Data processing systems for central consent repository and related methods
A data processing central consent repository system may be configured to, for example: (1) identify a form used to collect one or more pieces of personal data, (2) determine a data asset of a plurality of data assets of the organization where input data of the form is transmitted, (3) add the data asset to the third-party data repository with an electronic link to the form, (4) in response to a user submitting the form, create a unique subject identifier to submit to the third-party data repository and, along with the form data provided by the user in the form, to the data asset, (5) submit the unique subject identifier and the form data provided by the user to the third-party data repository and the data asset, and (6) digitally store the unique subject identifier and the form data in the third-party data repository and the data asset.
1. A method comprising:
analyzing, by computing hardware, one or more pieces of computer code associated with a webform used to collect personal data to identify a software application configured to receive the personal data collected by the webform;
transmitting, by the computing hardware, an instruction to a consent repository to generate an electronic link at the consent repository associating the webform and the software application;
detecting, by the computing hardware, a submission of the webform and form data associated with the webform;
generating, by the computing hardware and based on the form data, a unique subject identifier for a user associated with the submission of the webform;
transmitting, by the computing hardware, an instruction to the consent repository causing the consent repository to store and associate the unique subject identifier and the form data;
transmitting, by the computing hardware, an instruction to the software application causing the software application to process and associate the unique subject identifier and the form data;
detecting, by the computing hardware, a request for access to personal data associated with the user and request data associated with the request;
determining, by the computing hardware and based on the request data, the unique subject identifier using the consent repository;
determining, by the computing hardware and based on the unique subject identifier and the form data, the software application using the consent repository;
retrieving, by the computing hardware and based on the unique subject identifier, the personal data from the software application; and
generating, by the computing hardware, a graphical user interface for display on a user device, the graphical user interface presenting the personal data.
2. The method of claim 1 , further comprising:
transmitting an instruction to the consent repository causing the consent repository to generate a data map comprising the unique subject identifier, an indication of the software application, and an electronic link associating the unique subject identifier and the indication of the software application.
3. The method of claim 2 , wherein determining the software application using the consent repository comprises determining the software application based on the unique subject identifier using the data map.
4. The method of claim 2 , wherein transmitting the instruction to the consent repository causing the consent repository to generate the data map comprises using an application programming interface to transmit the instruction to the consent repository causing the consent repository to generate the data map.
5. The method of claim 1 , wherein analyzing the webform to identify the software application comprises:
analyzing the webform to identify a processing activity associated with the webform; and
determining the software application based on the processing activity using a data map associated with the processing activity.
6. The method of claim 1 , wherein generating the unique subject identifier comprises:
determining that the consent repository does not store data associated with the user; and
in response to determining that the consent repository does not store the data associated with the user, generating the unique subject identifier.
7. The method of claim 1 , wherein generating the unique subject identifier comprises:
detecting browser data in a browser application executed on a user device, the browser data comprising user data; and
generating the unique subject identifier based on the user data.
8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
processing hardware communicatively coupled to the non-transitory computer-readable medium, wherein the processing hardware is configured to execute the instructions and thereby perform operations comprising:
scanning one or more pieces of computer code associated with a webform used to collect personal data to determine a destination server associated with a storage location identified in the one or more pieces of computer code to which the personal data collected by the webform is transmitted;
transmitting an instruction to a consent repository to generate an electronic link at the consent repository associating the webform and the destination server;
detecting a submission of the webform and form data associated with the webform;
determining a unique subject identifier for a user associated with the submission of the webform based on the form data;
transmitting an instruction to the consent repository causing the consent repository to store and associate the unique subject identifier and the form data;
transmitting an instruction to the destination server causing the destination server to store and associate the unique subject identifier and the form data;
detecting a request for access to personal data associated with the user and request data associated with the request;
determining the unique subject identifier based on the request data using the consent repository;
determining the destination server based on the unique subject identifier and the form data using the consent repository;
retrieving a subset of the personal data from the destination server based on the unique subject identifier; and
generating a graphical user interface for display on a user device, the graphical user interface presenting the personal data.
9. The system of claim 8 , wherein determining the unique subject identifier comprises:
determining that the consent repository stores data associated with the user; and
in response to determining that the consent repository stores the data associated with the user, retrieving the unique subject identifier from the consent repository.
10. The system of claim 8 , wherein detecting the request for access to the personal data comprises detecting browser data in a browser application executed on a user device, the browser data comprising the request data and a data subject parameter identifying the user.
11. The system of claim 8 , wherein detecting the submission of the webform and the form data comprises detecting browser data in a browser application executed on a user device, the browser data comprising the form data and indication of the submission of the webform.
12. The system of claim 8 , wherein the operations further comprise:
transmitting an instruction to the consent repository causing the consent repository to modify a data map associated with the unique subject identifier to include an indication of the destination server and an electronic link associating the unique subject identifier and the indication of the destination server.
13. The system of claim 12 , wherein the operations further comprise:
determining a second server based on the unique subject identifier using the data map; and
retrieving a second subset of the personal data from the second server based on the unique subject identifier.
14. The system of claim 8 , wherein generating the graphical user interface comprises:
generating the graphical user interface for a browser application executed on a user device by configuring a display element configured to display the personal data on the graphical user interface; and
transmitting an instruction to the browser application causing the browser application to retrieve the personal data and present the graphical user interface on the user device.
15. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations comprising:
analyzing one or more pieces of computer code associated with a webform used to collect personal data to identify a database configured to receive the personal data collected by the webform;
transmitting an instruction to a consent repository to generate an electronic link at the consent repository associating the webform and the database;
detecting a submission of the webform and form data associated with the webform, the form data comprising consent data;
determining a unique subject identifier for a user associated with the submission of the webform based on the form data;
transmitting an instruction to the consent repository causing the consent repository to store and associate the unique subject identifier and the form data;
transmitting an instruction to the database causing the database to store and associate the unique subject identifier and the form data;
receiving a request for access to personal data associated with the user and request data associated with the request;
determining the unique subject identifier using the consent repository based on the request data;
determining the database using the consent repository based on the unique subject identifier and the form data;
retrieving the personal data from the database based on the unique subject identifier; and
generating a graphical user interface for display on a user device, the graphical user interface presenting the personal data.
16. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
transmitting an instruction to the consent repository causing the consent repository to generate a data inventory comprising the unique subject identifier, an indication of the database, the consent data, and an electronic link associating the unique subject identifier, the consent data, and the indication of the database.
17. The non-transitory computer-readable medium of claim 16 , wherein determining the database using the consent repository comprises determining the database based on the unique subject identifier using the data inventory.
18. The non-transitory computer-readable medium of claim 16 , wherein:
retrieving the personal data from the database comprises determining the consent database based on the unique subject identifier using the data inventory; and
retrieving the personal data from the database is further based on the consent data.
19. The non-transitory computer-readable medium of claim 15 , wherein generating the graphical user interface comprises:
generating the graphical user interface for a browser application executed on a user device based on the consent data by configuring a first display element configured to display the personal data on the graphical user interface and excluding a second display element configured to display a denial of access to the personal data from the graphical user interface; and
transmitting an instruction to the browser application causing the browser application to retrieve the personal data and present the graphical user interface on the user device.
20. The non-transitory computer-readable medium of claim 15 , wherein detecting the submission of the webform and form data comprises detecting browser data in a browser application executed on a user device, the browser data comprising the consent data.