A data center comprising: a plurality of secure processing units ; a plurality of data stores holding encrypted data records; and a network connecting the secure processing units and the data stores , wherein the secure processing units are configured to execute a data processing operation in parallel by being configured to read encrypted records from the plurality of data stores , process one or more of the encrypted data records within the secure processing units , send one or more of the encrypted data records between the secure processing units over the network, and write the encrypted data records to the plurality of data stores , wherein the data processing operation is implemented using a plurality of mappers and a plurality of reducers and where the mappers are configured to compute an execution plan, include a record key assignment, for the data processing operation to balance the amount of activity between individual ones of the secure processing units , wherein the data processing operation is configured to carry out a secret shuffle of at least some of the encrypted data records to protect privacy of data being processed from an observer that may observe any one or more of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted records; wherein the secret shuffle comprises a random permutation of the encrypted data records hidden from the observer, and wherein the plurality of secure processing units include a plurality of additional mappers and additional reducers, the plurality of additional mappers and the plurality of additional reducers are arranged to carry out the secret shuffle. a plurality of secure processing units ; a plurality of data stores holding encrypted data records; and a network connecting the secure processing units and the data stores , wherein the secure processing units are configured to execute a data processing operation in parallel by being configured to read encrypted records from the plurality of data stores , process one or more of the encrypted data records within the secure processing units , send one or more of the encrypted data records between the secure processing units over the network, and write the encrypted data records to the plurality of data stores , wherein the data processing operation is implemented using a plurality of mappers and a plurality of reducers and where the mappers are configured to compute an execution plan, include a record key assignment, for the data processing operation to balance the amount of activity between individual ones of the secure processing units , wherein the data processing operation is configured to carry out a secret shuffle of at least some of the encrypted data records to protect privacy of data being processed from an observer that may observe any one or more of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted records; wherein the secret shuffle comprises a random permutation of the encrypted data records hidden from the observer, and wherein the plurality of secure processing units include a plurality of additional mappers and additional reducers, the plurality of additional mappers and the plurality of additional reducers are arranged to carry out the secret shuffle. <EOS>