Abstract: In a method for protecting at least parts of product data, which are stored on at least one server and/or in at least one database and associated with a product identified by an RFID tag, from unauthorized access, an authentication and authorization check of an accessing party is performed upon access to a server and/or database, additionally proof being required upon access that the product is located within the discretionary area of the accessing party, the proof being provided by the RFID tag upon detection by an RFID reader by an access token in the form of a data structure, by which the RFID tag authorizes the accessing party to access at least parts of the product data associated with the product identified by the RFID tag, and stored on the server and/or in the database, wherein the product data can be queried and/or changed depending on the application.