Password management and data protection

Data protection laws, such as Türkiye's KVKK (Law No. 6698) and the EU's GDPR, expect every business that processes personal data to take appropriate technical and organisational measures to keep it secure. Marketplace panels holding customer details, accounting software and e-mail accounts are all doors to that data, and their keys are passwords.

This post is general information, not legal advice. Consult a lawyer about your own situation.

Why passwords are part of it

A customer's name, address and orders sit in the marketplace panel; their invoices in the accounting software; their messages in e-mail. When someone unauthorised gets into these accounts, personal data is exposed too. How passwords and access are managed is a direct part of data security.

Guidance from data protection authorities commonly lists measures such as limiting access rights, reviewing permissions regularly, removing a leaver's access and keeping logs.

A practical starting list

1. Limit access. Each employee reaches only the accounts their work needs. A shared spreadsheet contradicts this: whoever opens it sees everything.
2. Give personal permissions. Separate users where possible; otherwise share the password through a password manager, in vaults split by team.
3. Turn on two-step verification. Especially for e-mail, accounting and marketplace panels.
4. Review access regularly. Every three or six months, check who can reach which account and remove what is no longer needed.
5. Remove access at offboarding. Close a leaver's access on the same day and change the shared passwords they saw.
6. Keep records. Who accessed which password when, who changed what? You need these records to look back when something happens.
7. Write the rules down. A password and access policy is a practical way to document your measures. Our password policy generator gives you a draft to start from.

Where a password manager fits

A password manager does not tick every item on its own, but it makes them easier to apply. Passhield keeps passwords in end-to-end encrypted vaults, shares them by team with four permission levels, records who saw which password in a tamper-evident log, and lists what to do at offboarding. The server never sees passwords in plain text; what it does and does not see is listed on our security page.

In short

Password and access management is the front door of personal data security. Limit access, review permissions, remove them when people leave, keep records and write your rules down.