A method for providing user access to encrypted data on a user device, the method comprising: receiving, by the user device from a security center, a security policy for the user device that includes data access conditions and data encryption conditions for one or more users of the user device, wherein receiving a security policy for the user device further includes receiving encryption and decryption keys for the user device, wherein the encryption and decryption keys are stored on the user device in a container encrypted by a public key of the security center; sending the encrypted container to the security center for decryption of the container using the public key of the security center; and receiving from the security center encryption and decryption keys decrypted by the security center; encrypting at least a portion of the data stored on the user device based on satisfaction of the data encryption conditions; identifying a list of user accounts (131, 132) in an operating system of the user device for the one or more users specified in the data access conditions included in the received security policy; automatically creating, by a processor, at least one pre-boot authentication account for at least one user account, respectively, of the identified user accounts (131, 132) based on the data access conditions, with the at least one PBA account including pre-boot authentication credentials including access rights information that controls access of the user associated with the at least one user account to at least a portion of the encrypted data stored on the user device; if a password for the at least one PBA account is a same password for the at least one user account to access the OS of the user device, creating a single sign-on procedure for the user associated with the at least one user account whereby the password entered by the user for the pre-boot authentication credentials is automatically entered for the user to access the OS of the user device, wherein access to the encrypted portion of data is granted to the user at least upon entry of the correct pre-boot authentication credentials. receiving, by the user device from a security center, a security policy for the user device that includes data access conditions and data encryption conditions for one or more users of the user device, wherein receiving a security policy for the user device further includes receiving encryption and decryption keys for the user device, wherein the encryption and decryption keys are stored on the user device in a container encrypted by a public key of the security center; sending the encrypted container to the security center for decryption of the container using the public key of the security center; and receiving from the security center encryption and decryption keys decrypted by the security center; encrypting at least a portion of the data stored on the user device based on satisfaction of the data encryption conditions; identifying a list of user accounts (131, 132) in an operating system of the user device for the one or more users specified in the data access conditions included in the received security policy; automatically creating, by a processor, at least one pre-boot authentication account for at least one user account, respectively, of the identified user accounts (131, 132) based on the data access conditions, with the at least one PBA account including pre-boot authentication credentials including access rights information that controls access of the user associated with the at least one user account to at least a portion of the encrypted data stored on the user device; if a password for the at least one PBA account is a same password for the at least one user account to access the OS of the user device, creating a single sign-on procedure for the user associated with the at least one user account whereby the password entered by the user for the pre-boot authentication credentials is automatically entered for the user to access the OS of the user device, wherein access to the encrypted portion of data is granted to the user at least upon entry of the correct pre-boot authentication credentials.