A computing system comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive a request from an entity for operating on data stored or to be stored in a personal storage (560, 570, 660) in an ID hub (410, 550, 650) that provides storage for multiple decentralized identifier, DID, owners, wherein the personal storage is associated with an owner of a DID (205, 565, 575) and controlled by the DID owner so that no entity has access to the data without consent of the owner; determine a type of the data requested to be operated on; access one or more policy rules (621, 622) that are applicable to the type of the data from a plurality of distinct locations (620, 630, 650, 660); filtering the one or more policy rules based on a geographic location of the DID owner, a geographic location of the data, and/or a geographic location of the requesting entity, to determine a subset of one or more policy rules that are applicable to the requested data; based on the subset of one or more policy rules, determine if the operation to be performed on the data is to be granted or denied; and based on the determination, grant or deny the operation. one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive a request from an entity for operating on data stored or to be stored in a personal storage (560, 570, 660) in an ID hub (410, 550, 650) that provides storage for multiple decentralized identifier, DID, owners, wherein the personal storage is associated with an owner of a DID (205, 565, 575) and controlled by the DID owner so that no entity has access to the data without consent of the owner; determine a type of the data requested to be operated on; access one or more policy rules (621, 622) that are applicable to the type of the data from a plurality of distinct locations (620, 630, 650, 660); filtering the one or more policy rules based on a geographic location of the DID owner, a geographic location of the data, and/or a geographic location of the requesting entity, to determine a subset of one or more policy rules that are applicable to the requested data; based on the subset of one or more policy rules, determine if the operation to be performed on the data is to be granted or denied; and based on the determination, grant or deny the operation. receive a request from an entity for operating on data stored or to be stored in a personal storage (560, 570, 660) in an ID hub (410, 550, 650) that provides storage for multiple decentralized identifier, DID, owners, wherein the personal storage is associated with an owner of a DID (205, 565, 575) and controlled by the DID owner so that no entity has access to the data without consent of the owner; determine a type of the data requested to be operated on; access one or more policy rules (621, 622) that are applicable to the type of the data from a plurality of distinct locations (620, 630, 650, 660); filtering the one or more policy rules based on a geographic location of the DID owner, a geographic location of the data, and/or a geographic location of the requesting entity, to determine a subset of one or more policy rules that are applicable to the requested data; based on the subset of one or more policy rules, determine if the operation to be performed on the data is to be granted or denied; and based on the determination, grant or deny the operation.