Abstract: A method and apparatus are provided for use in enabling a user to access online services of a type requiring certain types of personal data to be supplied to respective service providers. An apparatus is provided having a store for storing profile data for use both by users and by service providers to store personal information in respect of those users. The apparatus also has user and service provider interfaces to enable read and write access to the store, identity management means and a profile access controller arranged to implement user-defined access controls in respect of a user's stored profile data. The identity management means are triggerable to allocate or to cease a pseudo-identifier in respect of a user and a selected service provider, the pseudo-identifier being the only identifier by which the service provider may access profile data stored in the store in respect of the user.