be regulated, the institutional parameters of the target regulatory agency, and the risk identification results, and determine the risk operation user based on the institutional parameters of the target regulatory agency and the risk identification results.

[0095] Optionally, the institution parameters may include user parameters in the target institution to be supervised, an institution identifier of the target institution to be supervised, an institution type, and the like.

[0096] Optionally, the risk operation user may be a user who operates the non-compliant target business to be regulated in the target regulatory agency, or may be a person responsible for the target business to be regulated in the target regulatory agency, which may be determined based on actual circumstances.

[0097] Optionally, the event view can visually present the relevant data of the risk event in the form of a view, such as the regulatory agency, the business to be regulated, the risk point, etc. corresponding to the risk event. In this embodiment, the supervision device can generate a risk event based on the risk plan, the event view, the risk operation user, the risk identification result, the first business parameter of the target business to be regulated, and the institutional parameter of the target regulatory agency.

[0098] In a possible implementation manner, the risk event can be represented as a risk record.

[0099] In this embodiment, the risk event may include a risk plan, an event view, a risk operation user, a risk identification result, parameters corresponding to the target business to be regulated in the target institution to be regulated, and an event code.

[0100] Optionally, the parameter corresponding to the target business to be regulated in the target regulatory agency refers to the record corresponding to the target regulatory agency in the first business information of the target business to be regulated. The regulatory device can determine the parameter based on the first business parameter of the target business to be regulated and the agency parameter of the target regulatory agency.

[0101] Optionally, the supervision device may also generate a time code corresponding to the risk event according to a preset code generation logic to uniquely identify the risk event.

[0102] It is understandable that the risk event refers to a record of matters that need to be processed accordingly, and the event view refers to a monitoring view that can be displayed on a display screen. It is understandable that after a risk event is generated, a corresponding supervisor is required to process the risk event.

[0103] In this embodiment, the supervisory device may also store the correspondence between the supervisory authority of each supervisor and the agency to be supervised. It is understandable that different supervisors have different supervisory authority, so the correspondence between the supervisory authority of each supervisor and the agency to be supervised can actually form a hierarchical supervisory relationship between the supervisor and the agency to be supervised.

[0104] In an example, if the authority of regulator A is greater than that of regulators B, C and D, and a hierarchical relationship is formed between regulator A and regulators B, C and D, and regulator B corresponds to supervising regulator 1, regulator C corresponds to supervising regulator 2, and regulator D corresponds to supervising regulator 3, then regulator A corresponds to supervising regulator 1, regulator 2 and regulator 3.

[0105] Optionally, based on this, after generating a risk event, the regulatory device may determine the target regulator according to the target regulatory agency corresponding to the risk event and the corresponding relationship, and send the risk event to the target regulator so that the target regulator can handle the risk event.

[0106] In this embodiment, the risk event can be sent to the target regulator in the form of a pending matter.

[0107] Understandably, since different supervisors have different supervisor permissions, each supervisor can view the event view within his or her own authority.

[0108] Please continue to refer to the above example. Regulator B can view the event view corresponding to the regulatory agency 1, regulator C can view the event view corresponding to the regulatory agency 2, and regulator D can view the event view corresponding to the regulatory agency 3. Then regulator A can view the event views corresponding to regulatory agencies 1, 2, and 3.

[0109] Optionally, the target supervisor can refer to the risk plan and process the risk event in combination with the actual situation, and upload the corresponding processing results after the processing is completed. In this embodiment, the supervision device can obtain the processing results corresponding to the risk event uploaded by the target supervisor, and delete the risk event if the processing results indicate that the risk event has been successfully processed.

[0110] Optionally, the processing result may indicate whether the risk event is successfully processed, that is, whether the risk is successfully eliminated.

[0111] It is understandable that the supervision device may delete the risk event if the risk handling result indicates that the risk has been successfully eliminated.

[0112] Optionally, in order to further centrally manage various businesses to be regulated and various regulatory agencies to be regulated, the regulatory device may also evaluate the risk regulation situation over a period of time.

[0113] Optionally, the supervision device may evaluate the risk supervision status of one or more businesses to be supervised within a period of time, or may evaluate the risk supervision status of one or more institutions to be supervised within a period of time, and the specific settings may be made according to the specific situation.

