Method for accessing data in a secure manner, wherein - the data comprise a number of data sets, wherein - each of the data sets is assigned to an entity (U), preferably a user, and - the data sets are stored in encrypted form in a database (DB), wherein a first decryption key (VK) assigned to a particular entity (U) is used to decrypt the data sets assigned to the particular entity, - the first decryption keys (VK) are stored in a volatile memory (VMEM), - the first decryption keys (VK) assigned to the particular entity (U) are encrypted by an encryption key (K1) assigned to the particular entity (U) (S4), and the encrypted first decryption keys (VKK) are stored in a permanent memory (PMEM) (S5), and - after the volatile memory (VMEM) is erased (S6) - the encrypted first decryption keys (VKK) are copied from the permanent memory (PMEM) into the volatile memory (VMEM) (S9), and - in the volatile memory (VMEM), the first decryption keys (VKK) are decrypted by a second decryption key (K2) assigned to the particular entity (U), and - wherein the access to the data sets stored in encrypted form in the database (DB) is handled by an access control device (PGU), wherein access policies indicating who can access the encrypted data sets and for what purpose are stored in the access control device (PGU), wherein, in the event of a change to the access policies, the entire content of the volatile memory (VMEM) is erased. - the data comprise a number of data sets, wherein - each of the data sets is assigned to an entity (U), preferably a user, and - the data sets are stored in encrypted form in a database (DB), wherein a first decryption key (VK) assigned to a particular entity (U) is used to decrypt the data sets assigned to the particular entity, - each of the data sets is assigned to an entity (U), preferably a user, and - the data sets are stored in encrypted form in a database (DB), wherein a first decryption key (VK) assigned to a particular entity (U) is used to decrypt the data sets assigned to the particular entity, - the first decryption keys (VK) are stored in a volatile memory (VMEM), - the first decryption keys (VK) assigned to the particular entity (U) are encrypted by an encryption key (K1) assigned to the particular entity (U) (S4), and the encrypted first decryption keys (VKK) are stored in a permanent memory (PMEM) (S5), and - after the volatile memory (VMEM) is erased (S6) - the encrypted first decryption keys (VKK) are copied from the permanent memory (PMEM) into the volatile memory (VMEM) (S9), and - in the volatile memory (VMEM), the first decryption keys (VKK) are decrypted by a second decryption key (K2) assigned to the particular entity (U), and - the encrypted first decryption keys (VKK) are copied from the permanent memory (PMEM) into the volatile memory (VMEM) (S9), and - in the volatile memory (VMEM), the first decryption keys (VKK) are decrypted by a second decryption key (K2) assigned to the particular entity (U), and - wherein the access to the data sets stored in encrypted form in the database (DB) is handled by an access control device (PGU), wherein access policies indicating who can access the encrypted data sets and for what purpose are stored in the access control device (PGU), wherein, in the event of a change to the access policies, the entire content of the volatile memory (VMEM) is erased. <EOS>