There's no way to be certain that someone with physical access to your server can't get at your data. But you can take certain precautions:
First of all, if the attacker gets access to your server while it's in its "running" state, so either through the console, through remote desktop, SSH, etc., then there's not a lot you can do. You're relying on your OS protections to save you while the server is operational. Not a lot more you can do there other than what people talk about every day.
But normally an attacker can circumvent your OS by powering down the system and bringing it up in "rescue mode" mounting your drives in another machine. You protect against that attack using encryption.
There are several whole-disk encryption systems out there. TrueCrypt is well known, and LUKS/FreeOFTE is another reliable one. BitLocker and other closed systems may or may not be secure; you don't really know because you don't know what's in them.
Obviously if you use a system like this, then your server boots into an unusable state. That's rather the point. So you must be logged in to bring the server online. If you can get a remote low-level console (e.g. IPMI) then you can type in the password at boot to unlock your drive.
Alternately, you can put your sensitive data on a separate data drive or parition which you unlock after booting up.
Or, a third option is to run your hardware simply as a VM hypervisor, and run your sensitive software on an encrypted virtual machine.
All three of these suffer from the weakness that if the attacker seizes control of your server but leaves it running where it is, he can modify the environment to capture you typing in your password when you bring the server online. There's no way around this flaw other than to take the server out of your attacker's possession.
But it is arguably better than nothing.