A data processing apparatus (2) includes memory management circuitry (18) for managing a two-stage address translation from a virtual address VA to an intermediate physical address IPA and then from the intermediate physical address IPA to a physical address PA. The first stage of the translation is performed using first stage translation data (22) controlled by a virtual machine program executing within a virtual machine execution environment provided by a hypervisor program which manages second stage translation data (24) for performing a second stage translation. If a region of memory is designated as a virtual machine private region accessible to a given virtual machine, but inaccessible to the hypervisor program, and also as a device region, then the memory management circuitry (18) performs private-device region management in respect of that region (i.e. the intermediate physical address may not be altered by the second stage translation). If a region is not both a virtual machine private region and a device region, then the memory management circuitry (18) performs non-private device management thereon.