VAPT (Vulnerability Assessment and Penetration Testing) finds and safely tests weaknesses in your apps and infrastructure. Many organisations test at least yearly and after major changes; your regulator or clients may require more.
It sets rules for consent, purpose, retention, security and individual rights over personal data. Systems need to support these rules. Your legal team should confirm your obligations.