User privacy and data security should be through about from the beginning. It's much easier to build in security and privacy focused processes and tech at the start than it will be to retrofit later on. But as Steven alluded to in his earlier comment, the reality is that you might be able to only do what you can afford to do or have time to do. The risk in what you store should be a good guide to how much effort gets invested. In my experience the most likely reasons to "think" more about data security have been big customers, compliance requirements for the industry you build in, or a security finding from a penetration test or vulnerability disclosure.