this book constitutes the refereed proceedings of the 20th annual working conference on data and applications security held in sophia antipolis, france, in july/august 2006. the 22 revised full papers presented were carefully reviewed and selected from 56 submissions. the papers present theory, technique, applications, and practical experience of data and application security covering a number of diverse research topics such as access control, privacy, and identity management.