MFA and CNIL compliance: a joint interview between law and cybersecurity

OP-ED · 2 MAY 2025

With Gaëlle Tilloy, lawyer, and Marc Schmitt, Senior Consultant at SASETY · Lire en français

An interview with Gaëlle TILLOY, attorney at the Paris Bar specialising in new technologies and personal data, and Marc SCHMITT, Senior Cybersecurity Consultant at SASETY, a Silverfort partner.

What is MFA?

Gaëlle TILLOY: Multi-factor authentication, or MFA, is a security method that strengthens the protection of IT systems by combining several elements to verify a user's identity. Unlike traditional authentication based on a single password, MFA requires at least two distinct factors among the following three:

1) a knowledge factor (e.g. password, code),

2) a possession factor (e.g. phone, token),

3) an inherence factor (e.g. fingerprint, facial recognition).

This approach makes unauthorised access much more difficult, even if one of the factors is compromised. MFA is thus part of a defence-in-depth strategy, now expected in many sensitive contexts.

Why did the CNIL publish a specific recommendation on MFA?

Gaëlle TILLOY: The CNIL (the French data protection authority) found that passwords alone no longer provide an adequate level of security in the face of the explosion of cyberattacks. The GDPR requires a level of security proportionate to the risk. In this logic, MFA appears as an essential basic measure in certain contexts. The recommendation of 20 March 2025 clarifies regulatory expectations while guiding organisations on how to implement it in practice.

Marc SCHMITT: In our work at SASETY, we have seen how much companies want a clear framework. The CNIL recommendation is valuable for setting guidelines. We chose to rely on Silverfort, which makes it possible to deploy MFA even on existing environments, with no need to rework applications. Silverfort provides broad, consistent coverage, compatible with GDPR expectations and sector standards such as NIS2 or DORA.

In which cases does the CNIL require MFA to be enabled?

Gaëlle TILLOY: The use of MFA should be guided by the level of risk. Applying it systematically and indiscriminately is not recommended. However, some cases call for a higher level of security: processing of sensitive data (health, financial data…), remote access or access to administration interfaces. Here the CNIL recalls the principle of proportionality set out in the GDPR.

Marc SCHMITT: Silverfort's strength is that it offers both static rules, for example enforcing MFA for access to Tier 0 servers, and dynamic rules. These are triggered according to context: detection of a new device, unusual behaviour, change of location, etc. This ability to orchestrate MFA intelligently is a direct answer to the expectations expressed by the CNIL.

What are the main GDPR principles to respect in an MFA project?

Gaëlle TILLOY: Implementing MFA is a form of personal data processing. As such, it must comply with all GDPR obligations, in particular:

Defining a clear legal basis, generally legitimate interest;
Data minimisation: there is no point collecting a phone number if another option is possible;
Limited retention of authentication data;
And respect for the rights of data subjects, including information, access and objection.

Marc SCHMITT: Silverfort complies with these principles. The product works without its own identity database, relies on the existing set-up (Active Directory, LDAP…) and collects only the metadata needed to analyse access. Retention settings are adjustable. We also help our clients document their compliance, which is essential today, especially to anticipate audits under NIS2 or DORA.

How should the parties involved in an MFA project be qualified?

Gaëlle TILLOY: Whether a party is a data controller or a processor depends on its role in processing the data. The controller defines the purposes and essential means of the processing. The processor acts on behalf of the controller. This distinction matters for determining the contractual and documentation obligations to be met.

Marc SCHMITT: Silverfort can be deployed in different models: on-premises, SaaS or hybrid. This makes it possible to adapt to the client's requirements and clearly define responsibilities between the parties. We help clients include these questions in their impact assessments and in contracts with their providers.

What precautions should be taken regarding biometrics?

Gaëlle TILLOY: The use of biometrics, which relies on sensitive data, requires a strict framework: explicit consent, a defined purpose, reinforced security. It cannot be a default or mass use, and alternatives must always be considered.

Marc SCHMITT: Silverfort supports many authentication factors, including standard ones such as TOTP or FIDO2. This makes it possible to offer robust MFA without resorting to more intrusive methods unless strictly necessary.

How can the security of MFA itself be guaranteed?

Gaëlle TILLOY: The CNIL refers to the recommendations of ANSSI (the French national cybersecurity agency), in particular the use of qualified components and authentication via a secure channel. It is essential that proofs of possession are dynamic and that the factors used rely on proven mechanisms.

Marc SCHMITT: Silverfort meets these technical requirements. It implements robust mechanisms and follows ANSSI recommendations such as R11 (authentication via a secure channel). This secures both the authentication process and the data handled throughout the user journey.

What are the risks if MFA is missing or poorly implemented?

Gaëlle TILLOY: The absence of MFA in a risky context may constitute a breach of the security obligation set out in the GDPR. In the event of an incident, this can lead to sanctions, including financial ones, from the CNIL. The liability of the controller or processor may also be engaged.

Marc SCHMITT: From an operational point of view, poor access management is one of the main intrusion vectors. A compromised password can be enough to access critical resources. MFA considerably reduces this risk. At SASETY, we consider it an essential security standard, particularly to meet the growing requirements of European regulators.

Conclusion: why has MFA become a standard today?

Gaëlle TILLOY: MFA has become an essential security measure because it provides an effective, measurable answer to current threats. It is appropriate, proportionate and GDPR-compliant when properly implemented. It is a key step in managing cyber risk.

Marc SCHMITT: With technologies such as Silverfort, MFA is no longer a technical headache. It becomes a lever of efficiency for IT teams and a guarantee of compliance for legal and security departments. Our role at SASETY is to support our clients in this transition, in a pragmatic and operational way.