A stored data access controller, configured to control access to data items encoding graph data and stored in a data storage apparatus, each data item encoding a labelled link between a subject graph node and an object graph node and being composed of a data value for each of three triple elements, the three triple elements being: a subject, identifying the subject graph node linked by the labelled link encoded by the data item; an object, identifying the object graph node linked by the labelled link encoded by the data item; and a predicate, being the label of the labelled link encoded by the data item; wherein the data items encode more than one graph database, and each of the more than one graph databases is stored on distinct data storage apparatus having individual search and data retrieval functions; the stored data access controller comprising: a query module, configured to receive a query requesting, as a query result, a specified subset of the data items stored in the data storage apparatus, and configured to obtain data items belonging to the specified subset from the more than one graph databases stored in the data storage apparatus as a preliminary query result; a predicate ontology storage unit configured to store the label of each of a plurality of labelled links from the encoded graph data in association with access control information attributed to the label, wherein access control information attributed to the label of a labelled link is identified by a data item having the form of a triple including the label of the labelled link as subject and data identifying the access control information as object, the access control information comprising a suppression condition; and a suppression module, the suppression module being centralised for the more than one graph databases, configured to obtain the preliminary query result from the query module, to generate a revised version of the preliminary query result by selectively suppressing information from the preliminary query result, and to output, as the requested query result in response to the received query, the revised version of the preliminary query result; wherein selectively suppressing information comprises, for the or each of one or more graph nodes, retrieving the access control information stored in the predicate ontology storage unit and attributed to the label of a labelled link between the graph node and another graph node, extracting the suppression condition from the retrieved access control information, determining whether or not the suppression condition is satisfied, and if the suppression condition is satisfied, suppressing the data value, the graph node being either the subject graph node or the object graph node linked by the labelled link. a subject, identifying the subject graph node linked by the labelled link encoded by the data item; an object, identifying the object graph node linked by the labelled link encoded by the data item; and a predicate, being the label of the labelled link encoded by the data item; a query module, configured to receive a query requesting, as a query result, a specified subset of the data items stored in the data storage apparatus, and configured to obtain data items belonging to the specified subset from the more than one graph databases stored in the data storage apparatus as a preliminary query result; a predicate ontology storage unit configured to store the label of each of a plurality of labelled links from the encoded graph data in association with access control information attributed to the label, wherein access control information attributed to the label of a labelled link is identified by a data item having the form of a triple including the label of the labelled link as subject and data identifying the access control information as object, the access control information comprising a suppression condition; and a suppression module, the suppression module being centralised for the more than one graph databases, configured to obtain the preliminary query result from the query module, to generate a revised version of the preliminary query result by selectively suppressing information from the preliminary query result, and to output, as the requested query result in response to the received query, the revised version of the preliminary query result;