A method of authorising conditional access to an encrypted digital data product, includes storing at least one set (23) of entitlements in a secure device (19,21), each entitlement including a product identifier and expiry information, receiving entitlement control messages from a decoder system (13) including a device (25) for decrypting encrypted digital data products using control words, each entitlement control message including a product identifier, and in a first mode, returning at least one control word in response to an entitlement control message including a product identifier if the product identifier corresponds to a product identifier in a stored entitlement including expiry information indicating the entitlement to be valid, and, in a second mode, progressively adjusting a counter (31) to a pre-determined value and returning at least one control word in response also to entitlement control messages including a product identifier if the product identifier corresponds to a product identifier in a stored entitlement including expiry information indicating expiry of the entitlement and if the counter (31) is at a value between an initial value and the pre-determined value. The counter (31) is set to an initial value to commence operation in the second mode upon receiving an entitlement control message including a product identifier corresponding to a product identifier in a stored entitlement that includes expiry information indicating expiry of the entitlement.