A portable storage apparatus for storing sensitive data of a user and/or of an external device, said portable storage apparatus comprising a basic storage component and a separate plug-in storage component (PISC) with a high security level data memory, wherein the basic storage component has: - a security level, SL, selection unit adapted to generate the security level selection control signal, SL-SEL-CRTL, in response to a user selection input of the user or in response to a device selection input signal received from the external device; - an authentication unit adapted to authenticate the user and/or the external device connected to the portable storage device and to enable the security level, SL, selection unit of said portable storage apparatus if the user or the connected external device has been successfully authenticated by said authentication unit; - at least one processing unit adapted to encrypt the sensitive data requiring a high security level, SL, with a secure encryption key (K SL1), loaded from a key storage of the plug-in storage component (PISC) of the portable storage apparatus after the plug-in storage component, PISC, has been plugged into the basic storage component, BSC, and the user has selected the high security level data memory to store sensitive data in encrypted form via the security level, SL, selection unit; and - a switching unit adapted to switch, in response to the security level selection control signal, SL-SEL-CRTL, received from the security level, SL, selection unit enabled by the authentication unit, the processing unit to the high security level, SL, data memory provided in the plug-in storage component (PISC) plugged into the basic storage component to connect the high security level, SL, data memory with the switching unit provided in the basic storage component and to store the encrypted sensitive data in the high security level, SL, data memory provided in the plug-in storage component (PISC) if the high security level, SL, data memory is selected by the authenticated user or by the authenticated external device. a basic storage component and a separate plug-in storage component (PISC) with a high security level data memory, wherein the basic storage component has: - a security level, SL, selection unit adapted to generate the security level selection control signal, SL-SEL-CRTL, in response to a user selection input of the user or in response to a device selection input signal received from the external device; - an authentication unit adapted to authenticate the user and/or the external device connected to the portable storage device and to enable the security level, SL, selection unit of said portable storage apparatus if the user or the connected external device has been successfully authenticated by said authentication unit; - at least one processing unit adapted to encrypt the sensitive data requiring a high security level, SL, with a secure encryption key (K SL1), loaded from a key storage of the plug-in storage component (PISC) of the portable storage apparatus after the plug-in storage component, PISC, has been plugged into the basic storage component, BSC, and the user has selected the high security level data memory to store sensitive data in encrypted form via the security level, SL, selection unit; and - a switching unit adapted to switch, in response to the security level selection control signal, SL-SEL-CRTL, received from the security level, SL, selection unit enabled by the authentication unit, - a security level, SL, selection unit adapted to generate the security level selection control signal, SL-SEL-CRTL, in response to a user selection input of the user or in response to a device selection input signal received from the external device; - an authentication unit adapted to authenticate the user and/or the external device connected to the portable storage device and to enable the security level, SL, selection unit of said portable storage apparatus if the user or the connected external device has been successfully authenticated by said authentication unit; - at least one processing unit adapted to encrypt the sensitive data requiring a high security level, SL, with a secure encryption key (K SL1), loaded from a key storage of the plug-in storage component (PISC) of the portable storage apparatus after the plug-in storage component, PISC, has been plugged into the basic storage component, BSC, and the user has selected the high security level data memory to store sensitive data in encrypted form via the security level, SL, selection unit; and - a switching unit adapted to switch, in response to the security level selection control signal, SL-SEL-CRTL, received from the security level, SL, selection unit enabled by the authentication unit, the processing unit to the high security level, SL, data memory provided in the plug-in storage component (PISC) plugged into the basic storage component to connect the high security level, SL, data memory with the switching unit provided in the basic storage component and to store the encrypted sensitive data in the high security level, SL, data memory provided in the plug-in storage component (PISC) if the high security level, SL, data memory is selected by the authenticated user or by the authenticated external device.