A data transmission method, wherein the method is performed by a user equipment, UE, and comprises: receiving (104, 402) a first message, wherein the first message is used to trigger a change of a security parameter of a first bearer, the first bearer is a signaling radio bearer or a data radio bearer, the security parameter comprises a key and/or a security algorithm, and the change of the security parameter indicates that the security parameter of the first bearer is changed from a first security parameter to a second security parameter; sending (106, 403) a second message, wherein the second message is used to indicate that the change of the security parameter of the first bearer is completed; performing (201, 521) first security processing on uplink data on the first bearer, to obtain second uplink data, wherein the first security processing comprises at least one of integrity protection for data on the signaling radio bearer, encryption processing for the data on the signaling radio bearer, and encryption processing for data on the data radio bearer, wherein the performing first security processing on uplink data on the first bearer comprises: after the first message is received, performing (201, 521) the first security processing on the uplink data by using the second security parameter; and before the first message is received, performing (201, 521) the first security processing on the uplink data by using the first security parameter; or after the second message is sent, performing (201, 521) the first security processing on the uplink data by using the second security parameter and before the second message is sent, performing (201, 521) the first security processing on the uplink data by using the first security parameter; and sending (211, 221, 522) the second uplink data, wherein the second uplink data comprises a first security parameter indication, and the first security parameter indication is used to indicate a security parameter used in the first security processing of the second uplink data; wherein the first message is from a base station, and the second message is sent to the base station, wherein the first bearer is a bearer between the base station and the UE. receiving (104, 402) a first message, wherein the first message is used to trigger a change of a security parameter of a first bearer, the first bearer is a signaling radio bearer or a data radio bearer, the security parameter comprises a key and/or a security algorithm, and the change of the security parameter indicates that the security parameter of the first bearer is changed from a first security parameter to a second security parameter; sending (106, 403) a second message, wherein the second message is used to indicate that the change of the security parameter of the first bearer is completed; performing (201, 521) first security processing on uplink data on the first bearer, to obtain second uplink data, wherein the first security processing comprises at least one of integrity protection for data on the signaling radio bearer, encryption processing for the data on the signaling radio bearer, and encryption processing for data on the data radio bearer, wherein the performing first security processing on uplink data on the first bearer comprises: after the first message is received, performing (201, 521) the first security processing on the uplink data by using the second security parameter; and before the first message is received, performing (201, 521) the first security processing on the uplink data by using the first security parameter; or after the second message is sent, performing (201, 521) the first security processing on the uplink data by using the second security parameter and before the second message is sent, performing (201, 521) the first security processing on the uplink data by using the first security parameter; and sending (211, 221, 522) the second uplink data, wherein the second uplink data comprises a first security parameter indication, and the first security parameter indication is used to indicate a security parameter used in the first security processing of the second uplink data; wherein the first message is from a base station, and the second message is sent to the base station, wherein the first bearer is a bearer between the base station and the UE.