Are you a developer? Do you run an IT company that develops software? Or perhaps you are a privacy consultant. If you fall into one of these categories, you are surely one of the few people who have heard of the acronym OWASP.
But let's take it step by step.
What is OWASP?
The Open Worldwide Application Security Project is an open-source project founded in 2001 with the aim of spreading a culture of code quality during the software development phases. Over the years, the OWASP community has produced articles, methodologies, documents and tools to support developers in building secure software and applications.
The four main checks on which the OWASP method is based are:
- Automated scanning for vulnerabilities;
- Penetration testing of an application;
- Static analysis of the code;
- Manual code review.
OWASP code checks are among the internationally recognized best practices for preventing security vulnerabilities and, if applied correctly, can greatly reduce the risk of data breaches caused by cyber incidents enabled by poor-quality software and application code.
However, although generally regarded as an optional best practice, OWASP checks are increasingly becoming mandatory in some contexts. The entry into force of the GDPR has accelerated this process.
Over the last two years (2023-2025), OWASP has further consolidated its reputation thanks to the growing spread of cloud, generative AI and increasingly advanced web applications, with a specific focus on standards such as the “OWASP Top 10 2025”, updated this very year to include emerging threats such as AI-related vulnerabilities and supply chain attacks on open-source libraries.
But what is the relationship between OWASP and the GDPR?
The GDPR, EU Regulation 2016/679 on privacy and the protection of personal data, requires companies, among other obligations, to:
-
Adopt the principles of “Privacy by Design” and “Privacy by Default”. In practice, a new product or service should not be “launched” unless it is GDPR-compliant from the design phase; it is by now well-established practice that every new application or digital service must incorporate GDPR compliance criteria from the earliest stages of conception and design;
-
Adopt appropriate security measures in order to prevent the risk of data breaches.
For this reason, more and more organizations that outsource software development or entrust third parties with IT processing of personal data require their suppliers or Data Processors to adopt, and document the adoption of, OWASP code checks.
Moreover, in recent years European data protection supervisory authorities (such as the Italian Data Protection Authority, the Garante) and the Agency for Digital Italy (AGID) have increasingly pointed to the OWASP Top 10 as an example and benchmark of recommended good technical practice, while never making it formally mandatory or binding[1]. The ENISA Guidelines and those of the EDPB (European Data Protection Board) generally indicate the advisability of adopting codified and universally recognized standards—among which the OWASP Top 10 is implicitly included.. European data protection authorities have progressively tightened their controls and issued explicit guidelines that expressly require providers of web and cloud applications to adopt documented OWASP methodologies updated to 2025.
In Italy, in 2025 the National Cybersecurity Agency (ACN) also sets increasingly strict requirements for qualifying SaaS platforms and Cloud Service Providers (CSPs) for the Public Administration. Among these requirements is, explicitly and mandatorily, a certified attestation that up-to-date OWASP checks have been carried out, as a mandatory guarantee to reduce security risks in the platforms used by public administrations.
So, if you are reading this article in 2025, you are probably doing so because you are facing explicit requests from private clients or public bodies asking you for compliance with up-to-date OWASP standards.
OWASP code checks: turn to Argo
Argo can support your company in applying OWASP best practices, using dedicated tools and producing the documentation that certifies that the tests have been passed.
Send us an email, submit a request through our contact form or give us a call. Passing the OWASP tests will make your code more secure, and your company will be perceived as reliable by clients and public administrations.
[1] https://www.agid.gov.it/it/infrastrutture/cloud-pa/qualificazione-servizi-cloud/modello-cloud-pa