eIDAS 2.0, which amends Regulation (EU) 910/2014, gives citizens direct control over their personal data by requiring that the European Digital Identity (EUDI) Wallet lets users decide exactly what information they share, with whom, and when. This is a significant shift from earlier digital identity systems, where data sharing was often opaque or bundled. The regulation places personal data sovereignty at the centre of digital identity in Europe. Below, we break down the most important questions citizens and organisations are asking about this new framework.
What rights does eIDAS 2.0 give citizens over their personal data?
Under eIDAS 2.0, citizens have the right to selectively share only the personal data that is strictly necessary for a given interaction, without exposing additional information. The regulation requires that the EUDI Wallet be designed with privacy by default, meaning data minimisation is built into the system rather than left to individual service providers. These rights apply to all EU citizens, residents, and businesses.
In practical terms, eIDAS 2.0 strengthens an individual’s position in digital interactions in several important ways:
- Informed approval: Users must explicitly approve the sharing of any piece of data before it is transmitted to a third party. This approval in the wallet is separate from the relying party’s own legal basis for processing under the GDPR.
- Data minimisation: Only the data genuinely required for a service can be requested. A service asking for your age cannot demand your full date of birth if a simple age confirmation suffices.
- Transparency: Citizens can see which organisations have requested access to their data and for what purpose, through the wallet’s dashboard.
- Portability: Identity data stored in the wallet can be reused across different services without starting from scratch each time.
- Per-interaction control: Users approve each data request individually. Each interaction requires a fresh approval before any data leaves the wallet.
These rights represent a meaningful step toward genuine personal data sovereignty. Citizens interact with digital services on their own terms, presenting only what a given situation requires.
How does selective disclosure work in the EUDI Wallet?
Selective disclosure in the EUDI Wallet means that a user can share a single attribute from their identity, such as proof of age or nationality, without revealing any other personal details stored in the wallet. This is made possible through verifiable credentials and cryptographic techniques that allow specific claims to be confirmed without exposing the underlying data.
A straightforward example makes this concrete. Suppose you want to buy a ticket for an age-restricted event online. The EUDI Wallet lets you share only a confirmed “over 18” attribute, derived through selective disclosure from your Person Identification Data. The service receives a tamper-evident, cryptographically verified answer to the question it actually needs, and nothing more. Your name, address, and full date of birth remain entirely private.
This approach is fundamentally different from how identity has traditionally worked online. Most current systems require users to hand over more information than necessary, simply because the infrastructure was not designed to separate individual attributes. The EUDI Wallet’s architecture, built on open technical specifications developed and tested through large-scale pilot programmes across EU Member States, is designed specifically to enable this kind of granular, attribute-level sharing. The credential formats prescribed by the Architecture and Reference Framework (ARF) are mdoc and SD-JWT VC.
For organisations, selective disclosure also reduces liability. When a service only receives the data it genuinely needs, it holds less sensitive information, which limits exposure in the event of a data breach.
Who can access the data stored in the EUDI Wallet?
Only the wallet holder controls access to data stored in the EUDI Wallet. No third party, including the wallet provider, the issuer of Person Identification Data or attestations, or the Member State that provided the wallet, can access or share the user’s data without explicit approval. Access is granted on a per-interaction basis, meaning each data request must be individually approved by the user.
Organisations wishing to request data from a wallet must be registered as a relying party under CIR (EU) 2025/848, adopted on 6 May 2025, by registering with the national competent authority of their Member State of establishment. Registration specifies, per intended use, which attributes and attestations the relying party is permitted to request. The wallet checks each incoming request against this registered scope. Once registered, these organisations are part of the trust ecosystem, and users can see exactly who is making a request before deciding whether to respond. Unregistered parties cannot receive wallet data.
It is also worth noting that the EUDI Wallet is designed so that data is stored on the user’s own device. This architectural choice significantly reduces the risk of large-scale data breaches and prevents any single organisation from building a profile of a user’s activity across different services. Governance of the overall framework is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, and the European Digital Identity Cooperation Group supports cross-border alignment. The wallet facilitates the exchange of identity data within a user’s home country and, where certified wallets and registered relying parties are in place, across other EU Member States, all while keeping the individual in control.
