An employee leaves the company but still knows the password to a shared business account. An external service provider is temporarily given access to a cloud application, but their permission is not removed once the project is completed. Or sensitive credentials are exchanged within a team via Excel spreadsheets and emails.

In everyday business, situations like these often seem harmless. However, if unauthorised access occurs or sensitive information is lost, they can lead to significant security risks and, in certain circumstances, legal consequences.

The central challenge is therefore this: companies must not only protect their data, but also be able to control who has access to which systems.

Why password security is also a compliance issue

Passwords are among the most important means of access in companies. They protect email accounts, customer databases, cloud services, financial systems and numerous other business applications.

At the same time, they represent a frequently underestimated risk. If credentials are reused, stored unencrypted or passed on without control, even a single compromised account can have far-reaching consequences.

Legal requirements for information security address precisely these risks.

In Switzerland, the revised Federal Act on Data Protection (FADP), which has been in force since 1 September 2023, forms an essential legal basis. It requires companies to protect personal data through appropriate technical and organisational measures.

This is not just about encryption or protecting the IT infrastructure. The organisation of user rights, secure sign-in procedures and internal responsibilities are also part of an effective security concept.

A professional password manager can help companies implement such measures. For example, it makes it possible to store credentials securely, assign permissions in a structured way and reduce the sharing of passwords via unsuitable channels.

It is important to note, however, that using a password manager alone does not mean full compliance with all data protection regulations. What matters is how the solution is integrated into existing security processes.

FADP and GDPR: what Swiss companies should bear in mind

Many Swiss companies work with customers, partners or service providers in other European countries. As a result, European regulations may also become relevant alongside the Swiss Data Protection Act.

The Swiss FADP obliges controllers to ensure the security of the personal data they process in a manner appropriate to the risk. This includes, among other things, measures against unauthorised access, data loss and misuse.

The EU General Data Protection Regulation (GDPR) pursues comparable protection goals. Under certain conditions, it can also apply to companies outside the EU – for example, if they specifically offer goods or services to people in the EU or monitor their behaviour there. An ordinary business relationship with an EU company, on the other hand, does not automatically mean that all provisions of the GDPR become applicable.

There is an important simplification for transferring personal data from the EU to Switzerland: the European Commission recognises Switzerland as a country with an adequate level of data protection. Other data protection obligations remain unaffected.

In operational practice, this results in a common basic requirement: companies should define in a traceable way which people are allowed to access sensitive information and which security measures are used to control this access.

This is exactly where structured password and access management is important.

NIS2, DORA and the Cyber Resilience Act: further IT security requirements

Alongside data protection, additional cybersecurity regulations are gaining importance in Europe.

The NIS2 Directive is aimed in particular at medium-sized and large companies in certain critical or particularly relevant sectors. These include, for example, energy supply, healthcare, transport, digital infrastructure and selected IT services. Under certain conditions, smaller organisations may also be affected.

Key security areas include risk management, access controls, the appropriate use of multi-factor authentication, the handling of security incidents and securing supply chains. The specific obligations arise from the Directive and its respective national implementation.

In addition, the DORA Regulation (Digital Operational Resilience Act) has applied to certain financial entities in the EU since 17 January 2025. It sets requirements for handling IT risks, digital operational disruptions and external IT service providers.

The EU Cyber Resilience Act (CRA), in turn, mainly concerns manufacturers of hardware and software products with digital elements. Since 11 September 2026, certain reporting obligations for actively exploited vulnerabilities and severe security incidents already apply. The essential product requirements will apply from 11 December 2027.

Not every Swiss SME automatically falls under these European regulations. Decisive factors include business activities, the services offered and the respective legal scope.

Nevertheless, these developments point in a clear direction: cybersecurity increasingly needs to be systematically organised, reviewed and taken responsibility for.

Password management in companies: where the greatest risks arise

The legal requirements may seem complex. In everyday work, however, many security problems start with basic organisational weaknesses.

Things become particularly critical when credentials are not managed centrally.

This often leads to similar situations in companies:

• Several employees use the same password for a business account.
• Credentials are stored in Excel files, documents or emails.
• External service providers receive passwords without their subsequent use being adequately controlled.
• After employees leave, passwords known to several people remain unchanged.
• No one can reliably keep track of which accounts exist within a department.

The actual problem does not lie solely in the strength of a password. Even a long, technically secure password can become a risk if it is passed on without control or if former employees still know it.

Companies therefore need a clear structure for managing business access.

A central password manager can help to provide passwords and other supported access information in a protected manner and to link their use to defined permissions.

Which security measures professional password management supports

Modern password management goes far beyond storing and automatically filling in passwords. The following areas are particularly relevant for companies.

1. Protected storage instead of uncontrolled password lists

Business credentials should not be scattered across unprotected documents or personal notes.

A professional password manager stores passwords in an encrypted environment. This reduces the risk of sensitive credentials being accidentally disclosed or shared via unsuitable communication channels.

2. Role-based permissions and controlled sharing

Not every employee needs access to all company accounts.

