# US 2021/0240849 A1 · Data processing systems and methods for populating and maintaining a centralized database of personal data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240849 A1 - Document ID: US20210240849A1 - Status: Published application - Kind: A1 - Application number: 17/234,205 - Filed: 2021-04-19 - Published: 2021-08-05 - Earliest claimed: 2016-06-10 - Assignees: OneTrust, LLC - Applicants: OneTrust, LLC - Inventors: Kabir A. Barday; Jonathan Blake Brannon; Jason L. Sabourin; Mihir S. Karanjkar; Kevin Jones; Richard A. Beaumont - Web page: https://patentgrep.com/patent/US20210240849A1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 16/22: Indexing; Data structures therefor; Storage structures - G06F 16/2365: {Ensuring data consistency and integrity} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A centralized data repository system, in various embodiments, is configured to provide a central data-storage repository (e.g., one or more servers, databases, etc.) for the centralized storage of personally identifiable information (PII) and/or personal data for one or more particular data subjects. In particular embodiments, the centralized data repository may enable the system to populate one or more data models (e.g., using one or more suitable techniques described above) substantially on-the-fly (e.g., as the system collects, processes, stores, etc. personal data regarding a particular data subject). In this way, in particular embodiments, the system is configured to maintain a substantially up-to-date data model for a plurality of data subjects (e.g., each particular data subject for whom the system collects, processes, stores, etc. personal data). ## Claims ### Claim 1 A method comprising: receiving, by computing hardware, an indication that a first party data system has collected, stored, or processed a new piece of personal data; identifying, by computing hardware, a data subject associated with the new piece of personal data; identifying, by computing hardware, based at least in part on the new piece of personal data, a processing activity associated with the new piece of personal data; generating, by computing hardware, based at least in part on the processing activity, a unique transaction identifier; receiving, by computing hardware from a consent receipt management system, an indication that the data subject has not provided valid consent for processing the new piece of personal data by the processing activity; at least partially in response to the indication that the data subject has not provided the valid consent for processing the new piece of personal data by the processing activity, obtaining, by computing hardware, a unique consent receipt key from the consent receipt management system; associating, by computing hardware in computer memory, the unique consent receipt key with the data subject and with the unique transaction identifier; requesting, by computing hardware, from the data subject, consent for processing the new piece of personal data by the processing activity; receiving, by computing hardware, from the data subject, the consent for processing the new piece of personal data by the processing activity; and at least partially in response to receiving the consent for processing the new piece of personal data by the processing activity: transmitting, by computing hardware to the consent receipt management system, the unique consent receipt key and the unique transaction identifier, and transmitting, by computing hardware to the centralized repository of personal data, the unique consent receipt key and the unique transaction identifier. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating, by computing hardware, a unique identifier associated with the data subject; and transmitting, by computing hardware, to the centralized repository of personal data, the unique identifier along with the unique consent receipt key and the unique transaction identifier. ### Claim 3 (depends on 2) The method of claim 2, wherein generating the unique identifier comprises generating, by computing hardware, the unique identifier using the unique consent receipt key. ### Claim 4 (depends on 2) The method of claim 2, wherein generating the unique identifier comprises generating, by computing hardware, the unique identifier using one or more pieces of personal data associated with the data subject. ### Claim 5 (depends on 2) The method of claim 2, further comprising: generating, by computing hardware, a consent receipt based at least in part on one or more of: (a) the unique identifier, (b) the unique consent receipt key, and (c) the unique transaction identifier; and transmitting, by computing hardware, the consent receipt to the data subject. ### Claim 6 (depends on 1) The method of claim 1, wherein requesting consent for processing the new piece of personal data by the processing activity comprises presenting, by computing hardware, the new piece of personal data to the data subject on a graphical user interface. ### Claim 7 (depends on 1) The method of claim 1, further comprising transmitting, by computing hardware, to the centralized repository of personal data, along with the unique consent receipt key and the unique transaction identifier, one or more of: (a) the new piece of personal data, and (b) an indication of a storage location of the new piece of personal data. ### Claim 8 A system comprising: computing hardware; computer memory; and a non-transitory computer-readable medium storing computer-executable instructions that, when executed by the computing hardware, cause the computing hardware to perform operations comprising: receiving a first indication that a data system has processed a new piece of personal data; identifying a data subject and a processing activity associated with the new piece of personal data; receiving a second indication from a consent receipt management system that the data subject has provided valid consent for processing the new piece of personal data; in response to receiving the second indication, generating a unique consent receipt key based on a consent receipt associated with the valid consent; determining a unique subject identifier for the data subject; associating the unique consent receipt key with the unique subject identifier