A data storage controller comprising: a communication interface operable to receive a source data block for storage in a data storage layer; a partition table; partitioning circuitry coupled to the communication interface, the partitioning circuitry configured to: partition the source data block into a public data block and a private data block; and determine a communication partner that is allowed visibility to the private data block; access the partition table to determine public data elements and private data elements; and responsive to the partition table, add public data elements from the source data block into the public data block and add the private data elements from the source data block into the private data block encryption circuitry coupled to the partitioning circuitry, the encryption circuitry configured to: obtain a symmetric encryption key; obtain an asymmetric encryption key linked to the communication partner; encrypt the private data block with the symmetric encryption key to obtain a protected private data block; and encrypt the symmetric encryption key with the asymmetric encryption key to obtain a protected decryption key; data storage circuitry coupled to the encryption circuitry, the data storage circuitry configured to: add the public data block, the protected private data block, and the protected decryption key to a public data storage element; and queue the public data storage element for insertion into the data storage layer. a communication interface operable to receive a source data block for storage in a data storage layer; a partition table; partitioning circuitry coupled to the communication interface, the partitioning circuitry configured to: partition the source data block into a public data block and a private data block; and determine a communication partner that is allowed visibility to the private data block; access the partition table to determine public data elements and private data elements; and responsive to the partition table, add public data elements from the source data block into the public data block and add the private data elements from the source data block into the private data block encryption circuitry coupled to the partitioning circuitry, the encryption circuitry configured to: obtain a symmetric encryption key; obtain an asymmetric encryption key linked to the communication partner; encrypt the private data block with the symmetric encryption key to obtain a protected private data block; and encrypt the symmetric encryption key with the asymmetric encryption key to obtain a protected decryption key; data storage circuitry coupled to the encryption circuitry, the data storage circuitry configured to: add the public data block, the protected private data block, and the protected decryption key to a public data storage element; and queue the public data storage element for insertion into the data storage layer. partition the source data block into a public data block and a private data block; and determine a communication partner that is allowed visibility to the private data block; access the partition table to determine public data elements and private data elements; and responsive to the partition table, add public data elements from the source data block into the public data block and add the private data elements from the source data block into the private data block encryption circuitry coupled to the partitioning circuitry, the encryption circuitry configured to: obtain a symmetric encryption key; obtain an asymmetric encryption key linked to the communication partner; encrypt the private data block with the symmetric encryption key to obtain a protected private data block; and encrypt the symmetric encryption key with the asymmetric encryption key to obtain a protected decryption key; data storage circuitry coupled to the encryption circuitry, the data storage circuitry configured to: add the public data block, the protected private data block, and the protected decryption key to a public data storage element; and queue the public data storage element for insertion into the data storage layer. obtain a symmetric encryption key; obtain an asymmetric encryption key linked to the communication partner; encrypt the private data block with the symmetric encryption key to obtain a protected private data block; and encrypt the symmetric encryption key with the asymmetric encryption key to obtain a protected decryption key; data storage circuitry coupled to the encryption circuitry, the data storage circuitry configured to: add the public data block, the protected private data block, and the protected decryption key to a public data storage element; and queue the public data storage element for insertion into the data storage layer. add the public data block, the protected private data block, and the protected decryption key to a public data storage element; and queue the public data storage element for insertion into the data storage layer.