A data handling apparatus (400) for a computer platform (1) using an operating system executing a process, the apparatus comprising a system call monitor (402) for detecting predetermined system calls, and means (402, 404, 406) for applying a data handling policy to the system call upon a predetermined system call being detected, whereby the data handling policy is applied for all system calls involving the writing of data outside the process. A corresponding method is disclosed.