A system and method for protecting Sensitive Personal Information (SPI) from Multi-Party Access (MPA), including receiving a request for access to a data record, encrypting the data record using a random symmetric key to generate an encrypted data record, storing the encrypted data record on a database, encrypting the symmetric key to generate an encrypted symmetric key by using a public key associated with the client device or a key encryption key associated with the one or more processors, and transmitting a message including the encrypted symmetric key. The message causes the client device to access the data record using the database and the encrypted symmetric key.