Systems and methods for protecting data using a personal data store controlled by the data subject

A system comprising:

• a memory device;
• and
• a processing device coupled to the memory device, the processing device to perform operations comprising:
• receiving a request to provide an entity with access to data associated with a user;
• responsive to receiving an indication of user approval of the request, sending a response package to the entity, wherein the response package comprises a reference to a location of the data within a data store controlled by the user, an obscured version of the data, and an access key associated with the data store;
• receiving the reference to the location of the data and the access key from the entity;
• authenticating the entity using the access key;
• obtaining the data from the data store using the location of the data within the data store;
• and
• providing the data to the entity.

A non-transitory computer-readable storage medium comprising instructions for a server that, when executed by a processing device, cause the processing device to perform operations comprising:

• receiving a request to provide an entity with access to data associated with a user;
• generating a reference to the data within a data store controlled by the user and an access key associated with the data store, wherein the reference to the data indicates a location of the data within the data store;
• upon receiving an indication of user approval of the request, sending a response package to the entity, wherein the response package comprises the reference to the location of the data, an obscured version of the data, and the access key;
• obtaining the data from the data store using the reference to the location of the data and the access key provided by the entity to obtain the data;
• and
• providing the data to the entity.