The EUDI Wallet enables consent-based data sharing by giving users full control over which personal data they share, with whom, and when. Before any information leaves the wallet, the user must actively approve the request. This applies to every interaction, whether opening a bank account, accessing a government service, or proving age online. The sections below explain how this works in practice.
What data can users actually share through the EUDI Wallet?
Users can share a wide range of verified personal data and digital documents through the EUDI Wallet, including identity attributes such as name, date of birth, and nationality, as well as official credentials like driving licences, diplomas, healthcare cards, and travel documents. The wallet acts as a single secure container for both identity data and document-based attestations.
The types of data stored and shareable through the wallet include:
- Personal identity attributes (name, address, nationality, date of birth)
- Government-issued documents (passport data, driving licence, residence permit)
- Academic and professional credentials (diplomas, certificates)
- Healthcare information (European Health Insurance Card, prescriptions)
- Financial credentials (for account opening or strong customer authentication)
- Payment means and transport passes
Not all of this data needs to be shared in every situation. The wallet is designed so that users can share only the specific attributes relevant to a given request. This is a meaningful shift from how identity verification works today, where showing a passport often reveals far more than is actually needed.
How does the EUDI Wallet enforce user approval before sharing data?
The EUDI Wallet enforces user approval through an explicit confirmation step that occurs every time a relying party requests access to personal data. No data is transmitted without the user actively confirming the request on their device. This mechanism is built into the wallet’s architecture and cannot be bypassed by the requesting organisation.
When a service provider sends a data request, the wallet displays a clear overview of exactly what information is being asked for and who is asking. The user then decides whether to approve or reject the request. This process happens in real time and is entirely user-driven.
This approach differs significantly from traditional identity verification methods, where users often have little visibility into what data is collected or how it is used. With the EUDI Wallet, approval is granular, informed, and tied to each individual interaction. The wallet also gives users access to a dashboard showing which organisations have received which data, providing ongoing oversight.
It is important to distinguish between approving a data request in the wallet and giving consent as a legal basis under the GDPR. A relying party needs its own lawful basis for processing the data it receives. For identity verification in regulated contexts such as know-your-customer checks, that basis is typically a legal obligation, not user consent.
What is selective disclosure and how does it work in the EUDI Wallet?
Selective disclosure is the ability to share only specific attributes from an attestation, without revealing the full document or dataset. In the EUDI Wallet, selective disclosure means a user can prove they are over 18 without revealing their exact date of birth, or confirm their nationality without sharing their home address. Only the minimum required information is disclosed.
This works through the use of verifiable attestations in standardised formats such as mdoc and SD-JWT VC, which allow individual data fields within an attestation to be shared independently. The wallet uses cryptographic techniques to ensure that a selectively disclosed attribute remains verifiable and trustworthy, even though the rest of the attestation is not shared.
A practical example makes this concrete. Imagine booking tickets for an age-restricted event. The wallet presents a single verified statement: “This person is 18 or older.” The event organiser receives a cryptographically signed confirmation, and nothing else. Name, address, and exact date of birth stay private. This works through selective disclosure of a specific attribute, without requiring zero-knowledge proofs.
Selective disclosure is one of the most privacy-protective features of the EUDI Wallet and is central to the principle of data minimisation embedded in eIDAS 2.0, which amends Regulation (EU) 910/2014. It also reduces the risk of personal profiling, since organisations only ever receive the attributes they genuinely need.
Who can request data from a user’s EUDI Wallet?
Only registered relying parties can request data from a user’s EUDI Wallet. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of the Member State where they are established before they can request wallet data. Unregistered parties cannot send legitimate data requests to the wallet.
During registration, a relying party specifies per intended use which attributes and attestations it will request. The wallet checks incoming requests against this registered scope, so organisations cannot request data beyond what they have declared.
Relying parties span a broad range of sectors. Public authorities such as tax offices, healthcare providers, and municipal services can request identity data for service access. Private sector organisations including banks, insurers, telecoms providers, and online platforms can also register as relying parties, allowing them to use the wallet for identity verification and onboarding.