[0114] In this embodiment, the supervision device can evaluate the risk supervision situation from multiple perspectives, such as evaluating the risk supervision situation from four dimensions: system norms, data processing, operation management, and supply chain management, and each dimension also includes multiple evaluation sub-dimensions.

[0115] For example, institutional norms may include assessment sub-dimensions such as personal information processing management system, personal information processing specifications, and data security management system; data processing may include assessment sub-dimensions such as data collection, data processing / use, data transmission / provision, and data storage / deletion; operations management may include assessment sub-dimensions such as organizational structure, personnel management, risk monitoring and disposal, risk assessment, emergency disposal, and compliance audit; supply chain management may include assessment sub-dimensions such as qualification review, entrusted processing procedures, and entrusted processing agreements.

[0116] Optionally, different evaluation models may be generated for different evaluation dimensions in advance, for example, one evaluation model may be generated for each evaluation sub-dimension, and then a corresponding evaluation model may be selected for evaluation according to specific evaluation requirements. In this embodiment, the supervision device may first obtain an evaluation instruction.

[0117] Optionally, the assessment instruction may be an assessment instruction issued by the user according to actual needs, or may be an assessment instruction pre-configured in the supervision device and executed periodically, such as evaluating the risk supervision status of the data collection process every one month.

[0118] Optionally, the evaluation instruction may include an evaluation time range and a second business parameter of at least one business to be evaluated, wherein each business to be evaluated corresponds to at least one institution to be evaluated.

[0119] Optionally, the second business parameter may include the institution parameters (such as the institution name), data acquisition path, associated system name, etc. of the institution to be evaluated.

[0120] In this embodiment, the supervision device can obtain the risk identification results and risk event processing data corresponding to each institution to be evaluated within the evaluation time range for each business to be evaluated according to the second business parameter, and generate a risk assessment report for each business to be evaluated and / or each institution to be evaluated within the evaluation time range based on the risk identification results and risk event processing data corresponding to each institution to be evaluated within the evaluation time range and a preset assessment model.

[0121] Optionally, the risk identification result may include a risk identification result indicating the presence of a non-compliance risk and a risk identification result indicating the absence of a non-compliance risk.

[0122] Optionally, the processing data of the risk event may include processing time, processing results, etc.

[0123] Optionally, the risk assessment report may include a report name or report number, an assessment time range, an overall compliance risk situation, assessment results corresponding to each assessment dimension, an assessment time, and improvement suggestions.

[0124] In addition, the risk assessment report may also include the detection coverage of data compliance risks, the total number of risk events, the occurrence rate of risk events, the success rate of risk event handling, the efficiency of risk event handling or the average processing time, etc.

[0125] Furthermore, the risk assessment report may also include a horizontal comparison result between different businesses to be regulated, or a horizontal comparison result between different devices to be regulated.

[0126] Optionally, after obtaining the risk assessment report, the supervisory device may send the risk assessment report to the corresponding supervisor based on the supervisory institution targeted by the risk assessment report, so that the supervisor can issue specific rectification opinions to the corresponding supervisory institution based on the improvement suggestions in the risk assessment report and the actual situation.

[0127] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing a data compliance risk supervision device is provided below. Optionally, the data compliance risk supervision device can adopt the above Figure 1 The device structure of the supervisory device is shown.

[0128] For further information, see Figure 3 , Figure 3 A functional module diagram of a data compliance risk supervision device provided in an embodiment of the present application. It should be noted that the basic principle and technical effects of the data compliance risk supervision device provided in this embodiment are the same as those of the above-mentioned embodiments. For the sake of brief description, for parts not mentioned in this embodiment, please refer to the corresponding contents in the above-mentioned embodiments. The data compliance risk supervision device includes: an acquisition module 200, an analysis module 210 and a generation module 220.

[0129] The acquisition module 200 is used to acquire the data to be analyzed corresponding to the services to be regulated in each of the institutions to be regulated according to the first service parameters of each of the services to be regulated.

[0130] It can be understood that the acquisition module 200 can be used to execute the above step S20.

