Data processing systems and methods for populating and maintaining a centralized database of personal data
A centralized data repository system, in various embodiments, is configured to provide a central data-storage repository (e.g., one or more servers, databases, etc.) for the centralized storage of personally identifiable information (PII) and/or personal data for one or more particular data subjects. In particular embodiments, the centralized data repository may enable the system to populate one or more data models (e.g., using one or more suitable techniques described above) substantially on-the-fly (e.g., as the system collects, processes, stores, etc. personal data regarding a particular data subject). In this way, in particular embodiments, the system is configured to maintain a substantially up-to-date data model for a plurality of data subjects (e.g., each particular data subject for whom the system collects, processes, stores, etc. personal data).
1. A computer-implemented data processing method for maintaining a centralized repository of personal data collected, stored, or processed, by a first party data system, the method comprising:
receiving, by one or more processors, an indication that the first party data system has collected, stored, or processed a new piece of personal data;
identifying, by one or more processors, a data subject associated with the new piece of personal data;
determining, by one or more processors, based at least in part on the new piece of personal data, whether computer memory associated with the centralized repository of personal data currently stores any personal data associated with the data subject identified by the new piece of personal data;
in response to determining that the computer memory associated with the centralized repository of personal data currently stores personal data associated with the data subject:
accessing, by one or more processors, a storage location of one or more unique identifiers within computer memory associated with the centralized repository of personal data;
determining, by one or more processors, a unique identifier of the one or more unique identifiers associated with the data subject stored by the centralized repository of personal data;
digitally storing, by one or more processors, to computer memory associated with the centralized repository of personal data, an indication of a storage location of the new piece of personal data within the first party system; and
electronically associating, in computer memory, the storage location of the new piece of personal data with the unique identifier associated with the data subject stored by the centralized repository of personal data;
in response to determining that the computer memory associated with the centralized repository of personal data does not currently store personal data associated with the data subject:
generating the unique identifier for the data subject;
digitally storing, by one or more processors, to computer memory associated with the centralized repository of personal data, an indication of a storage location of the new piece of personal data within the first party system; and
electronically associating, in computer memory, the storage location of the new piece of personal data with the unique identifier associated with the data subject stored by the centralized repository of personal data;
providing a user interface for initiating a transaction between an entity associated with the first party system and the data subject;
receiving a request to initiate the transaction between the entity and the data subject;
in response to the request, generating, by a third party consent receipt management server, a unique consent receipt key;
receiving, from the data subject, a unique subject identifier;
electronically storing the unique subject identifier, the unique consent receipt key, and a unique transaction identifier associated with the transaction in computer memory;
electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier; and
in response to receiving the request, transmitting a consent receipt to the data subject, the consent receipt comprising at least the unique subject identifier and the unique consent receipt key.
2. The computer-implemented data processing method of claim 1 , wherein storing the indication of the new piece of personal data comprises electronically storing a copy of the new piece of personal data in computer memory.
3. The computer-implemented data processing method of claim 1 , wherein receiving the indication that the first party data system has collected, stored, or processed the new piece of personal data comprises receiving the indication via one or more application programming interfaces.
4. The computer-implemented data processing method of claim 1 , the method further comprising:
in response to receiving the indication that the first party data system has collected, stored, or processed the new piece of personal data and identifying the data subject, accessing a consent receipt management system;
determining, based at least in part on the new piece of personal data and data received from the consent receipt management system, whether the data subject has provided valid consent for the collection, storage, and processing of a type of the new piece of personal data for the purpose for which the new piece of personal data was collected, stored, or processed by the first party system;
in response to determining that the data subject has provided valid consent, storing the indication of the new piece of personal data; and
in response to determining that the data subject has not provided valid consent, not storing the indication of the new piece of personal data.
5. The computer-implemented data processing method of claim 1 , wherein the unique identifier is a unique identifier selected from the group consisting of:
the unique subject identifier;
the unique consent receipt key; and
the unique transaction identifier.
