In this paper, we show how a third-party architecture can be used for a secure management of personal data over the web. Main benefits of the proposed system are its scalability, the compliance with emerging web standards, and the enforcement of privacy requirements of both data owners and consumers. This is obtained by making use of non-standard encryption strategies and by relying on a Trusted Privacy Manager in charge of data encryption and key delivering. In the paper, besides providing an overview of the proposed architecture we focus on the Trusted Privacy Manager and on the strategies it adopts for key generation and management.