GDPR and password managers – what you need to know

A password manager, by nature, handles particularly sensitive data. Here's how the GDPR (General Data Protection Regulation) governs this type of service, and what that actually changes for you.

What data is involved?

Two clearly distinct categories:

• Your Encryvault account credentials (email, hashed password) — classic personal data, protected as such.
• Your vault's contents (stored passwords, notes) — encrypted end-to-end before ever leaving your device (see our article on the Zero-Knowledge architecture). Technically, Encryvault cannot read this content, which considerably limits the risk when processing this category of data.

The right of access and portability

The GDPR gives you the right to obtain a copy of your data. That's exactly what the dashboard's export feature enables (Settings → Import / Export): an encrypted JSON or CSV export of your vault, at any time, without having to request it.

The right to erasure

Closing your account must result in the actual deletion of your data, not just its deactivation. This is a point worth checking with any provider — "soft" deletion (account marked inactive but data kept indefinitely) doesn't satisfy this right.

Data hosting

The GDPR strictly regulates the transfer of personal data outside the European Union. A service that hosts your data on servers located in the EU, under European law, considerably simplifies compliance — no standard contractual clauses to monitor, no reliance on an international transfer mechanism whose legal validity can shift over time.

Encryption as a "by design" security measure

The GDPR requires security "by design and by default" — data protection must be built in from the start, not bolted on afterward. End-to-end encryption enabled by default, with nothing to configure, ticks this box directly rather than treating it as an advanced option.

What to remember as a user

• Check that the service you use offers a genuine export of your data.
• Check that closing your account actually deletes your data, not just your access to it.
• Favor EU-based hosting if data location matters to you.
• End-to-end encryption isn't just a security argument — it's also what most effectively limits the consequences of a potential legal disclosure requirement: there's simply nothing readable to disclose.

This article is for informational purposes only and does not constitute legal advice. For any question about your specific GDPR rights, see our Privacy Policy or contact our DPO.