An integrated-circuit device (1) comprises a processor (7), memory (13) for storing executable code, and memory protection logic (9). The memory protection logic (9) is configured to: determine the state of a read protection flag for a protected region of the memory (13); detect a memory read request by the processor (7); determine whether the read request is for an address in the protected region of the memory (13); determine whether the processor (7) issued the read request while executing code stored in the protected region of the memory (13); and deny read requests for addresses in the protected region if the read protection flag for the protected region is set, unless at least one of one or more access conditions is met, wherein one of the access conditions is that the processor (7) issued the read requests while executing code stored in the protected region.