With role- and group-based permissions, companies can specify which people or teams may use certain credentials. This supports the so-called principle of least privilege: users receive only the permissions they need for their tasks.

It remains important to distinguish between access to a password manager and permissions within an application. Both must be managed appropriately.

3. Secure onboarding and offboarding processes

When employees leave the company or change roles internally, access rights must be adjusted.

Deactivating a user account in Active Directory or the identity management system can be an important part of offboarding. However, it does not necessarily prevent already known passwords from continuing to be used for independent or shared business accounts.

Companies should therefore also check which credentials need to be changed, which existing sessions need to be terminated and which other sign-in options need to be revoked.

Central password management helps to identify the affected accounts and to reorganise how they are provided.

4. Multi-factor authentication and strong passwords

A password alone should not be the only protective measure, especially for critical business applications.

Multi-factor authentication adds a further security mechanism to the sign-in process. Wherever possible, phishing-resistant methods should be preferred.

At the same time, long, unique passwords remain necessary for many applications. A password manager can generate and securely manage such passwords without employees having to memorise them.

5. Traceability and regular review

For IT security, it is important not only whether permissions have been granted, but also whether they are still justified.

Suitable administration and logging functions can help to trace changes to permissions and certain access events. Which information is actually recorded depends on the solution used and its configuration.

Regularly reviewing existing access rights helps to identify unnecessary permissions and outdated shares at an early stage.

Cyberattack or data loss: when is there an obligation to report?

Despite technical and organisational protective measures, security incidents cannot be completely ruled out.

If, for example, a business account is compromised and unauthorised persons gain access to personal data as a result, the company must check whether a reportable data security breach has occurred.

In Switzerland, the FADP requires notification to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible if the breach is likely to result in a high risk to the personality or fundamental rights of the data subjects.

Under the GDPR, a reportable personal data breach must generally be notified to the competent supervisory authority within 72 hours of becoming aware of it. Notification is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

In addition, since 1 April 2025, certain operators of critical infrastructure in Switzerland have been obliged to report to the Federal Office for Cyber Security (FOCS). Reportable cyberattacks must generally be reported within 24 hours of their discovery.

Depending on the company and the system affected, a security incident can therefore trigger different legal obligations.

In addition to the technical response, clear internal procedures must be in place. Who assesses the incident? Who informs the management? Which accounts need to be blocked and which authorities may need to be notified?

Structured management of passwords and access rights makes it easier to identify affected accounts and initiate the necessary protective measures. However, it replaces neither an incident response plan nor the legal assessment of reporting obligations.

External IT service providers: responsibility cannot simply be outsourced

Many companies work with external IT partners, cloud providers or specialised service providers. Some of these need access to internal systems and business information.

However, working with external partners does not automatically release companies from their data protection responsibilities.

It should therefore be clearly defined which access is required for which purpose, how long it may last and who is responsible for reviewing it.

Shared accounts in particular deserve attention. If passwords are passed on to external partners, it can become difficult to keep track of how they are used afterwards.

Professional password management can make an important contribution here. Access can be provided in a structured way, permissions can be managed in a targeted manner and revoked when necessary.

For passwords that have already been shared, a password change may also be necessary. Simply removing a share from the password manager does not automatically invalidate a previously known password.

Secure collaboration with external partners therefore requires both technical protection mechanisms and clear organisational rules.

What legal consequences can security failures have?

Data protection breaches and failure to comply with legal security requirements can have significant consequences.

In Switzerland, the FADP provides for fines of up to CHF 250,000 against responsible natural persons for certain intentional violations. Under specific legal conditions, the company may instead be fined up to CHF 50,000.

For particularly serious violations, the GDPR allows fines of up to EUR 20 million or four per cent of worldwide annual turnover, whichever is higher.

Other regulations such as NIS2 also provide for sanction mechanisms, whose specific application depends on the respective legal framework.

However, not every security gap automatically leads to a fine. What matters are the specific legal obligations, the circumstances of the incident and, where applicable, culpability.

Regardless of this, cyberattacks can have operational consequences: work stoppages, recovery costs, possible data loss and damaged customer trust.

Preventive security measures are therefore not only a question of compliance, but also of business risk management.

Conclusion: secure password management is a building block of responsible corporate governance

The regulatory requirements for data protection and cybersecurity continue to evolve. For Swiss companies, this means above all regularly questioning existing security processes.

This is not about deploying as many individual security solutions as possible. What matters is a coherent overall concept that combines technical and organisational measures.

Professional password management can make a significant contribution to this. Through protected storage, controlled sharing, clear permissions and well-defined onboarding and offboarding processes, numerous risks in handling business access can be reduced.

At the same time, further protective measures such as multi-factor authentication, identity management, employee training and effective security incident management remain indispensable.

The key question for companies is therefore not only: are our passwords secure? But also: do we know at all times who is allowed to access which business accounts and how we control this?

Those who can answer these questions and consistently implement the corresponding processes create an important foundation for long-term information security, data protection and digital resilience.

Want to improve password management in your company?

Central and secure management of passwords and access can help companies reduce risks and make internal security processes more efficient. Find out how professional password management can support your organisation in everyday business.