Skip to main content
Next Step PM
Back to the library

Test · Core

Check security, privacy and data protection

Before real users and real data arrive, check that the product protects both. Security and privacy problems found after launch are expensive and damage trust.

About 2-10 daysChanges yearlyLast reviewed 5 November 2026

Who this applies to

Skills it builds
Technical and AI fluency
PM types
All
Product types
All
Starting points
All
Ways of working
All
Experience
All
Size of organisation
All

Steps, by experience

Beginner (under 1 year)

  1. List what personal or sensitive data the product collects, where it is stored and who can see it.
  2. Check you only collect what you need, and that users are told how it is used.
  3. Ask your security colleague or a specialist to check the product against common risks, such as the OWASP Top Ten.
  4. Check who can access what: users should only see their own data, and staff only what they need.
  5. Complete a data protection impact assessment if the processing is high risk.
  6. Fix serious issues before launch and record any accepted risks with an owner.

Intermediate (1 to 4 years)

  1. Map personal data flows and check minimisation and transparency.
  2. Arrange a security review or penetration test proportionate to the risk.
  3. Check access controls and logging.
  4. Complete a data protection impact assessment where needed and track fixes.

Experienced (5+ years)

  1. Build security and privacy reviews into the delivery process, not just before launch.
  2. Threat-model new features with engineering early.
  3. Agree risk acceptance rules with security and legal leaders.
  4. Plan for data subject requests, retention and deletion from the start.

Who can do this

Owner: Product manager

Can be delegated to

  • Policy / Legal / Compliance: Lead the data protection impact assessment
  • Backend Engineer or Full-stack Engineer or Tech Lead: Fix security issues and check access controls
  • DevOps / SRE: Check hosting, secrets and logging

Reviewed by: Tech Lead, Policy / Legal / Compliance

Tool examples

GitHub
Turn on secret scanning and dependency alerts for the repository.
GitLab
Use security scanning in the pipeline so issues are found on every change.
AWS
Review access permissions so each service has only what it needs.
Azure
Review access permissions so each service has only what it needs.
Google Cloud
Review access permissions so each service has only what it needs.
Confluence
Keep the data map and the impact assessment together on one page.

Definition of done

  • Personal data mapped and minimised
  • Security review done and serious issues fixed
  • Impact assessment done where needed
  • Accepted risks recorded with owners

Common pitfalls

  • Leaving security to the last week
  • Collecting data 'in case it is useful'
  • Assuming the hosting provider handles everything

If you lead the team

What good looks like: Security and privacy are checked before real users and real data arrive.

Ask your PM

  • Who has reviewed security and privacy, and what did they find?
  • Have we done a data protection impact assessment where needed?

Warning signs

  • Security review happens the week before launch.
  • Personal data is collected 'just in case'.

Do these first

Sources