A data-processing apparatus has a data provider for providing an input datum encrypted by an encryption key. In addition, the data-processing apparatus has a key stream generator for generating a key stream in a predetermined deterministic manner such that the key stream has a decryption key corresponding to the encryption key. Furthermore, the data-processing apparatus has a data processor for processing the encrypted input datum in a masked manner using the decryption key as a temporary key to obtain an output datum encrypted by an output key such that the encrypted output datum corresponds to a result, encrypted by the output key, of a predetermined operation on the encrypted input datum having been decrypted by the decryption key.