A resource provider environment system, comprising: at least one data repository; at least one processor; and memory including instructions that, when executed by the at least one processor, cause the system to: receive, at the resource provider environment system, a first data object from a user environment, the first data object including user data, a data tag, a policy, and an audit log, the data tag corresponding to the policy for the user data and causing the policy to be automatically applied to the first data object in the user environment, the audit log including a history of events relating to the user data; determine that the policy is supported by, and is free of conflicts with other policies of, the resource provider environment system; cause the user data, the policy, the data tag, and the audit log to be stored by the at least one data repository of the resource provider environment system if the policy is supported by, and free of conflicts with other policies of the resource provider environment system, then performing the following steps: receive a request for at least a portion of the user data; determine that a source of the request is authorized to receive the user data; add information for the request to the audit log for the user data; generate a second data object including the user data, the data tag, the policy, and the audit log; and send the second data object to a destination specified by the request. at least one data repository; at least one processor; and memory including instructions that, when executed by the at least one processor, cause the system to: receive, at the resource provider environment system, a first data object from a user environment, the first data object including user data, a data tag, a policy, and an audit log, the data tag corresponding to the policy for the user data and causing the policy to be automatically applied to the first data object in the user environment, the audit log including a history of events relating to the user data; determine that the policy is supported by, and is free of conflicts with other policies of, the resource provider environment system; cause the user data, the policy, the data tag, and the audit log to be stored by the at least one data repository of the resource provider environment system if the policy is supported by, and free of conflicts with other policies of the resource provider environment system, then performing the following steps: receive a request for at least a portion of the user data; determine that a source of the request is authorized to receive the user data; add information for the request to the audit log for the user data; generate a second data object including the user data, the data tag, the policy, and the audit log; and send the second data object to a destination specified by the request. receive, at the resource provider environment system, a first data object from a user environment, the first data object including user data, a data tag, a policy, and an audit log, the data tag corresponding to the policy for the user data and causing the policy to be automatically applied to the first data object in the user environment, the audit log including a history of events relating to the user data; determine that the policy is supported by, and is free of conflicts with other policies of, the resource provider environment system; cause the user data, the policy, the data tag, and the audit log to be stored by the at least one data repository of the resource provider environment system if the policy is supported by, and free of conflicts with other policies of the resource provider environment system, then performing the following steps: receive a request for at least a portion of the user data; determine that a source of the request is authorized to receive the user data; add information for the request to the audit log for the user data; generate a second data object including the user data, the data tag, the policy, and the audit log; and send the second data object to a destination specified by the request. receive a request for at least a portion of the user data; determine that a source of the request is authorized to receive the user data; add information for the request to the audit log for the user data; generate a second data object including the user data, the data tag, the policy, and the audit log; and send the second data object to a destination specified by the request.