Password managers and the GDPR.
Credentials are the key to all other data. Whoever keeps them badly breaches the regulation at its most sensitive point.
What the regulation actually requires.
The General Data Protection Regulation never uses the words password manager. Article 32 requires appropriate technical and organisational measures, graded by risk. In practice that leads very quickly to the same set of points: credentials must not lie around, must not be shared, must be withdrawable when an employee leaves, and it must remain traceable who had access to what. A password manager is the obvious way to meet this. It is not mandatory, but meeting the obligation without one becomes laborious.
What matters when choosing.
A data processing agreement
As soon as a provider processes personal data on your behalf, you need an agreement under Article 28. Without it, the deployment is open to challenge, however good the technology is. Reputable providers supply it unprompted. Our processing agreement.
Where the data sits, and which law applies
Within the European Union the position is straightforward. With providers subject to a law outside it, the further question arises whether authorities there can demand disclosure, even when the servers stand in Europe. A provider should be able to answer that question without evasion.
Demonstrability, not just security
Article 5 requires you to be able to demonstrate compliance. A log showing who opened, shared or withdrew which access, and when, is worth more in an audit than any assurance.
Deleting has to mean deleting
When somebody leaves, their access must go, and completely. Shared entries must not disappear from colleagues' folders in the process. That sounds self-evident, but in practice it is not.
Encryption is an argument, not a free pass
Article 34 can remove the duty to notify data subjects if the data was effectively encrypted. It does not remove the notification to the supervisory authority, nor any of the remaining obligations.
A note on our own behalf.
This text is an orientation, not legal advice. What is appropriate in your company depends on your size, your sector and the data you handle. When in doubt, ask your data protection officer or a specialist lawyer. What we can contribute are the documents covering our own solution: privacy policy, data processing agreement and a description of the procedures we use under encryption.
Common questions. Clear answers.
Your question is not here? Write to us, we answer personally.
Does the GDPR prescribe a password manager?
No, the words do not appear in the regulation. It requires appropriate measures under Article 32. Anyone who can justify how they grant, withdraw and demonstrate access securely without such a tool also meets the obligation another way. In practice that rarely succeeds.
Do I need a processing agreement with the provider?
Yes, as soon as the provider processes personal data on your behalf, even if that is only the administration of your employees' accounts. This applies even when the content is encrypted and the provider cannot read it. If you run the solution entirely yourself, the agreement is not needed.
Is it enough for the servers to stand in Europe?
The location is an important point, but not the only one. What also decides the matter is which law governs the company that owns the servers. A group outside Europe may under certain circumstances be obliged to disclose data that sits in Europe.
What applies when running it in-house?
Then you are solely responsible, and no processing agreement is needed because nobody processes on your behalf. In exchange you carry operation, backup and updates yourself. What that means in practice.
Must I report a breach if everything was encrypted?
The notification to the supervisory authority under Article 33 almost always remains. The additional notification of data subjects under Article 34 can fall away if the data is rendered unusable for unauthorised parties by effective encryption. The burden of demonstrating that rests with you.
Enterprise Security. No Compromise.
Register for our next free, no-obligation live webinar and see how FidenoVault protects your logins.
- Zero-knowledge
- European sovereignty
- GDPR-compliant
