A data protection method, comprising: obtaining an original extended page table, EPT, wherein memory mapping relationships of all pieces of data and memory mapping relationships of all pieces of code in an application are configured in the original EPT; determining critical data; performing a dynamic analysis on source code in the application, to determine a first critical code set related to the critical data; determining code in the first critical code set as the critical code used to access the critical data; deleting the memory mapping relationships of the critical data and the critical code in the original EPT according to a memory area in which the critical data is located and a memory area in which the critical code is located, and adding a memory mapping relationship of a trampoline code corresponding to the critical code to the original EPT, to obtain a first EPT; detecting whether critical code that is in the application and that is used to access critical data is called; when detecting that an operating system calls the critical code by using the first EPT, switching from the first EPT to a preconfigured second EPT according to the trampoline code corresponding to the critical code, wherein memory mapping relationships of the critical data and the critical code are not configured in the first EPT, the memory mapping relationships of the critical data and the critical code are configured in the second EPT, and the critical data and the critical code are separately stored in independent memory areas; and after calling and executing the critical code by using the second EPT, switching from the second EPT back to the first EPT according to the trampoline code. obtaining an original extended page table, EPT, wherein memory mapping relationships of all pieces of data and memory mapping relationships of all pieces of code in an application are configured in the original EPT; determining critical data; performing a dynamic analysis on source code in the application, to determine a first critical code set related to the critical data; determining code in the first critical code set as the critical code used to access the critical data; deleting the memory mapping relationships of the critical data and the critical code in the original EPT according to a memory area in which the critical data is located and a memory area in which the critical code is located, and adding a memory mapping relationship of a trampoline code corresponding to the critical code to the original EPT, to obtain a first EPT; detecting whether critical code that is in the application and that is used to access critical data is called; when detecting that an operating system calls the critical code by using the first EPT, switching from the first EPT to a preconfigured second EPT according to the trampoline code corresponding to the critical code, wherein memory mapping relationships of the critical data and the critical code are not configured in the first EPT, the memory mapping relationships of the critical data and the critical code are configured in the second EPT, and the critical data and the critical code are separately stored in independent memory areas; and after calling and executing the critical code by using the second EPT, switching from the second EPT back to the first EPT according to the trampoline code.