Abstract: Methods and devices for controlling access to sensitive data stored in a computer system are provided. For at least some data entries in a dataset, each identified by a respective key, an indicator of which zero or more conditions of a plurality of queries are satisfied by that data entry is generated. The keys are grouped into cohorts based on the indicators, at least some of the cohorts comprising keys identifying data entries satisfying the same zero of more conditions. A first output is transmitted to the first computing device comprising an identifier of a first cohort and an indication of a condition which is satisfied by data entries identified by keys in the first cohort. A second output is transmitted to a second computing device comprising an identifier of the first cohort and a set of keys corresponding to the data entries in the first cohort.