MFA for coaches: how to secure your practice in 2026

MFA for coaches: how to secure your practice in 2026

MFA means that when you log in you provide two proofs instead of one. First your password, then for example a code from an app on your phone. For coaches this is not a technical detail. Your session notes often contain things a coachee tells no one else: doubts about work, conflicts, stress, sometimes health. If someone steals your password, without MFA they can access all those notes right away. With MFA they cannot. In this article you will learn what MFA is, whether it is mandatory, which method to choose and how to set it up in an afternoon.

TL;DR

• MFA (multi-factor authentication) requires two kinds of proof when you log in, for example your password plus a code from an app. Two passwords do not count.
• Mandatory? There is no separate law for coaches. But the GDPR requires appropriate protection, and according to the Dutch Data Protection Authority, MFA is part of that if you process sensitive data, such as health information.
• Choose an authenticator app or passkey, not SMS. The NCSC advises against SMS because those messages are not encrypted.
• Start with your email, then your coaching software, calendar, storage and bank.
• MFA is a start. Also record who has access to what and what you do if you lose your phone.

Table of contents

• What MFA is, in plain terms
• Is MFA mandatory for a coach?
• Which accounts to secure first
• Which MFA method suits you
• Setting up MFA in five steps
• An unexpected MFA notification, or losing your phone
• MFA is a start, not the whole story
• How we view login security
• A coaching environment where MFA comes as standard
• Frequently asked questions
• Sources

What MFA is, in plain terms

MFA stands for multi-factor authentication. You may know it as two-step verification or 2FA. 2FA is the most common form of MFA: exactly two steps.

The idea is simple. A system wants to be sure that it is really you. For that there are three kinds of proof. The Dutch Data Protection Authority names these three factors:

1. Something you know, such as a password or PIN.
2. Something you have, such as your phone with an app, or a physical key.
3. Something you are, such as your fingerprint or your face.

With MFA you combine at least two of these kinds. That is the key point. A second password or a security question is still “something you know.” So that combination does not count as MFA.

Why does this work so well? The NCSC calls logging in with only a username and password vulnerable to phishing. Phishing is a fake email or fake website that gets you to log in, so someone else obtains your details. Coaches receive such emails too: a fake invoice, a “shared document” or a notice that your mailbox is full. Click wrongly once, and the attacker has your password. With MFA they still lack your phone or your fingerprint. They then face a second lock.

Is MFA mandatory for a coach?

Short answer: nowhere does it say “coaches must use MFA.” But that does not mean you can skip it.

What the GDPR asks of you

The GDPR is the General Data Protection Regulation, the European privacy law. As a coach you process personal data: names, contact details, goals, records of conversations. Article 32 of the GDPR requires appropriate technical and organisational measures to protect that data. What is “appropriate” depends on how sensitive the data is and what could go wrong.

The Dutch Data Protection Authority (AP) is the Dutch supervisory body. On its page about the security of personal data, the AP states that organisations which process sensitive data, such as health data, must use at least multi-factor authentication.

Does your practice fall under this?

That depends on what you write down. A career coach who only records work experience and goals processes less sensitive data than a life coach who talks with a coachee about burnout, grief or sleep problems. But an executive coach too often hears confidential things about an organisation, a reorganisation or a colleague. In practice, most coaches occasionally note something that touches on health or wellbeing.

Not sure whether your notes contain sensitive data? Then assume they do. If you genuinely have doubts about your situation, a privacy lawyer or the AP website is the right place for an answer.

What happens when things go wrong

The AP has intervened more than once with organisations without MFA. The Amsterdam hospital OLVG received a fine of 440,000 euros in 2021, partly because there was no two-factor authentication when logging into medical records. Earlier, the AP imposed on the UWV an order subject to a penalty of 150,000 euros per month, because employers could log into a portal with health data without MFA.

A small coaching practice is not a hospital. The amounts say little about your risk. But the lesson says a lot: for the AP, logging in with only a password is not enough when the data is sensitive. On top of that comes the damage that is not a fine. A coachee who hears that his records have been exposed will not come back. And he tells others.

Which accounts to secure first

You do not have to do everything in one day. Start with the accounts where the most damage can occur. The NCSC advises classifying accounts by impact: low, medium and high. For a coach that looks roughly like this:

A tip: also look at accounts you have almost forgotten. An old Dropbox with intake forms from 2021, a free form tool you once used. Turn on MFA there, or delete the account if you no longer need it.

Which MFA method suits you

Not every form of MFA is equally strong. On the page How do you choose an MFA method? the NCSC explains the available methods. There the NCSC strongly advises against using SMS where possible, because SMS messages are not encrypted and can be intercepted.

Authenticator app: the practical standard

An authenticator app is free and works on any smartphone. Well-known apps are Microsoft Authenticator and Google Authenticator. You scan a QR code once, after which the app keeps generating a new, short-lived code. For most coaches this is the best first step.

Passkeys: beyond the password

A passkey is a newer way of logging in. The NCSC explains that passkeys work with your fingerprint or facial recognition on your own device. The digital key belongs to that one website. A fake website therefore cannot do anything with it. If a service offers passkeys, that is often the strongest and at the same time easiest choice. The NCSC names passkeys and security keys based on the FIDO2 standard as the best protection against phishing.

Setting up MFA in five steps

For most services it works roughly like this. The exact buttons differ per account.

