A mobile communications device, method and computer program product for providing security are described. In one embodiment, the device comprises: a processor; a communications subsystem; a storage element having application modules and data; and a security module operable to detect a locked state of the device and initiate a lockout data protection timer for a predetermined duration upon detection of the locked state. The security module is operable to, after the lockout data protection timer has been initiated, detect if a password is entered through a user input device within the predetermined duration and to terminate the lockout data protection timer if entry of the password is detected to perform a security action comprising erasing or encrypting at least some of the data if entry of the password is not detected.