Unstructured data access control

A method for protecting individual data elements within an unstructured dataset includes identifying a data element within the unstructured dataset requiring access control, encrypting the data element within the unstructured dataset, storing a decryption key and access control information corresponding to the dataset at an access controller, and cryptographically binding the encrypted data element to metadata that identifies the access controller. The method may additionally include detecting an access attempt to the dataset, and determining whether the access attempt is acceptable according to the access control information. If the access attempt is acceptable, the method may further include allowing the access attempt. If the access attempt is not acceptable, the method may further include denying the access attempt.