A computing system comprising: one or more processors ; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive a request from an entity for operating on data stored or to be stored in a personal storage in an ID hub that provides storage for multiple decentralized identifier, DID, owners, wherein the personal storage is associated with an owner of a DID and controlled by the DID owner so that no entity has access to the data without consent of the owner; determine a type of the data requested to be operated on; access one or more policy rules that are applicable to the type of the data from a plurality of distinct locations ; filtering the one or more policy rules based on a geographic location of the DID owner, a geographic location of the data, and/or a geographic location of the requesting entity, to determine a subset of one or more policy rules that are applicable to the requested data; based on the subset of one or more policy rules, determine if the operation to be performed on the data is to be granted or denied; and based on the determination, grant or deny the operation. one or more processors ; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive a request from an entity for operating on data stored or to be stored in a personal storage in an ID hub that provides storage for multiple decentralized identifier, DID, owners, wherein the personal storage is associated with an owner of a DID and controlled by the DID owner so that no entity has access to the data without consent of the owner; determine a type of the data requested to be operated on; access one or more policy rules that are applicable to the type of the data from a plurality of distinct locations ; filtering the one or more policy rules based on a geographic location of the DID owner, a geographic location of the data, and/or a geographic location of the requesting entity, to determine a subset of one or more policy rules that are applicable to the requested data; based on the subset of one or more policy rules, determine if the operation to be performed on the data is to be granted or denied; and based on the determination, grant or deny the operation. receive a request from an entity for operating on data stored or to be stored in a personal storage in an ID hub that provides storage for multiple decentralized identifier, DID, owners, wherein the personal storage is associated with an owner of a DID and controlled by the DID owner so that no entity has access to the data without consent of the owner; determine a type of the data requested to be operated on; access one or more policy rules that are applicable to the type of the data from a plurality of distinct locations ; filtering the one or more policy rules based on a geographic location of the DID owner, a geographic location of the data, and/or a geographic location of the requesting entity, to determine a subset of one or more policy rules that are applicable to the requested data; based on the subset of one or more policy rules, determine if the operation to be performed on the data is to be granted or denied; and based on the determination, grant or deny the operation. <EOS>