Controlling access to protected information stored in a database. Certain records in the database can be designated as master records. Master records are stored in a data table. Any database record of the database may include one or more ownership data fields comprising owner identification information for identifying a master record associated with the database record. Owner identification information of the ownership data fields of a retrieved database record are analyzed to identify the master record associated with the retrieved database record. Access to the retrieved database record is controlled using the same authorization rules used to govern access to the master record associated with the retrieved database record. The system provides a mechanism to ensure that the owner identification information of any new or updated database record is linked to the correct master records. New and updated database records inherit access control from their associated master records.