A method for controlling access to encrypted files, the method comprising: storing, in a database, priority information for a plurality of applications and a plurality of file access policies that are associated with priority information for the plurality of applications, respectively, where the plurality of file access policies each specify a different rule for accessing an encrypted file, including: (i) providing access to the encrypted file, (ii) decrypting the encrypted file and providing access to a decrypted file, and (iii) blocking access to the encrypted file; detecting, by a hardware processor, a request from a first application to access the encrypted file; identifying, by the hardware processor, the first application that requested access to the encrypted file including identifying, in the database, a priority associated with the first application, and the file access policy associated with the priority of the first application; identifying, by the hardware processor, a second application started by the first application for accessing the requested file including identifying, in the database, a priority associated with the second application, and the file access policy associated with the priority of the second application; determining, by the hardware processor, which of a plurality of conditions has been satisfied, each condition being associated with a priority selection rule for determining the priority of the file access policy to be applied to the second application;selecting, by the hardware processor, the file access policy associated with the priority determined by the priority selection rule associated with the satisfied condition; and controlling, by the hardware processor, access to the encrypted file by the second application based on the rule specified in the selected file access policy. storing, in a database, priority information for a plurality of applications and a plurality of file access policies that are associated with priority information for the plurality of applications, respectively, where the plurality of file access policies each specify a different rule for accessing an encrypted file, including: (i) providing access to the encrypted file, (ii) decrypting the encrypted file and providing access to a decrypted file, and (iii) blocking access to the encrypted file; detecting, by a hardware processor, a request from a first application to access the encrypted file; identifying, by the hardware processor, the first application that requested access to the encrypted file including identifying, in the database, a priority associated with the first application, and the file access policy associated with the priority of the first application; identifying, by the hardware processor, a second application started by the first application for accessing the requested file including identifying, in the database, a priority associated with the second application, and the file access policy associated with the priority of the second application; determining, by the hardware processor, which of a plurality of conditions has been satisfied, each condition being associated with a priority selection rule for determining the priority of the file access policy to be applied to the second application;selecting, by the hardware processor, the file access policy associated with the priority determined by the priority selection rule associated with the satisfied condition; and controlling, by the hardware processor, access to the encrypted file by the second application based on the rule specified in the selected file access policy.