Controlling access to sensitive data in a shared dataset, including: identifying, for a dataset stored at a first location, a second location for replicating a portion of the dataset; replicating, from the first location to the second location, the portion of the dataset, wherein the portion of the dataset does not include all data in the dataset; detecting that additional data has been added to the portion of the dataset stored in the second location; and replicating, from the second location to the first location, the additional data that has been added to the portion of the dataset stored in the second location.