[0131] The analysis module 210 is used to perform compliance risk analysis on the data to be analyzed corresponding to the businesses to be regulated in each agency to be regulated according to the risk identification algorithms corresponding to the businesses to be regulated, and obtain risk identification results for the businesses to be regulated in each agency to be regulated.

[0132] It can be understood that the analysis module 210 can be used to execute the above step S21.

[0133] The generation module 220 is used to determine the target business to be regulated in the target regulatory agency that has non-compliance risks based on the risk identification results, and generate a risk event based on the first business parameter of the target business to be regulated, the institutional parameters of the target regulatory agency, and the risk identification results corresponding to the target business to be regulated.

[0134] It can be understood that the generation module 220 can be used to execute the above step S22.

[0135] Optionally, the generation module 220 is also used to input the first business parameters of the target business to be regulated and the risk identification results into a pre-stored plan generation model for processing to obtain a risk plan for the risk event; generate an event view corresponding to the risk event according to the first business parameters of the target business to be regulated, the institutional parameters of the target regulatory agency and the risk identification results, and determine the risk operation user according to the institutional parameters of the target regulatory agency and the risk identification results; generate a risk event according to the risk plan, event view, risk operation user, risk identification results, the first business parameters of the target business to be regulated and the institutional parameters of the target regulatory agency.

[0136] Optionally, the generation module 220 is also used to determine the target regulator based on the target regulator corresponding to the risk event and the corresponding relationship; send the risk event to the target regulator so that the target regulator can process the risk event; obtain the processing result corresponding to the risk event uploaded by the target regulator, and delete the risk event if the processing result indicates that the risk event has been successfully processed.

[0137] Optionally, the generation module 220 is also used to obtain evaluation instructions; the evaluation instructions include an evaluation time range and a second business parameter of at least one business to be evaluated, wherein each business to be evaluated corresponds to at least one institution to be evaluated; for each business to be evaluated, the risk identification results and risk event processing data corresponding to each institution to be evaluated within the evaluation time range are obtained according to the second business parameter; based on the risk identification results and risk event processing data corresponding to each institution to be evaluated within the evaluation time range and a preset evaluation model, a risk assessment report for each business to be evaluated and / or each institution to be evaluated within the evaluation time range is generated.

[0138] Optionally, the data compliance risk supervision device also includes a risk module. Optionally, the risk module is used to obtain rule information corresponding to at least one rule uploaded by a user; perform semantic analysis on the rule information according to a preset semantic analysis model to obtain risk points corresponding to each rule; process each risk point according to a preset risk identification model to obtain a risk identification algorithm corresponding to each risk point; and generate an association relationship between each risk identification algorithm and each business to be supervised in response to a user's binding operation.

[0139] Optionally, the risk module is also used to generate a correlation map between each risk point and each rule.

[0140] Optionally, the risk module is also used to process each risk point according to a preset risk classification model to obtain the risk type corresponding to each risk point; calculate the risk score of the risk point according to the rule score corresponding to each risk point and the risk score of the risk point; the risk score represents the risk level of the risk point.

[0141] Optionally, the above modules can be stored in the form of software or firmware. Figure 1 The memory shown in the figure or fixed in the operating system (OS) of the supervisory device, and can be Figure 1 Meanwhile, the data and program codes required for executing the above modules can be stored in the memory.

[0142] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the data compliance risk supervision method provided in the embodiment of the present application can be implemented.

[0143] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0144] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0145] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0146] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data compliance risk supervision method, characterized in that: Applied to a supervision device, the supervision device stores at least one first service parameter corresponding to a service to be supervised and a risk identification algorithm corresponding to each service to be supervised, wherein each service to be supervised corresponds to at least one supervision institution to be supervised, and the method comprises: According to the first business parameters of each of the businesses to be regulated, respectively, obtaining the data to be analyzed corresponding to the business to be regulated in each of the agencies to be regulated; According to the risk identification algorithms corresponding to the businesses to be regulated, respectively, compliance risk analysis is performed on the data to be analyzed corresponding to the businesses to be regulated in each of the institutions to be regulated, to obtain risk identification results of the businesses to be regulated in each of the institutions to be regulated; The target business to be regulated in the target regulatory agency that has the risk of non-compliance is determined according to the risk identification result, and a risk event is generated according to the first business parameter of the target business to be regulated, the institutional parameter of the target regulatory agency and the risk identification result corresponding to the target business to be regulated.

