GDPR and RADIUS

GDPR and RADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol that verifies identities across networks. It often processes usernames, passwords, and sometimes device identifiers. The General Data Protection Regulation (GDPR) treats this as personal data. That means: data minimization, purpose limitation, and explicit security measures.

Data Flow and Compliance Risk
When a RADIUS server forwards credentials to a central store, it can cross borders. GDPR calls this a data transfer. If the central store is in a non-EU region, you need legal safeguards such as Standard Contractual Clauses. Logging activity in RADIUS becomes another compliance layer—logs store IP addresses, timestamps, and identifiers. Each log entry falls under GDPR’s transparency and retention rules.

Security and Encryption Requirements
RADIUS itself can run over UDP with shared secrets, but GDPR’s Article 32 pushes for stronger protection: TLS wrapping (RadSec), secure storage of shared secrets, and encryption of database at rest. Engineers must ensure integrity checks and limit who can access personal data inside RADIUS deployments.

Retention and Right to Erasure
GDPR mandates that personal data exist only as long as needed. With RADIUS, this means regularly purging authentication logs. Erasure requests must propagate through every RADIUS node and backend. Architecture decisions—centralized versus distributed servers—affect how quickly and completely this can be done.

Operational Steps for Compliance

1. Map every data point RADIUS handles.
2. Document cross-border data flows.
3. Apply encryption in transit and at rest.
4. Set retention schedules and automate deletion.
5. Run DPIAs (Data Protection Impact Assessments) for new deployments.
6. Audit RADIUS configurations against GDPR articles.

GDPR compliance with RADIUS is not optional—it’s enforceable law with significant fines. By designing authentication flows that respect privacy at each packet, you protect users and reduce risk.

Test a GDPR-ready RADIUS workflow and see it live in minutes—start now at hoop.dev.