1. A method of performing an operation on a data storage for storing data being encrypted with a key K D associated with an owner of the data, the method comprising: for a client C k of one or more clients which are authorized to perform operations on the data storage: deriving a first key K Ck and a second key K Tk such that the key K D can be derived from the first key K Ck and the second key K Tk , providing the client C k with the first key K Ck , and providing a Trusted Third Party, TTP, with the second key K Tk , and at a Policy Enforcement Point, PEP: receiving a request to perform the operation on the data storage at the PEP from the client C k of the one or more clients, acquiring the first key K Ck at the PEP from the client C k , wherein the PEP and the client C k are different entities, acquiring the second key K Tk at the PEP from the TTP, wherein the PEP and the TPP are different entities, and wherein the client C k and the TPP are different entities, deriving at the PEP the key K D from the first key K Ck and the second key K Tk , and performing at the PEP the operation on the data storage using the derived key K D , wherein the PEP and the data storage are different entities.