Sensitive data compliance manager

A computer-implemented method comprising:

• receiving a specific item of personal identifying information (PII) of a data subject;
• using the received specific item of PII of the data subject, searching a database of PII held by an organization for instances of the specific item of PII of the data subject, wherein the database of PII identifies storage locations in which PII is held within an organizational computer network;
• determining a first storage location within the organizational computer network of an instance of the specific item of PII of the data subject found during the searching of the database of PII;
• searching the database of PII to find additional PII held at the first storage location;
• associating a specific item of additional PII held at the first storage location with the data subject, wherein the specific item of additional PII held at the first storage location is different than the received specific item of PII of the data subject;
• using the specific item of additional PII held at the first storage location, searching the database of PII for instances of the specific item of additional PII held at the first storage location;
• determining a second storage location within the organizational computer network of an instance of the specific item of additional PII held at the first storage location;
• searching the database of PII to find additional PII held at the second storage location;
• associating a specific item of additional PII held at the second storage location with the data subject, wherein the specific item of additional PII held at the second storage location is different than the specific item of additional PII held at the first storage location and the received specific item of PII of the data subject;
• and
• preparing a data subject profile including:
• the received specific item of PII of the data subject, the specific item of additional PII held at the first storage location and associated with the data subject, and the specific item of additional PII held at the second storage location and associated with the data subject.