2. The method according to claim 1, characterized in that The generating a risk event according to the first business parameter of the target business to be regulated, the institutional parameter of the target institution to be regulated, and the risk identification result corresponding to the target business to be regulated includes: Inputting the first business parameter of the target business to be regulated and the risk identification result into a pre-stored plan generation model for processing to obtain a risk plan for the risk event; Generate an event view corresponding to the risk event according to the first business parameter of the target business to be regulated, the institutional parameter of the target institution to be regulated, and the risk identification result, and determine the risk operation user according to the institutional parameter of the target institution to be regulated and the risk identification result; The risk event is generated according to the risk plan, the event view, the risk operation user, the risk identification result, the first business parameter of the target business to be regulated, and the institutional parameters of the target institution to be regulated.

3. The method according to claim 1, characterized in that The supervisory device also stores the corresponding relationship between the supervisory authority of each supervisor and the supervisory agency to be supervised. The method further includes: Determine the target regulator according to the target regulator corresponding to the risk event and the corresponding relationship; Sending the risk event to the target regulator so that the target regulator can handle the risk event; Obtain a processing result corresponding to the risk event uploaded by the target supervisor, and delete the risk event if the processing result indicates that the risk event has been successfully processed.

4. The method according to claim 1, characterized in that: The method further comprises: Obtaining an evaluation instruction; the evaluation instruction includes an evaluation time range and a second business parameter of at least one business to be evaluated, wherein each business to be evaluated corresponds to at least one institution to be evaluated; For each of the businesses to be evaluated, obtaining risk identification results and risk event processing data corresponding to each institution to be evaluated within the evaluation time range according to the second business parameter; Based on the risk identification results corresponding to each to-be-assessed institution within the assessment time range, the processing data of risk events and the preset assessment model, a risk assessment report for each to-be-assessed business and / or each to-be-assessed institution within the assessment time range is generated.

5. The method according to claim 1, characterized in that The risk identification algorithm is generated by the following steps: Obtaining rule information corresponding to at least one rule uploaded by a user; Perform semantic analysis on the rule information according to a preset semantic analysis model to obtain risk points corresponding to each rule; Processing each of the risk points according to a preset risk identification model to obtain a risk identification algorithm corresponding to each of the risk points; In response to the user's binding operation, an association relationship between each of the risk identification algorithms and each of the businesses to be regulated is generated.

6. The method according to claim 5, characterized in that After performing semantic analysis on the rule information according to a preset semantic analysis model to obtain risk points corresponding to each rule, the method further includes: Generate a correlation map between each of the risk points and each of the rules.

7. The method according to claim 5, characterized in that The method further comprises: Process each of the risk points according to a preset risk classification model to obtain a risk type corresponding to each of the risk points; The risk score of the risk point is calculated according to the rule score corresponding to each risk point and the risk score of the risk point; the risk score represents the risk level of the risk point.

8. A data compliance risk monitoring device, characterized in that: Applied to a supervision device, the supervision device stores at least one first service parameter corresponding to a service to be supervised and a risk identification algorithm corresponding to each service to be supervised, wherein each service to be supervised corresponds to at least one supervision institution to be supervised, and the device comprises: An acquisition module, used for acquiring the data to be analyzed corresponding to the business to be regulated in each of the to-be-regulated institutions according to the first business parameters of each of the to-be-regulated businesses; An analysis module, used to perform compliance risk analysis on the to-be-analyzed data corresponding to the to-be-regulated business in each of the to-be-regulated institutions according to the risk identification algorithms corresponding to the to-be-regulated businesses, and obtain risk identification results of the to-be-regulated businesses in each of the to-be-regulated institutions; A generation module is used to determine the target business to be regulated in the target institution to be regulated that has non-compliance risks based on the risk identification results, and generate a risk event based on the first business parameter of the target business to be regulated, the institutional parameters of the target institution to be regulated and the risk identification results corresponding to the target business to be regulated.

9. A monitoring device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor can execute the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images