Multi-Factor Authentication (MFA)
An authentication model that requires two or more independent factors — something the user knows, has, or is — to confirm identity.
Full Definition
Multi-Factor Authentication adds a second factor to the password baseline: a time-based code from an authenticator app (TOTP), a push notification on a trusted device, a hardware security key (FIDO2/WebAuthn), or an SMS one-time code (progressively phased out in favour of stronger methods). Phishing-resistant MFA — specifically FIDO2 / passkeys — is the current standard because it binds the authentication to the specific origin, defeating credential phishing and real-time proxy attacks.
MFA is now effectively mandatory in regulated environments. SOC 2, PCI DSS v4.0 and ISO 27001 all require MFA for administrative access. Under GDPR Article 32, DPDP Section 8(5) and PDPA's Protection Obligation, lack of MFA on sensitive systems is a near-automatic finding of inadequate security safeguards. For privacy-impacting systems (DSR portals, admin consoles, consent management interfaces), MFA on both the end-user side and the staff side is baseline practice.
Related terms
Authentication
The process of verifying that an entity — a user, a service or a device — is who or what it claims to be before granting access.
Access Control
The set of policies and technical mechanisms that determine who can access which personal data, for what purpose and under what conditions.
Single Sign-On (SSO)
An authentication model in which a user signs in once to an identity provider and gains federated access to multiple applications without re-authenticating.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes