Abstract: A data encryption and decryption system is provided. An electronic encryption apparatus is configured to extract a feature set from plaintext data using a lossy algorithm, encrypt the feature set, send it to a feature server, receive an access control list (ACL), send this to a key server, and receive back an encryption key, which is used to encrypt the plaintext data. A data identifier is also exchanged. An electronic decryption apparatus is configured to send the data identifier to the key server, identify an entity to the key server, receive a decryption key from the key server, and decrypt the encrypted data. The key server stores the ACL and data identifier in mutual association. When it receives a data identifier and entity identifier from the electronic decryption apparatus, it checks the entity is on the ACL associated with the data identifier, and returns the decryption key.