A data processing apparatus has processing circuitry which has a secure domain and a less secure domain. When operating in the secure domain the processing circuitry has access to data that is not accessible in the less secure domain. In response to a control flow altering instruction, processing switches to a program instruction at a target address. Domain selection is performed to determine a selected domain in which the processing circuitry is to operate for the program instruction at the target address. Domain checking can be performed to check which domains are allowed to be the selected domain for the target program. A domain check error is triggered if the selected domain in the domain selection is not an allowed selected domain. Thus, if less secure code causes the control flow altering instruction to behave in an unexpected way, an error is triggered, guarding against unauthorised access to secure data. The control flow altering instruction may be a branch instruction or a load instruction. If the control flow altering instruction is executed while operating in the less secure domain, domain checking is performed and a domain error may be triggered if the selected domain is not an allowed domain.