and the new piece of personal data in the computer memory; and transmitting the unique consent receipt key and the unique subject identifier to a centralized repository of personal data. ### Claim 9 (depends on 8) The system of claim 8, wherein determining the unique subject identifier comprises determining the unique subject identifier based on the consent receipt in response to determining that the centralized repository of personal data does not currently store personal data associated with the data subject. ### Claim 10 (depends on 8) The system of claim 8, wherein determining the unique subject identifier comprises identifying the unique subject identifier from among one or more unique subject identifiers currently stored at the centralized repository of personal data. ### Claim 11 (depends on 8) The system of claim 8, the non-transitory computer-readable medium further storing computer-executable instructions that, when executed by the computing hardware, cause the computing hardware to perform operations comprising: receiving, from the data subject, a request for the new piece of personal data; determining, based at least in part on the request for the new piece of personal data, the unique subject identifier associated with the data subject; retrieving, based at least in part on the unique subject identifier associated with the data subject, the new piece of personal data; and transmitting the new piece of personal data to the data subject. ### Claim 12 (depends on 8) The system of claim 8, wherein receiving the first indication comprises receiving a request from the data subject to initiate a transaction associated with processing the new piece of personal data. ### Claim 13 (depends on 12) The system of claim 12, wherein the operations further comprise: determining a transaction identifier for the transaction in response to receiving the request; and transmitting the transaction identifier to the centralized repository of personal data along with the unique consent receipt key and the unique subject identifier. ### Claim 14 (depends on 13) The system of claim 13, wherein the transaction identifier is determined based on the consent receipt. ### Claim 15 (depends on 8) The system of claim 8, wherein transmitting the unique consent receipt key and the unique subject identifier to the centralized repository of personal further comprises transmitting, along with the unique consent receipt key and the unique subject identifier, one or more of: (a) the new piece of personal data, and (b) a third indication of a storage location of the new piece of personal data. ### Claim 16 A non-transitory computer-readable medium storing computer-executable instructions that, when executed by computing hardware, configure the computing hardware to perform operations comprising for: receiving, by computing hardware, a first indication that a data system has collected a new piece of personal data; identifying, by computing hardware, a data subject associated with the new piece of personal data; identifying, by computing hardware, a processing activity associated with the new piece of personal data; receiving, by computing hardware, a consent receipt from the data subject; receiving, by computing hardware, a second indication that the data subject has provided valid consent for processing the new piece of personal data by the processing activity; in response to receiving the second indication, determining, by computing hardware, a unique consent receipt key based on the consent receipt; determining, by computing hardware, a unique subject identifier for the data subject; associating, by computing hardware in a computer memory, the unique consent receipt key with the unique subject identifier; and transmitting, by computing hardware, the unique consent receipt key and the unique subject identifier to a centralized repository of personal data along with the unique consent receipt key and the unique transaction identifier, one or more of: (a) the new piece of personal data, and (b) a third indication of a storage location of the new piece of personal data. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein determining the unique subject identifier comprises determining, by computing hardware, the unique subject identifier based on the consent receipt. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein determining the unique consent receipt key comprises obtaining, by computing hardware, the unique consent receipt key from a consent receipt management system using the unique subject identifier. ### Claim 19 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein determining the unique subject identifier comprises: determining, by computing hardware, an identifier for the data subject; generating, by computing hardware, a hash value based on the identifier; and storing, by computing hardware in the computer memory, the hash value as the unique subject identifier. ### Claim 20 A data processing system comprising: processing detection means for receiving an indication that a data system has received a new piece of personal data; consent determination means for: identifying a data subject associated with the new piece of personal data, identifying a processing activity associated with the new piece of personal data, determining that the data subject has provided valid consent for processing the new piece of personal data, in response to determining that the data subject has provided the valid consent, accessing a consent receipt associated with the valid consent stored at a consent receipt management system, and determining a unique consent receipt key based on the consent receipt; subject identifier determination means for: determining a unique subject identifier for the data subject, and associating the unique consent receipt key with the unique subject identifier in the computer memory; centralized repository communications means for transmitting the unique consent receipt key and the unique subject identifier to a centralized repository of personal data; and personal data storage location identification means for transmitting, to the centralized repository of personal data, one or more of: (a) the new piece of personal data, and (b) an indication of a storage location of the new piece of personal data.