Disclosed herein are a data protection apparatus and method for a smart device. The data protection apparatus for a smart device includes a detection unit for detecting unauthorized activity in a bootloader of the smart device, based on whether a program for acquiring an administrator privilege has been installed and whether a compressed-command file is present, during a procedure for loading the bootloader, and a data access blocking unit for, when the unauthorized activity is detected, performing an operation of locking the smart device, thus blocking access to data in the smart device.