Don't put data in the cgi-bin directory. Use another directory not accessible from the web for that.
Set the file permissions on your data directory so that only your web server user can read and write files there.
Create all the data files from within the cgi scripts with permissions of 600.
The Apache webserver has an option to deny access to files matching wildcards (by default, access to all files starting with .ht is denied). You can use this feature to block access to your files (this feature is configured in the file httpd.conf).