A data protection system includes a data storage apparatus and an information processing apparatus. In the information processing apparatus, a redirection processing apparatus sets a personal storage area corresponding to a user to an accessible state according to a redirection policy. Furthermore, a write control unit controls data writing permission/prohibition for each storage area according to a write management policy. In particular, the write control unit prohibits data writing to a local storage unit except for the storage area to be used to access the personal storage area. With this, the data does not remain in the information processing apparatus, thereby preventing data leakage from the information processing apparatus.