18. An apparatus for restricting data access from an electronic data access requestor, the apparatus comprising: a processor; and memory storing: a first data access requester comprising computer instructions executable by the processor to access data resources external to the apparatus; a first set of get tokens associated with the first data access requestor, wherein each said get token in said first set of get tokens corresponds to a data resource from which the first data access requestor has received data; a first set of send tokens associated with the first data access requester, wherein each said send token in said first set of send tokens corresponds to a data resource to which the first data access requester has sent data; and computer instructions executable by the processor for determining whether to associate a new get token or a send token with the first data access requester, wherein said determining whether to associate a new send token with the first data access requester is dependent on the current first set of get tokens associated with the first data access requester, wherein access to the corresponding data resource is permitted if said determining results in the new send token being associated with the first data access requester, and access to the corresponding data resource is restricted if said determining does not result in the new send token being associated with the first data access requester.
18. An apparatus for restricting data access from an electronic data access requestor, the apparatus comprising: a processor; and memory storing: a first data access requester comprising computer instructions executable by the processor to access data resources external to the apparatus; a first set of get tokens associated with the first data access requestor, wherein each said get token in said first set of get tokens corresponds to a data resource from which the first data access requestor has received data; a first set of send tokens associated with the first data access requester, wherein each said send token in said first set of send tokens corresponds to a data resource to which the first data access requester has sent data; and computer instructions executable by the processor for determining whether to associate a new get token or a send token with the first data access requester, wherein said determining whether to associate a new send token with the first data access requester is dependent on the current first set of get tokens associated with the first data access requester, wherein access to the corresponding data resource is permitted if said determining results in the new send token being associated with the first data access requester, and access to the corresponding data resource is restricted if said determining does not result in the new send token being associated with the first data access requester. 21. The apparatus of claim 18 , wherein the apparatus is configured to: intercept a data access attempt from the first data access requester to a first data resource; and if the data access attempt is an attempt to send data to the first data resource, allow the data access if said first set of get tokens is empty.