Authentication
The process of verifying that an entity — a user, a service or a device — is who or what it claims to be before granting access.
Full Definition
Authentication is the first gate in any access control stack. The simplest form is a password (something you know); strong authentication adds a second factor (something you have — hardware key, authenticator app; something you are — biometric). Modern passwordless flows use FIDO2 / WebAuthn-based device-bound credentials, which eliminate password-reuse and phishing as attack vectors.
For personal-data processing, authentication quality has downstream consequences. A weak authentication on a DSR intake portal lets attackers impersonate the subject and extract their data. A weak authentication on the admin tier lets attackers run unlogged exports. Regulators treat the authentication posture as a factor in the 'reasonable security safeguards' assessment under GDPR Article 32, DPDP Section 8(5), and PDPA. Mandatory multi-factor authentication for admin access, and risk-based step-up for sensitive user actions, is the operational floor.
Related terms
Multi-Factor Authentication (MFA)
An authentication model that requires two or more independent factors — something the user knows, has, or is — to confirm identity.
Access Control
The set of policies and technical mechanisms that determine who can access which personal data, for what purpose and under what conditions.
Single Sign-On (SSO)
An authentication model in which a user signs in once to an identity provider and gains federated access to multiple applications without re-authenticating.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes