New ICO GDPR guidance: Passwords and encryption in online services and websites

The latest guidence from the ICO (Information Commissioner's Office) could be relevent to anyone operating a website that allows users to log in, whether it's staff, volunteers, customers, or the general public. Although the GDPR does not say anything specific about passwords, you are required to process personal data securely by means of appropriate technical and organisational measures.
Source