A computer system comprises: a central processing unit (CPU); an input/output control hub (IOCH) connected to the CPU; a storage device; the input/output control hub (IOCH) comprising a direct data access control (DDAC) being connected to the storage device; the DDAC providing protected regions and unprotected regions on the storage device (HDD). The IOCH comprises in addition to the DDAC an interface for semantic control of data access (SCDA), the SCDA storing custom configuration data which can be loaded only by a dedicated service which controls protected code running on the CPU. Via the SCDA, files in protected regions can be accessed on a record or even field level, whereby each record or field can have different access rights.