Citizens have full control over what data they share from their EUDI Wallet. The European Digital Identity Wallet is built on the principle that you decide what information to share, with whom, and when. No data is shared without your explicit approval, and you are never required to hand over more than what a specific interaction actually needs.
This design reflects the core requirements of eIDAS 2.0, which is Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014. User control and data minimisation sit at the heart of the European Digital Identity framework. Whether you are accessing a government service, opening a bank account, or simply proving your age, the wallet puts you in charge of your own data.
The sections below walk through exactly how that control works in practice, from what the wallet stores to what happens to your data after it has been shared.
What data does the EUDI Wallet actually store about you?
The EUDI Wallet stores verified digital documents and identity attributes that you choose to add to it. This can include your national identity credentials, but also a wide range of other documents such as a driving licence, academic qualifications, health certificates, travel credentials, and more. The wallet does not automatically collect or store data beyond what you actively load into it.
Think of the wallet as a secure digital equivalent of your physical wallet or document folder. Just as you decide which cards and documents to carry with you, you decide what goes into your EUDI Wallet. The digital version stores verified credentials issued by trusted authorities, such as your national government, a university, or a healthcare provider, acting as issuers of Person Identification Data or attestations under the eIDAS 2.0 framework.
The data in your wallet is stored on your own device. Governance of the EUDI Wallet ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, EU Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, and wallet providers are responsible for the technical operation of individual wallet instances. No single central European authority operationally manages all EUDI Wallets, and no single organisation has a complete view of everything your wallet contains.
Examples of what the wallet can store include:
- National identity data (name, date of birth, nationality)
- A mobile driving licence
- Educational diplomas and certificates
- Healthcare documents and prescriptions
- Travel credentials
- Payment-related credentials
- Social security information
How does selective disclosure let you share only what is needed?
Selective disclosure is the mechanism that allows you to share a specific piece of information from your EUDI Wallet without revealing anything else. Instead of handing over an entire document, you share only the single attribute that is actually required. For example, you can prove you are over 18 by disclosing only the attribute confirming that fact, without revealing your exact date of birth, or you can confirm your nationality without sharing your full address.
This is one of the most significant privacy features of the European Digital Identity Wallet, and it represents a meaningful improvement over how identity verification works today. When you show a physical ID card to prove your age, the other party sees your name, address, and date of birth, even though they only needed to know your age. Selective disclosure eliminates that unnecessary exposure.
In practice, when a relying party asks your wallet for a specific piece of data, you see exactly what is being requested before anything is shared. Each request requires your individual approval. If you approve, only that specific attribute is transmitted. Nothing more leaves your wallet.
This approach directly supports the principle of data minimisation, which is a core requirement under both eIDAS 2.0 and the GDPR. Sharing only what is strictly necessary reduces the risk of personal profiling and limits the potential impact of any data breach on the receiving side.
Real-world examples of selective disclosure in action include:
- Booking a cinema ticket for an age-restricted film: share only that you are 18 or older, nothing else.
- Registering for a public service: share your postal code for a local vote, without disclosing your full identity.
- Opening a bank account online: share the identity attributes the bank needs for verification, without handing over unrelated credentials.
- Accessing a healthcare portal: share your patient identifier and relevant health credentials, without including your driving licence or education history.
Who can request access to your EUDI Wallet data?
Only officially registered organisations, known as relying parties, can request data from your EUDI Wallet. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national competent authority of the Member State where it is established before it can request wallet data. Registration covers each intended use, specifying which attributes and attestations will be requested. The wallet checks incoming requests against this registered scope. A random website or unverified app cannot simply ask your wallet for information.
Relying parties must identify themselves to the wallet before making any data request. This means you can see who is asking for your data and for what purpose before you decide whether to share anything. The wallet displays the identity of the requesting organisation, the specific attributes being requested, and the stated reason for the request.
This requirement creates a layer of accountability that does not exist with many current identity verification methods. From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, the acceptance obligation under Article 5f of eIDAS 2.0 extends to relevant regulated private sectors where strong user authentication is required by law or contract. These sectors include banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms fall under a separate provision of Article 5f: for those platforms, the obligation applies where the platform requires user authentication, on the voluntary request of the user, and only for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt from the private acceptance obligation. Government services and regulated private sector organisations are among the sectors actively preparing to become recognised relying parties.
You always have the right to decline a data request. If you do not approve, no data is shared, and you can still choose to use alternative methods to access the service if available.
Can you see and revoke which organisations have accessed your data?
Yes. The EUDI Wallet is designed to give you a clear overview of which organisations have received data from your wallet and when. The wallet dashboard makes this history visible to you directly within the app, giving you a practical tool to understand where your information has gone.
This level of visibility is a meaningful step forward compared to how personal data flows today, where it is often difficult or impossible to know which third parties have received your information.
Beyond visibility, the wallet framework also supports the ability to manage future data sharing with specific organisations. The exact implementation of these features will vary depending on the wallet solution provided by each Member State, since it is Member States that are responsible for providing or mandating wallet solutions and for certifying and notifying them. The underlying eIDAS 2.0 regulation requires that users maintain meaningful control over their data, including the ability to manage and review ongoing data sharing relationships. It is worth noting that each data request requires your individual approval in the wallet. This approval is a separate matter from the legal basis a relying party must hold under the GDPR for processing the data it receives.
This kind of user-facing control is especially relevant for organisations in financial services and other regulated sectors, where data governance and audit trails are critical requirements. For citizens, it means that approving a data request once does not mean giving up control permanently.
What happens to your data after a relying party receives it?
Once a relying party receives data from your EUDI Wallet, that data is governed by existing EU data protection law, primarily the GDPR. The organisation that received your data must hold a valid legal basis for processing it under the GDPR. It may use the data only for the specific purpose stated at the time of the request, and it cannot retain the data longer than necessary for that purpose. For identity verification in regulated contexts such as banking, the legal basis is typically a statutory obligation. Where health data is involved, a separate condition under Article 9(2) GDPR is also required.
The EUDI Wallet controls what data leaves your device and under what conditions. Once data has been transmitted to a relying party, the wallet itself no longer governs what happens to it. That is where the GDPR takes over.
Relying parties cannot use your wallet data for purposes beyond what they declared when requesting it. They cannot sell it to third parties without a separate legal basis, and they must comply with data subject rights, including your right to access, correction, and erasure under the GDPR.
The combination of eIDAS 2.0 and the GDPR creates a two-layer protection model. The wallet controls the moment of disclosure, ensuring you share only what is needed with verified parties. Data protection law then governs what happens to that data once it has been shared. Understanding this distinction helps organisations and citizens alike set realistic expectations about what EUDI Wallet data control actually covers.
For organisations preparing to integrate with the EUDI Wallet ecosystem, digital identity solutions need to account for both layers: the technical and registration requirements for becoming a recognised relying party under CIR (EU) 2025/848, and the compliance obligations that apply once user data is received.
How the ID Connector supports EUDI Wallet data privacy in practice
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of data privacy and user control, the ID Connector handles several of the technical layers that make compliant wallet acceptance possible:
- Verifying the issuer signature of received attestations against the relevant national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL)
- Checking the revocation status of attestations using issuer-provided status information
- Validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope, so that only the attributes declared during relying party registration under CIR (EU) 2025/848 are requested and processed
- Supporting qualified signing via a connected qualified trust service provider, where that is required
Organisations in financial services, healthcare, pharma, and government that are preparing for the acceptance obligations under eIDAS 2.0 can use the ID Connector to meet the technical requirements on the relying party side without building that infrastructure from scratch. Contact TrustTech to find out how the ID Connector fits your organisation’s integration requirements.