A computing system associated with a credential holder comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to perform the following: receive a verifiable credential, VC, from a credential issuer, the VC containing one or more claims about a subject entity; obtain a public key of the credential issuer; encrypt the VC by the public key of the credential issuer; generate one or more instruction(s), at least one of the instructions instructing the credential issuer to grant a scope of permission associated with the encrypted VC to a relying entity, the scope of permission comprising at least permission to access a subset of data that can be extracted from the VC or a portion of data that can be derived from the VC; send the encrypted VC and the instruction(s) to the credential issuer or the relying entity; such that if the encrypted VC and the instruction(s) have been sent to the relying entity, the relying entity forwards the encrypted VC and the instruction(s) to the credential issuer; cause the credential issuer to generate a response containing the subset of verifiable data or the portion of data and proof code, the proof code being configured to prove validity of the subset of data or the portion of data; and cause the credential issuer to send the response to the computing system associated with the credential holder or to the relying entity. one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to perform the following: receive a verifiable credential, VC, from a credential issuer, the VC containing one or more claims about a subject entity; obtain a public key of the credential issuer; encrypt the VC by the public key of the credential issuer; generate one or more instruction(s), at least one of the instructions instructing the credential issuer to grant a scope of permission associated with the encrypted VC to a relying entity, the scope of permission comprising at least permission to access a subset of data that can be extracted from the VC or a portion of data that can be derived from the VC; send the encrypted VC and the instruction(s) to the credential issuer or the relying entity; such that if the encrypted VC and the instruction(s) have been sent to the relying entity, the relying entity forwards the encrypted VC and the instruction(s) to the credential issuer; cause the credential issuer to generate a response containing the subset of verifiable data or the portion of data and proof code, the proof code being configured to prove validity of the subset of data or the portion of data; and cause the credential issuer to send the response to the computing system associated with the credential holder or to the relying entity. receive a verifiable credential, VC, from a credential issuer, the VC containing one or more claims about a subject entity; obtain a public key of the credential issuer; encrypt the VC by the public key of the credential issuer; generate one or more instruction(s), at least one of the instructions instructing the credential issuer to grant a scope of permission associated with the encrypted VC to a relying entity, the scope of permission comprising at least permission to access a subset of data that can be extracted from the VC or a portion of data that can be derived from the VC; send the encrypted VC and the instruction(s) to the credential issuer or the relying entity; such that if the encrypted VC and the instruction(s) have been sent to the relying entity, the relying entity forwards the encrypted VC and the instruction(s) to the credential issuer; cause the credential issuer to generate a response containing the subset of verifiable data or the portion of data and proof code, the proof code being configured to prove validity of the subset of data or the portion of data; and cause the credential issuer to send the response to the computing system associated with the credential holder or to the relying entity.