A device for generating a watermarked stream, comprising: an input interface configured to receive encrypted control messages and conditional access streams including a main stream comprising payload portions of an original stream and payload portions comprising impairments, and cryptographically protected watermarking data streams comprising watermarked payload portions of the original stream, wherein said watermarked payload portions include watermarks (38a, 38b) which are specific to each watermarking data stream from which a watermarking information can be embedded in the watermarked stream; a security module configured to process said encrypted control messages and to enable access to cryptographic keys required to decrypt conditional access streams selected according to access data (AC, AR) included in said encrypted control messages; a descrambler configured to remove the cryptographic protection applied on the selected conditional access streams using the cryptographic keys obtained from the security module; a watermarking unit configured to generate the watermarked stream from said conditional access streams by selectively processing said watermarking data streams depending on the access data (AC, AR) included in said encrypted control messages to embed the watermarking information, and wherein the selectively processing comprises: accessing a watermarking data stream selected according to the access data (AC, AR) included in said encrypted control messages; generating the watermarked stream by removing the impairments of the main stream by replacing one or more payload portions of the main stream containing said impairments with a corresponding watermarked payload portion of the original stream from said selected watermarking data stream. an input interface configured to receive encrypted control messages and conditional access streams including a main stream comprising payload portions of an original stream and payload portions comprising impairments, and cryptographically protected watermarking data streams comprising watermarked payload portions of the original stream, wherein said watermarked payload portions include watermarks (38a, 38b) which are specific to each watermarking data stream from which a watermarking information can be embedded in the watermarked stream; a security module configured to process said encrypted control messages and to enable access to cryptographic keys required to decrypt conditional access streams selected according to access data (AC, AR) included in said encrypted control messages; a descrambler configured to remove the cryptographic protection applied on the selected conditional access streams using the cryptographic keys obtained from the security module; a watermarking unit configured to generate the watermarked stream from said conditional access streams by selectively processing said watermarking data streams depending on the access data (AC, AR) included in said encrypted control messages to embed the watermarking information, and wherein the selectively processing comprises: accessing a watermarking data stream selected according to the access data (AC, AR) included in said encrypted control messages; generating the watermarked stream by removing the impairments of the main stream by replacing one or more payload portions of the main stream containing said impairments with a corresponding watermarked payload portion of the original stream from said selected watermarking data stream. accessing a watermarking data stream selected according to the access data (AC, AR) included in said encrypted control messages; generating the watermarked stream by removing the impairments of the main stream by replacing one or more payload portions of the main stream containing said impairments with a corresponding watermarked payload portion of the original stream from said selected watermarking data stream.