A computer implemented method of sharing a data message containing multiple data fields between a provider computer system and a consumer computer system, wherein the provider and consumer computer systems have mutual mistrust, the method comprising: responsive to authenticating the provider computer system by an anonymisation server, receiving, by the anonymisation server, from the provider computer system, a definition of one or more fields in the data message accessible to the consumer computer system, each field having associated a cryptographic key; responsive to an indication from a data storage server that a ciphertext of the data message is requested by the provider computer system to be stored in the data storage server including a derivative of an identifier of the provider computer system, confirming the authenticity of the ciphertext by authenticating, by the anonymisation server, the provider computer system by performing a look-up operation based on the derivative of the identifier of the provider computer system, wherein the derivative of the identifier of the provider computer system is a hash or digest of an identifier of the provider, and wherein each field of the ciphertext is encrypted using a corresponding cryptographic key according to the definition; responsive to an authentication of the consumer computer system, issuing, by the anonymisation server, the consumer computer system with a cryptographic key for each of the fields in the data message accessible to the consumer computer system according to the definition, such that the consumer computer system is operable to obtain the ciphertext from the data storage server and to decrypt the one or more accessible data fields and such that other data fields being non-accessible to the consumer are encrypted to anonymise such other data fields, wherein the step responsive to the authentication of the consumer further comprises communicating, by the anonymisation server, a derivative of the data message to the consumer computer system such that the consumer computer system can identify the data message to the data storage server for retrieval thereof, wherein the derivative of the data message is a hash or digest of the data message, and wherein communication with each of the provider and consumer computer systems is encrypted using separate session keys. responsive to authenticating the provider computer system by an anonymisation server, receiving, by the anonymisation server, from the provider computer system, a definition of one or more fields in the data message accessible to the consumer computer system, each field having associated a cryptographic key; responsive to an indication from a data storage server that a ciphertext of the data message is requested by the provider computer system to be stored in the data storage server including a derivative of an identifier of the provider computer system, confirming the authenticity of the ciphertext by authenticating, by the anonymisation server, the provider computer system by performing a look-up operation based on the derivative of the identifier of the provider computer system, wherein the derivative of the identifier of the provider computer system is a hash or digest of an identifier of the provider, and wherein each field of the ciphertext is encrypted using a corresponding cryptographic key according to the definition; responsive to an authentication of the consumer computer system, issuing, by the anonymisation server, the consumer computer system with a cryptographic key for each of the fields in the data message accessible to the consumer computer system according to the definition, such that the consumer computer system is operable to obtain the ciphertext from the data storage server and to decrypt the one or more accessible data fields and such that other data fields being non-accessible to the consumer are encrypted to anonymise such other data fields, wherein the step responsive to the authentication of the consumer further comprises communicating, by the anonymisation server, a derivative of the data message to the consumer computer system such that the consumer computer system can identify the data message to the data storage server for retrieval thereof, wherein the derivative of the data message is a hash or digest of the data message, and wherein communication with each of the provider and consumer computer systems is encrypted using separate session keys.