A method of controlling access to an encrypted file stored on a mobile device, comprising: receiving, by the mobile device, a request for access to encrypted file of encrypted file contents which is associated with encrypted file metadata; decrypting the encrypted file metadata, wherein the decryption is performed using a file system key generated by the mobile device, wherein deletion of the file system key prevents decrypting the encrypted file metadata thereby preventing access to an encrypted file content key that, when decrypted, is usable to decrypt the encrypted file content; extracting, by the mobile device, from the decrypted file metadata, the encrypted file content key and data protection class (318/402); retrieving, using the data protection class (318/402), obtained from the decrypted file metadata, a policy associated with the data protection class (318/402) and the encrypted file contents, the policy specifying a required context comprising a state or configuration of the mobile device for enabling access to the encrypted file contents; determining a current context of the mobile device; comparing the current context to the required context, wherein the required context comprises a requirement that a particular user authentication protection is enabled for the mobile device; in response to the current context of the mobile device satisfying the required context for the data protection class: retrieving an encrypted class key associated with the data protection class; decrypting the encrypted class key according to the required context; decrypting the encrypted file key using the decrypted class key; and decrypting the encrypted file contents using the decrypted file key. receiving, by the mobile device, a request for access to encrypted file of encrypted file contents which is associated with encrypted file metadata; decrypting the encrypted file metadata, wherein the decryption is performed using a file system key generated by the mobile device, wherein deletion of the file system key prevents decrypting the encrypted file metadata thereby preventing access to an encrypted file content key that, when decrypted, is usable to decrypt the encrypted file content; extracting, by the mobile device, from the decrypted file metadata, the encrypted file content key and data protection class (318/402); retrieving, using the data protection class (318/402), obtained from the decrypted file metadata, a policy associated with the data protection class (318/402) and the encrypted file contents, the policy specifying a required context comprising a state or configuration of the mobile device for enabling access to the encrypted file contents; determining a current context of the mobile device; comparing the current context to the required context, wherein the required context comprises a requirement that a particular user authentication protection is enabled for the mobile device; in response to the current context of the mobile device satisfying the required context for the data protection class: retrieving an encrypted class key associated with the data protection class; decrypting the encrypted class key according to the required context; decrypting the encrypted file key using the decrypted class key; and decrypting the encrypted file contents using the decrypted file key. retrieving an encrypted class key associated with the data protection class; decrypting the encrypted class key according to the required context; decrypting the encrypted file key using the decrypted class key; and decrypting the encrypted file contents using the decrypted file key.