A system and method for protecting Sensitive Personal Information (SPI) from Multi-Party Access (MPA), including receiving a request for access to a data record, the request comprising an encrypted device identifier identifying the client device, encrypting the data record using a random symmetric key to generate an encrypted data record, encrypting the data record using a second symmetric key to generate a second encrypted data record, the second symmetric key being different from the random symmetric key, encrypting the random symmetric key to generate an encrypted symmetric key by using a public key associated with the client device or a key encryption key associated with the one or more processors, and transmitting a message comprising the encrypted symmetric key and the encrypted device identifier. The message causing the client device to access the data record using a database, the encrypted device identifier, and the encrypted symmetric key.