A data access control system, comprising: a database storing information (107, 108, 304, 305) comprising a user key associated with a user; a server configured for data communication with a client device (101, 200) associated with a service provider via a network; a contactless card (105, 300, 420, 520) associated with the user, the contactless card (105, 300, 420, 520) comprising a communications interface, a processor, and a memory, the memory storing an applet (106, 303), a user token (107, 304), and personal user data associated with the user, wherein the personal user data is encrypted using the user key; the client device (101, 200) storing a client application (102, 201), the client application (102, 201) comprising instructions for execution on the client device (101, 200), the client application (102, 201) configured to: in response to a tap action (150, 414, 620) between the contactless card (105, 300, 420, 520) and the client device (101, 200) initiate a near field data access request (410, 414, 510, 514) to the contactless card (105, 300, 420, 520, 150, 430, 432, 630); receive the user token (107, 304, 630) from the contactless card (105, 300, 420, 520), the user token being transmitted by the applet (106, 152); transmit to the server a service provider token associated with the service provider, the user token (107, 154, 304), and a request for a data access key (156, 640, 710), wherein the service provider token is associated with the service provider (710, 720); receive from the server the data access key (160, 174); receive from the contactless card (150, 430, 432, 630) the encrypted personal user data (162,176); and using the data access key, decrypt the encrypted personal user data (350, 670); wherein the server is configured to: receive, from the client application (102, 201), the service provider token, the user token (107, 154, 304) and the request for the data access key (156, 640, 710); identify the service provider based on the service provider token (158 720); identify the user based on the user token (107, 150, 304, 730); verify that the service provider is authorized to receive access to the personal user data (159, 720, 740); retrieve the user key from the database; generate the data access key from the user key; and transmit to the client application (102, 201) the data access key (160, 650). a database storing information (107, 108, 304, 305) comprising a user key associated with a user; a server configured for data communication with a client device (101, 200) associated with a service provider via a network; a contactless card (105, 300, 420, 520) associated with the user, the contactless card (105, 300, 420, 520) comprising a communications interface, a processor, and a memory, the memory storing an applet (106, 303), a user token (107, 304), and personal user data associated with the user, wherein the personal user data is encrypted using the user key; the client device (101, 200) storing a client application (102, 201), the client application (102, 201) comprising instructions for execution on the client device (101, 200), the client application (102, 201) configured to: in response to a tap action (150, 414, 620) between the contactless card (105, 300, 420, 520) and the client device (101, 200) initiate a near field data access request (410, 414, 510, 514) to the contactless card (105, 300, 420, 520, 150, 430, 432, 630); receive the user token (107, 304, 630) from the contactless card (105, 300, 420, 520), the user token being transmitted by the applet (106, 152); transmit to the server a service provider token associated with the service provider, the user token (107, 154, 304), and a request for a data access key (156, 640, 710), wherein the service provider token is associated with the service provider (710, 720); receive from the server the data access key (160, 174); receive from the contactless card (150, 430, 432, 630) the encrypted personal user data (162,176); and using the data access key, decrypt the encrypted personal user data (350, 670); wherein the server is configured to: in response to a tap action (150, 414, 620) between the contactless card (105, 300, 420, 520) and the client device (101, 200) initiate a near field data access request (410, 414, 510, 514) to the contactless card (105, 300, 420, 520, 150, 430, 432, 630); receive the user token (107, 304, 630) from the contactless card (105, 300, 420, 520), the user token being transmitted by the applet (106, 152); transmit to the server a service provider token associated with the service provider, the user token (107, 154, 304), and a request for a data access key (156, 640, 710), wherein the service provider token is associated with the service provider (710, 720); receive from the server the data access key (160, 174); receive from the contactless card (150, 430, 432, 630) the encrypted personal user data (162,176); and using the data access key, decrypt the encrypted personal user data (350, 670); wherein the server is configured to: receive, from the client application (102, 201), the service provider token, the user token (107, 154, 304) and the request for the data access key (156, 640, 710); identify the service provider based on the service provider token (158 720); identify the user based on the user token (107, 150, 304, 730); verify that the service provider is authorized to receive access to the personal user data (159, 720, 740); retrieve the user key from the database; generate the data access key from the user key; and transmit to the client application (102, 201) the data access key (160, 650).