6. The computer-implemented data processing method of claim 1 , wherein:
the transaction comprises processing, by the entity, one or more pieces of personal data associated with the data subject;
the user interface displays information identifying the one or more pieces of personal data; and
the new piece of personal data comprises at least one of the one or more pieces of personal data.
7. The computer-implemented data processing method of claim 1 , further comprising populating the centralized repository of personal data with one or more pieces of past personal data collected and stored by the first party data system by:
generating, by one or more processors, a data inventory for one or more data assets or one or more processing activities used in the collection or storage of personal data;
digitally storing, by one or more processors, the data inventory in computer memory;
modifying, by one or more processors, the data inventory to include one or more data fields that each define a respective data inventory attribute of a plurality of data inventory attributes;
determining, by one or more processors, which of the one or more data fields are unpopulated data fields;
determining, by one or more processors, a respective data inventory attribute value for each of the unpopulated data fields;
in response to determining the respective data inventory attribute value for each of the unpopulated data fields, modifying each of the unpopulated data fields to include the respective data inventory attribute value;
storing the modified data inventory in computer memory;
electronically linking, by one or more processors, each respective data inventory attribute to each of:
an associated respective question of a plurality of questions in a template; and
an associated respective data field of the unpopulated data fields;
storing, by one or more processors, an indication of the electronic linking in computer memory;
creating, by one or more processors, an assessment based at least in part on the template, the assessment comprising the plurality of questions;
receiving, by one or more processors, from a user, one or more responses to the assessment comprising a respective response to each of the plurality of questions;
filling, by one or more processors, the unpopulated data fields based at least in part on the respective response to each of the plurality of questions, the associated respective question, and the associated respective data field;
storing, by one or more processors, the data inventory along with the filled data fields in computer memory;
indexing the data inventory by data subject; and
electronically associating the indexed data inventory with the centralized repository of personal data.
8. The computer-implemented data processing method of claim 1 , further comprising:
receiving, by one or more processors, from the data subject, a data subject access request,
processing the data subject access request by identifying one or more pieces of personal data associated with the data subject, by:
determining the unique identifier associated with the data subject based on the request; and
scanning the central repository of personal data using the unique identifier to identify the one or more pieces of personal data;
in response to identifying the one or more pieces of personal data, taking one or more actions selected from the group consisting of:
deleting the one or more pieces of personal data from the centralized repository of personal data;
modifying at least one of the one or more pieces of personal data and storing the modified at least one of the one or more pieces of personal data in the centralized repository of personal data; and
generating a report comprising the one or more pieces of personal data and providing the report to the data subject.
9. A computer-implemented data processing method of generating and maintaining a third party data repository system on behalf of one or more entities, the method comprising:
receiving, from a first entity, a request to generate a third party repository of personal data on behalf of the first entity;
in response to receiving the request, generating a personal data inventory for the first entity;
generating, by one or more processors, for each of a plurality of data subjects about whom the first entity collects, stores, or processes personal data, a respective unique identifier;
digitally storing, by one or more processors, each respective unique identifier in computer memory;
electronically associating each respective unique identifier with the first entity;
receiving, at a third party data repository server, an indication that a piece of personal data has been processed for a particular data subject by the first entity;
in response to receiving the indication:
identifying the respective unique identifier associated with the particular data subject;
electronically storing, in the personal data inventory, a storage location within a storage system of the first entity of the piece of personal data; and
electronically associating the storage location within the storage system of the first entity of the piece of personal data and the unique identifier in the personal data inventory;
providing a user interface for initiating the particular transaction between the first entity and the particular data subject;
receiving, from the particular data subject, a request to initiate the particular transaction;
in response to the request, generating, by a third party consent receipt management server, a unique consent receipt key;
receiving, from the particular data subject, a unique subject identifier;
electronically storing the unique subject identifier, the unique consent receipt key, and a unique transaction identifier associated with the particular transaction in computer memory;
electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier; and
in response to receiving the request, transmitting a consent receipt to the data subject, the consent receipt comprising at least the unique subject identifier and the unique consent receipt key.
