GDPR checklist for security tools.
Credential managers hold access details for your other systems and logs about who used them. Compare 5 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 1Password | Usually a processor | Set per account or project | Obtained through the vendor |
 LastPass | Usually a processor | Set per account or project | Obtained through the vendor |
 Dashlane | Usually a processor | Set per account or project | Obtained through the vendor |
 Keeper | Usually a processor | Set per account or project | Published by the vendor |
 Proton Pass | Usually a processor | Set per account or project | Published by the vendor |
What to check for security tools
- Review who has admin access and how departures are handled.
- Check how long access logs are kept.
- Record the provider as a recipient of staff details.
- Confirm where encrypted data is stored.
Questions, answered.
What should I check before using a security tool under the GDPR?
Review who has admin access and how departures are handled. Check how long access logs are kept. Record the provider as a recipient of staff details. Confirm where encrypted data is stored.
Do I need a data processing agreement with a security provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which security tools does Privacyboard cover?
1Password, LastPass, Dashlane, Keeper, Proton Pass. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.