A data processing apparatus comprising: a memory protection setting storage storing a plurality of entries, each entry defining an address section and being for either memory protection set by a virtual machine monitor or for memory protection set by a virtual machine, the number of entries for memory protection set by the virtual machine monitor and the number of entries for memory protection set by the virtual machine being configured to be dynamically changeable; a plurality of first determination circuits each of which is provided for each of the entries and provisionally determines whether or not an access request is permitted based on whether or not an access destination address of the access request corresponds to the entry; and a second determination circuit (16; 21; 31) for determining whether or not the access request is permitted based on i) a result of provisional determination by each of the first determination circuits, ii) entry boundary information which dynamically defines which entry among the plurality of entries is an entry for memory protection set by the virtual machine monitor and which entry is an entry for memory protection set by the virtual machine, and iii) an access source information (VM FLAG) indicating whether the access request is an access by the virtual machine monitor or the virtual machine, wherein for the access source information (VM FLAG) indicating that the access request is an access by the virtual machine monitor, the second determination circuit (16; 21; 31) is configured to permit the access request, when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor, and wherein for the access source information (VM FLAG) indicating that the access request is an access by the virtual machine, the second determination circuit (16; 21; 31) is configured to permit the access request, when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine, and when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor. a memory protection setting storage storing a plurality of entries, each entry defining an address section and being for either memory protection set by a virtual machine monitor or for memory protection set by a virtual machine, the number of entries for memory protection set by the virtual machine monitor and the number of entries for memory protection set by the virtual machine being configured to be dynamically changeable; a plurality of first determination circuits each of which is provided for each of the entries and provisionally determines whether or not an access request is permitted based on whether or not an access destination address of the access request corresponds to the entry; and a second determination circuit (16; 21; 31) for determining whether or not the access request is permitted based on i) a result of provisional determination by each of the first determination circuits, ii) entry boundary information which dynamically defines which entry among the plurality of entries is an entry for memory protection set by the virtual machine monitor and which entry is an entry for memory protection set by the virtual machine, and iii) an access source information (VM FLAG) indicating whether the access request is an access by the virtual machine monitor or the virtual machine, wherein for the access source information (VM FLAG) indicating that the access request is an access by the virtual machine monitor, the second determination circuit (16; 21; 31) is configured to permit the access request, when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor, and wherein for the access source information (VM FLAG) indicating that the access request is an access by the virtual machine, the second determination circuit (16; 21; 31) is configured to permit the access request, when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine, and when any provisional determination result indicates that the access destination address of the access request corresponds to the entry for memory protection set by the virtual machine monitor.