If attackers can physically move the data around, from Flash to Flash, then you will need to resort to cryptography. If chip A must be able to make sense of some data bytes, but chip B (of the same model) cannot, then chip A must know something that B does not. Encryption reduces the problem: if you encrypt all your sensitive data with a secret key known only to A (let's call it KA) then your problem becomes: how can you make A store its key, in a way that it cannot be extracted ? Length of KA would typically be 128 bits, i.e. 16 bytes; that's the added value of cryptography: the size of your problem has shrunk down to 16 bytes.
The first normal method is the following: during an initial phase (typically at the end of the factory line), a device-specific key KA is injected in device A, to be stored in a tamper-resistant chip. That chip must be able to store the key (only a few bytes), do some encryption/decryption with it, and resist forceful extraction (physical resistance). A "master server" stores a copy of all device keys (warning ! sensitive !) and encrypts data elements which must be afterwards sent securely to device A. Mobile phones use that model; the tamper-resistant chip is the SIM card.
An extended method entails a tamper-resistant chip with a bit more power: it can do asymmetric cryptography (say, RSA) and generate its own private/public key pair. During the initial enrollment phase, under controlled conditions, the device generates its key pair, and exports the public key; the public key is stored externally, and is used for encryption (when some data is to be sent securely to device A) and authentication (when device A wants to prove its identity to an online server). Typically, during the enrollment phase, the public key is wrapped by a custom Certification Authority into a certificate and used in standard protocols such as SSL/TLS. Some payment terminals use this model.
A TPM is a tamper-resistant chip which can usually do asymmetric crypto, including generating and storing a private key. This is the right tool for the job, but you still have to use it: the TPM will not magically, by its mere presence, protect the data; you have to design the initial enrollment phase and do the key management. As described above, this more-or-less implies running your own PKI.