A secure access control system configured to control access to sensitive data stored on disparate systems is disclosed. A first entity is designated to control access to second entity data. An authentication token, generated using a key derivation function, is used to authenticate the first entity. The authenticated first entity is granted access to second entity data. An access control interface is generated configured to selectively grant or withdraw access to second entity data. The access control interface identifies entities associated with respective access controls. The access control interface is instantiated on a first entity device. Activation indications of access controls is received over a network. Access to second entity data is accordingly granted or withdrawn. Access control transition event rules and/or access control transition time rules are retrieved. Using monitored events and the access control transition event rules, and/or a monitored current time and the access control transition time rules, a determination is made as to transition access control of the second entity data first entity to the second entity.