To comply with GDPR, do I need passwords hashed?
<p>I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article?</p>

<p>Please cite and refer to any specific article number that applies, where possible.</p>

<p>As <a href="https://law.stackexchange.com/questions/19519/to-comply-with-gdpr-do-i-need-passwords-hashed#comment34078_19519">@gnasher729 has commented</a>, "a merely hashed password database is criminally insecure. Salted + hashed is the standard, and protecting your database is also required."</p>

<p>GDPR Paragraph 78 says (inter alia)</p>

<blockquote>
  <p>In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default.</p>
</blockquote>

<p>Hash without salt is hardly good design.</p>

european-union gdpr