A computer-implemented method of securely controlling access to data, the method performed using a consolidation server, the method comprising: receiving, from a first issuer server, first encrypted data comprising a user device identifier, ID, a first application, app, ID for a first app stored on a user device, and a first account ID for a first account issued by the first issuer, indicating authorisation for the first app to access data relating to the first account; receiving, from a second issuer server, second encrypted data comprising the user device ID, a second app ID for a second app stored on the user device, and a second account ID for a second account issued by the second issuer, indicating authorisation for the second app to access data relating to the second account; creating and securely storing a consolidated file labelled by the user device ID, the consolidated file comprising: a first record comprising the first app ID and the first account ID, and a second record comprising the second app ID and the second account ID; transmitting third encrypted data, comprising the consolidated file, to the user device; receiving fourth encrypted data, comprising the user device ID, the first app ID, and the first account ID, indicating a request to modify the first record from the user device; and responsive thereto: modifying the first record in the consolidated file according to the request to modify the first record and securely storing a resulting modified first record on the consolidation server; and transmitting to the first issuer server fifth encrypted data, comprising the first app ID and the first account ID, indicating an instruction to modify the first app's access rights to data relating to the first account according to the request. receiving, from a first issuer server, first encrypted data comprising a user device identifier, ID, a first application, app, ID for a first app stored on a user device, and a first account ID for a first account issued by the first issuer, indicating authorisation for the first app to access data relating to the first account; receiving, from a second issuer server, second encrypted data comprising the user device ID, a second app ID for a second app stored on the user device, and a second account ID for a second account issued by the second issuer, indicating authorisation for the second app to access data relating to the second account; creating and securely storing a consolidated file labelled by the user device ID, the consolidated file comprising: a first record comprising the first app ID and the first account ID, and a second record comprising the second app ID and the second account ID; transmitting third encrypted data, comprising the consolidated file, to the user device; receiving fourth encrypted data, comprising the user device ID, the first app ID, and the first account ID, indicating a request to modify the first record from the user device; and a first record comprising the first app ID and the first account ID, and a second record comprising the second app ID and the second account ID; transmitting third encrypted data, comprising the consolidated file, to the user device; receiving fourth encrypted data, comprising the user device ID, the first app ID, and the first account ID, indicating a request to modify the first record from the user device; and modifying the first record in the consolidated file according to the request to modify the first record and securely storing a resulting modified first record on the consolidation server; and transmitting to the first issuer server fifth encrypted data, comprising the first app ID and the first account ID, indicating an instruction to modify the first app's access rights to data relating to the first account according to the request.