10. The computer-implemented data processing method of claim 9 , the method further comprising:
determining, based at least in part on the piece of personal data, a processing activity associated with the piece of personal data;
identifying, using a consent receipt management system, a particular transaction based at least in part on the processing activity and the piece of personal data;
determining, based at least in part on the particular transaction, whether the data subject has provided valid consent for the collection, by the first entity, of the first piece of personal data; and
in response to determining that the data subject has not provided valid consent for the collection of the piece of personal data, deleting the copy of the first piece of personal data from the personal data inventory.
11. The computer-implemented data processing method of claim 9 , wherein the third party data repository system comprises the third party consent receipt management server.
12. The computer-implemented data processing method of claim 9 , wherein:
the particular transaction comprises processing, by the first entity, one or more pieces of personal data associated with the particular data subject;
the user interface displays information identifying the one or more pieces of personal data; and
the piece of personal data comprises at least one of the one or more pieces of personal data.
13. The computer-implemented data processing method of claim 12 , the method further comprising:
receiving, from the particular data subject, a request to rescind consent for the particular transaction,
in response to receiving the request:
electronically disassociating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier;
identifying, based on the unique identifier associated with the particular data subject, a location of the piece of personal data; and
deleting the copy of the piece of personal data from the personal data inventory.
14. The computer-implemented data processing method of claim 9 , further comprising populating the personal data inventory with data previously collected by one or more systems associated with the first entity, wherein populating the personal data inventory comprises:
connecting, by one or more processors, via one or more computer networks, to the one or more systems associated with the first entity;
scanning, by one or more processors, the one or more systems associated with the first entity to generate a catalog of the plurality of data subjects and one or more pieces of personal information associated with the plurality of data subjects;
storing the catalog in computer memory;
scanning one or more data repositories in the one or more systems associated with the first entity based at least in part on the generated catalog to identify one or more attributes of data associated with the plurality of data subjects by searching one or more data fields in the one or more databases for the one or more pieces of personal information;
analyzing and correlating the one or more attributes and metadata for the scanned one or more data repositories;
using one or more machine learning techniques to categorize one or more data elements from the generated catalog;
analyzing a flow of the data elements between the one or more data repositories and at least one known data asset;
categorizing the one or more data elements based on a confidence score;
receiving input from one or more users confirming or denying a categorization of the one or more data elements;
in response to receiving the input, modifying the confidence score; and
populating the personal data inventory with the one or more data elements based at least in part on the confidence score.
15. The computer-implemented data processing method of claim 14 , further comprising:
providing a software application for installation on a computing device that is networked with the one or more data repositories; and
providing a communication channel between one or more remote scanning servers and the software application, wherein:
the software application is configured to communicate with the one or more remote scanning servers through a firewall; and
the software application is configured to transmit the one or more attributes of data associated with the plurality of data subjects to the one or more remote scanning servers.
16. The computer-implemented data processing method of claim 9 , wherein:
the indication that the piece of personal data has been processed for the particular data subject is a first indication that a first piece of personal data has been processed for the particular data subject as part of a first processing activity; and
the method further comprises:
receiving, at the third party data repository server, a second indication that a second piece of personal data has been processed for the particular data subject by the first entity as part of a second processing activity; and
in response to receiving the second indication:
identifying the respective unique identifier associated with the particular data subject;
electronically storing, in the personal data inventory, a copy of the second piece of personal data; and
electronically associating the copy of the piece of personal data, the unique identifier, and the second processing activity in the personal data inventory.
17. The computer-implemented data processing method of claim 16 , further comprising:
receiving a plurality of indications that a plurality of pieces of personal data have been processed for a plurality of data subjects by the first entity; and
in response to receiving each of the plurality of indications:
identifying, for each respective piece of personal data, the respective unique identifier associated with a respective data subject of the plurality of data subjects identified by the respective piece of personal data;
electronically storing, in the personal data inventory, a copy of each respective piece of personal data; and
electronically associating the copy of each respective piece of personal data with the respective unique identifier in the personal data inventory.