1. Install an authenticator app on your phone. Do this before you start, so you do not have to stop halfway.
2. Go to the security settings of the account. Look for words like “two-step verification,” “2FA,” “MFA” or “login and security.”
3. Choose the app or a passkey as the method, not SMS. Scan the QR code with your app and enter the first code to confirm.
4. Save your recovery codes. Many services give you a list of backup codes. Keep them on paper in a safe place, or in your password manager. Not as a photo on the same phone.
5. Test it. Log out, log back in and check that the second step works. Then move on to the next account on your list.

Count on ten to fifteen minutes per account. With the eight accounts from the table you will be done in an afternoon.

Do you work with multiple coaches?

If you work with colleagues or an assistant, make sure everyone uses MFA. A practice is only as strong as its weakest account. Do not use a shared login for an entire practice. Then you do not know who did what, and you cannot properly remove access from someone who leaves.

An unexpected MFA notification, or losing your phone

An MFA notification is the message you receive on your phone while logging in: a code, or a question like “Are you trying to log in?” Normally that notification only comes when you log in yourself.

Do you get a notification while you are not logging in? Then do not approve it. It usually means someone else has your password and is now trying to get in. MFA has just done its job. Change the password of that account right away.

Do you think an account has been hacked after all? The NCSC provides a step-by-step plan to recover a hacked account. An important point from it: only changing your password is not enough. Also log out on all devices where the account is active. Otherwise someone who is already in can simply stay. If it concerned an account with coachees’ data, also check whether you need to report a data breach to the AP.

Lost your phone or got a new device? Use your recovery codes to log in and then link your new phone. That is why step 4 is so important. Without recovery codes it can take days before you can get back into your own account.

MFA is a start, not the whole story

MFA protects the front door. But properly securing your practice requires more.

• Know who can access what. The AP recommends making an overview of who has access to which personal data and why. For a solo coach that is a short list. For a practice with an assistant or several coaches, it prevents everyone from being able to view everything.
• Use a password manager. The NCSC names strong, unique passwords and a password manager as a foundation, alongside MFA.
• Keep data together. The more scattered places, the more accounts you have to secure. Notes in an app, intakes in a form tool, records in Word in the cloud and appointments via WhatsApp: each of those places is an extra door.
• Make agreements with your suppliers. Software that stores coachees’ data processes that data for you. For that you enter into a data processing agreement, a contract about how they handle that data.
• Review your entire administration. Your bookkeeping and business apps belong here too. This IT checklist for freelancers and SMEs in 2026 helps you thoroughly go through your business systems once.

Want to know where your practice stands now? With our GDPR checklist for coaches you go through the obligations one by one. The short privacy check for coaching gives you a first impression in a few minutes.

How we view login security

We build Exantur for coaches. We often see the same picture. A coach has carefully thought about confidentiality within the session itself. But the records are spread across five tools, with five passwords, two of which are the same. That is not unwillingness. It grows that way, tool by tool.

That is why we do not see MFA as an extra, but as a foundation. Someone who tells you their doubts, their fears or their plans for a new job should be able to assume that this cannot be read with just a stolen password. That is why MFA is in Exantur. As is hosting in the EU, in Frankfurt, and a data processing agreement you can enter into. One organisation’s data is strictly separated from another’s.

We are also honest about the limits. Software with MFA does not automatically make your practice GDPR-proof. You decide what you write down, how long you keep it and who can access it. We can make it easier for you to do that well. The choices remain yours.

Martijn

A coaching environment where MFA comes as standard

Want fewer separate accounts to secure? Exantur brings your practice together in one place. You manage coachees, programmes, session notes, goals, check-ins, intake forms and assessments such as DISC and Wheel of Life in one workspace, secured with MFA. Your coachees get their own portal for coachees, so shared documents and assignments no longer have to go via separate email or chat apps. For practices with multiple coaches there are teams, roles and audit logs, so you can see who did what.

The Mini plan costs €19 per month or €190 per year. Starter costs €49 per month, Growth €99 per month and Practice €199 per month. View all plans and pricing or read more about secure coaching software. You can try Exantur for free first.

Frequently asked questions

What does MFA stand for?

MFA stands for multi-factor authentication. When you log in, you prove in at least two different ways that it is really you. For example, with your password and a code from an app on your phone.

Is MFA legally mandatory for coaches?

There is no law that specifically requires coaches to use MFA. The GDPR does require appropriate protection of personal data. According to the Dutch Data Protection Authority, MFA is the minimum needed if you process sensitive data, such as health information. Many coaches record such information, so for most practices MFA is in practice the norm.

What is the difference between 2FA and MFA?

2FA, two-factor authentication, uses exactly two steps. MFA is the broader term for two or more steps. For a coach the difference is small: turn it on, and choose a strong second step such as an authenticator app or passkey.

Is an SMS code good enough?

An SMS code is better than just a password, but it is the weakest form. The NCSC advises against SMS, because messages are not encrypted and can be intercepted. Where possible, choose an authenticator app, a passkey or a security key.

Sources

• Security of personal data | Dutch Data Protection Authority
• Access to personal data | Dutch Data Protection Authority
• Hospital OLVG fined for inadequate security of medical records | Dutch Data Protection Authority
• AP compels UWV with a sanction to better secure data | Dutch Data Protection Authority
• How do you choose an MFA method? | NCSC
• Mature authentication | NCSC
• What are passkeys? | NCSC
• How do you recover a hacked account? | NCSC

Recommendations

• Best practice management software for coaches