A system for managing personal data stored by an enterprise includes an interface, a permissions database, a processor, and non-transitory computer readable media. The interface is configured to receive a request to access at least some of the personal data, the request defining a purpose for the request. The permissions database that stores a plurality of records that define permissions associated with the personal data. The non-transitory computer readable media in communication with the processor that stores instruction code which, when executed by the processor, causes the processor to locate, within one or more disparate source databases within the enterprise, personal data associated with one or more individuals. For each individual, the processor generates a record in the permissions database that relates the individual to: a) attributes of the personal data; b) legal grounds information that defines process rights; c) one or more purposes for which the personal data may be used; and d) constraint information that defines limitations on the individual to modify or delete the personal data. The processor selects one or more records associated with a purpose that matches the purpose of the request. The processor retrieves personal data associated with attributes of the one or more records from the one or more disparate source databases. The processor then communicates, via the interface, the retrieved personal data to a requestor associated with the request.