A method for bounding a privacy spend for a query to a database storing restricted data, the method comprising: receiving a database query from the client, the database query comprising a relation indicative of data to perform the query upon and at least one privacy parameter indicative of a level of differential privacy with which to perform the query; determining a noise type for the query; generating a representation of probabilistic privacy loss for the query based on the determined noise type comprising generating a Renyi differential privacy curve, said Renyi differential privacy curve being a function of alpha, wherein alpha is an order of the Renyi divergence; determining a privacy spend for the query using the generated representation of probabilistic privacy loss, wherein determining the privacy spend for the query comprises: evaluating the Renyi differential privacy curve at a plurality of alphas to produce a set of tau values, each tau value being an unadjusted upper bound for the corresponding alpha and the at least one privacy parameter; for each alpha of the plurality of alphas, combining the corresponding tau value from the set of tau values with one or more historic tau values also associated with the alpha; and determining the privacy spend for the query based on the combinations; and determining whether the determined privacy spend exceeds a privacy budget associated with the client, and if so blocking the query. receiving a database query from the client, the database query comprising a relation indicative of data to perform the query upon and at least one privacy parameter indicative of a level of differential privacy with which to perform the query; determining a noise type for the query; generating a representation of probabilistic privacy loss for the query based on the determined noise type comprising generating a Renyi differential privacy curve, said Renyi differential privacy curve being a function of alpha, wherein alpha is an order of the Renyi divergence; determining a privacy spend for the query using the generated representation of probabilistic privacy loss, wherein determining the privacy spend for the query comprises: evaluating the Renyi differential privacy curve at a plurality of alphas to produce a set of tau values, each tau value being an unadjusted upper bound for the corresponding alpha and the at least one privacy parameter; for each alpha of the plurality of alphas, combining the corresponding tau value from the set of tau values with one or more historic tau values also associated with the alpha; and determining the privacy spend for the query based on the combinations; and evaluating the Renyi differential privacy curve at a plurality of alphas to produce a set of tau values, each tau value being an unadjusted upper bound for the corresponding alpha and the at least one privacy parameter; for each alpha of the plurality of alphas, combining the corresponding tau value from the set of tau values with one or more historic tau values also associated with the alpha; and determining the privacy spend for the query based on the combinations; and determining whether the determined privacy spend exceeds a privacy budget associated with the client, and if so blocking the query.