A method for managing access to data, the data being associated with metadata, one predetermined access policy for accessing the metadata including, for each of at least one client, one identifier relating to each of the at least one client; wherein the predetermined access policy includes, for each of the at least one client, one predetermined associated authentication policy, the predetermined associated authentication policy including at least one requirement of a predetermined client authentication to access the metadata and at least one corresponding predetermined reference client authentication data item, wherein the method comprises: - a) receiving, by an entity, from a client device, a data access request for accessing the data, the data access request including one identifier relating to a requesting client; - b) identifying, by the entity, based on the identifier relating to the requesting client, the predetermined associated authentication policy; - c) sending, by the entity, to the client device, based on the predetermined associated authentication policy, a request to submit at least one client authentication data item; - d) receiving, by the entity, at least one submitted client authentication data item; - e) authenticating, as an authentication step, by the entity, the requesting client, based on at least one submitted client authentication data item, by using the at least one corresponding predetermined reference client authentication data item respectively, according to the predetermined associated authentication policy; thus determining at least one authentication result - f) determining, by the entity, based on the predetermined access policy, whether the metadata access is or is not authorized, as an access decision; - g) generating on the fly, by the entity, only if the metadata access is authorized, based on the predetermined access policy, an associated first key, as first data allowing to access the metadata using a key derivation function, the key derivation function being dependent on the identifier relating to the requesting client and a user credential of the at least one submitted client authentication data item - h) accessing, by the entity, based on the generated first data, the metadata; - i) accessing, by the entity, based on the accessed metadata and the predetermined access policy, at least a part of the data being associated with the metadata as a late dynamic binding of the metadata with the at least a part of the data being associated with the metadata. - a) receiving, by an entity, from a client device, a data access request for accessing the data, the data access request including one identifier relating to a requesting client; - b) identifying, by the entity, based on the identifier relating to the requesting client, the predetermined associated authentication policy; - c) sending, by the entity, to the client device, based on the predetermined associated authentication policy, a request to submit at least one client authentication data item; - d) receiving, by the entity, at least one submitted client authentication data item; - e) authenticating, as an authentication step, by the entity, the requesting client, based on at least one submitted client authentication data item, by using the at least one corresponding predetermined reference client authentication data item respectively, according to the predetermined associated authentication policy; thus determining at least one authentication result - f) determining, by the entity, based on the predetermined access policy, whether the metadata access is or is not authorized, as an access decision; - g) generating on the fly, by the entity, only if the metadata access is authorized, based on the predetermined access policy, an associated first key, as first data allowing to access the metadata using a key derivation function, the key derivation function being dependent on the identifier relating to the requesting client and a user credential of the at least one submitted client authentication data item - h) accessing, by the entity, based on the generated first data, the metadata; - i) accessing, by the entity, based on the accessed metadata and the predetermined access policy, at least a part of the data being associated with the metadata as a late dynamic binding of the metadata with the at least a part of the data being associated with the metadata.