When a relying party sends a request, the wallet displays information about who is asking and under what legal basis. Users can see whether the requesting organisation is registered before deciding to share anything. This transparency is a deliberate design choice: users should always know exactly who is on the other side of a data request.
It is worth noting that a relying party must be able to accept every relevant notified wallet, regardless of which wallet provider issued it. Choosing a specific wallet provider is not part of the registration process.
Organisations working in financial services or government are among the first sectors expected to integrate with the EUDI Wallet ecosystem, given their existing regulatory obligations around identity verification.
How does the EUDI Wallet protect against over-collection of personal data?
The EUDI Wallet protects against over-collection by enforcing data minimisation at the technical level. Relying parties can only request the specific attributes they have registered for, and users can reject any request that goes beyond what is necessary. The wallet does not allow bulk data transfers or open-ended access to a user’s credential store.
Several mechanisms work together to prevent over-collection:
- Attribute-level requests: Relying parties must specify exactly which data fields they need, and may only request attributes within their registered scope.
- User approval per interaction: Every data share requires explicit approval, so there is no standing permission that allows repeated or automatic access.
- No central data repository: Data stays on the user’s device and is only transmitted at the moment of sharing. There is no central database that organisations can query.
- Regulatory boundaries: Under eIDAS 2.0, relying parties are legally bound to request only what is proportionate and necessary for their stated purpose.
- User dashboard: Users can review a log of past data shares, giving them visibility and the ability to identify unexpected or excessive requests.
Together, these layers make it structurally difficult for organisations to collect more data than they are entitled to. The wallet shifts the default toward sharing only what is needed and nothing more.
What does consent-based sharing mean for organisations accepting EUDI Wallet attestations?
For organisations that accept EUDI Wallet attestations, consent-based sharing means they will receive verified, user-approved data attributes. This raises the quality and trustworthiness of the data they receive while also placing clear obligations on how that data may be used.
Organisations need to adapt their processes in several ways. They must define precisely which data attributes they need for each use case, register as a relying party with the relevant national authority under CIR (EU) 2025/848, and ensure their systems can technically receive and process attestations in the supported formats. They also need to align their data handling practices with the principle of data minimisation, since they are only entitled to use the data for the purpose stated during registration.
Verified attestations reduce fraud risk, streamline onboarding, and eliminate the need for manual document checks. For sectors like healthcare and financial services, where identity verification is both critical and heavily regulated, the EUDI Wallet offers a more reliable and efficient alternative to current methods. Organisations in healthcare can use it to confirm patient identity securely, while financial institutions can meet know-your-customer requirements with verified data. For healthcare data, relying parties should note that processing requires not only a lawful basis under the GDPR but also a condition under Article 9(2) GDPR, given the special category nature of health information.
The shift also has implications for customer experience. Users who control their own data and understand what they are sharing are more likely to trust the organisations they interact with. Consent-based sharing is a foundation for building lasting digital trust.
How the ID Connector supports consent-based data sharing via the EUDI Wallet
Preparing your organisation for the EUDI Wallet and consent-based data sharing involves technical integration, a clear understanding of the regulatory framework, and a well-defined data strategy for handling attestations securely and at scale.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
TrustTech’s ID Connector is built specifically for organisations managing this transition. In the context of consent-based data sharing, the ID Connector handles:
- Accepting wallet presentations from every notified wallet solution, regardless of the issuing Member State
- Verifying attestations against national trusted lists, consolidated in the EU List of Trusted Lists
- Checking revocation status through issuer-provided status information
- Validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope so that only declared data fields are requested and processed
- Supporting selective disclosure flows so that users share the minimum necessary attributes for each interaction
- Connecting to a qualified trust service provider for qualified signing where required
The ID Connector is relevant across financial services, healthcare, pharma, and government, where identity verification obligations are specific and the consequences of errors are significant. Get in touch with TrustTech to find out how the ID Connector fits your use case.