Cybersecurity Policy Report, MFA Advice Offered by French Data Protection Authority, (Apr 1, 2025)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has released its recommendations on multifactor authentication (MFA) to ensure compliance with security requirements under the European Union’s General Data Protection Regulation (GDPR).

In a news release today, CNIL said its MFA recommendations were part of its approach to identifying cybersecurity solutions in light of the increase of cyber threats associated with the digitalization of economic activity. Such solutions, like MFA, are useful for ensuring information security, but CNIL said they also must be GDPR-compliant in their design when they rely on the use of personal data.

The recommendations, which may be accessed from the news release but are available only in French, aim to inform data controllers on the following topics:

1. The conditions under which recourse to MFA is appropriate with regard to security needs;

2. Compliance with GDPR principles in the context of MFA use, particularly with regard to legal basis, data minimization, retention periods, and respect for the rights of data subjects;

3. Determining the qualifications of the actors involved in an MFA solution;

4. The choice of MFA methods and their compliance with the GDPR; and

5. The points of contention relating to the use of various forms of MFA.

The recommendations are addressed to data controllers and subcontractors, in particular their data protection officers (DPOs), information systems security officers (ISSOs), and their teams, as well as providers of MFA solutions.

News: InternationalLegislation DataSecurity DataPrivacy GDPR