An access control apparatus (2000) acquires a request (20) for access to data stored in a first storage apparatus 30. The access control apparatus (2000) acquires privilege information (70) from a blockchain storage (40). The privilege information (70) represents access privilege pertaining to access to the first storage apparatus (30). The access control apparatus (2000) determines whether requested access is within a range of the access privilege of a target entity (10) being a subject of the request (20), by using the privilege information (70) of the target entity (10). When it is determined that the access is within the range of the access privilege of the target entity (10), the access control apparatus (2000) executes the access.