What is the difference between eIDAS 2.0 and GDPR data rights?
eIDAS 2.0 and the GDPR both protect personal data, but they operate at different levels. The GDPR sets out broad legal rights around how organisations collect, store, and process personal data. eIDAS 2.0 goes further by defining the technical and regulatory infrastructure that actively enforces data minimisation and user control at the point of interaction, before data is even shared.
The GDPR gives you the right to request that an organisation delete your data after the fact. eIDAS 2.0 gives you the technical means to avoid sharing unnecessary data in the first place. The two frameworks are complementary.
There are a few key distinctions worth understanding:
- Scope: The GDPR applies to all personal data processing by organisations. eIDAS 2.0 specifically governs digital identity, authentication, and trust services across the EU.
- Mechanism: The GDPR relies on legal obligations and enforcement. eIDAS 2.0 embeds data control directly into the technical architecture of the EUDI Wallet, with legally binding requirements set out in implementing acts and technical elaboration provided by the Architecture and Reference Framework (ARF).
- Timing: GDPR rights are often exercised after data has been shared. eIDAS 2.0 operates at the moment of sharing, giving users real-time control over what leaves their wallet.
- Enforcement: Both frameworks carry compliance obligations for organisations, but eIDAS 2.0 introduces specific requirements around relying party registration, administered at national level by competent authorities, and technical interoperability that go beyond the GDPR’s scope.
A relying party also needs its own GDPR legal basis for processing the data it receives. In regulated contexts such as KYC, that basis is typically a legal obligation. For health data, an additional condition under Article 9(2) GDPR applies. Compliance with eIDAS 2.0 does not automatically mean compliance with the GDPR, and vice versa.
How can organisations ensure compliance with eIDAS 2.0 data control requirements?
Organisations can work toward compliance with eIDAS 2.0 data control requirements by registering as a relying party under CIR (EU) 2025/848 with the national competent authority of their Member State of establishment, updating their data request practices to align with data minimisation principles, and integrating their systems with EUDI Wallet-compatible infrastructure. Compliance is a legal obligation and, in practice, an opportunity to streamline identity verification and reduce onboarding friction.
24 December 2026 is the deadline by which every EU Member State is required to have at least one certified EUDI Wallet available to citizens, residents, and businesses. From that date, public bodies must accept notified wallets as a valid means of identification for online services that require electronic identification. This deadline does not guarantee that every national wallet will reach the same level of maturity simultaneously, or that every possible cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are likely to develop in phases, and organisations should plan accordingly.
For regulated private-sector organisations, including those in financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, an obligation to accept the EUDI Wallet applies from 24 December 2027 under Article 5f of the regulation, specifically in contexts where strong user authentication is legally or contractually required. Very large online platforms (VLOPs) with more than 45 million users in the EU fall under a separate provision of Article 5f: they must accept the EUDI Wallet where they require user authentication, on the voluntary request of the user and for the minimum data necessary. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the Article 5f obligation. For organisations in scope, 24 December 2026 marks the point at which wallets become available in practice, making it the right moment to begin testing wallet-ready integration ahead of the 2027 deadline.
Practical steps organisations should take include reviewing which personal data they currently collect during onboarding or verification processes, identifying where data requests can be reduced to the minimum necessary, and working with identity infrastructure providers who already support verifiable credentials and eIDAS 2.0 standards.
How TrustTech helps organisations with eIDAS 2.0 data control
Preparing for eIDAS 2.0 is an opportunity to build a more efficient, user-friendly, and trustworthy digital identity infrastructure. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
Using the ID Connector, organisations can:
- Implement wallet-ready identity verification that supports selective disclosure and data minimisation from day one
- Replace repeated identity checks with reusable, tamper-evident credentials that work across services and borders
- Verify incoming wallet presentations against national trusted lists, check revocation status, and validate wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution
- Enforce the registered attribute scope per intended use, so that only the data a relying party is registered to request can be exchanged
- Integrate qualified digital signatures via a connected QTSP and identity-linked approvals into existing workflows
- Address eIDAS 2.0 requirements alongside GDPR, AML, and KYC obligations through a single interface
- Reduce onboarding drop-off and compliance overhead simultaneously
The ID Connector sits between the parties that need to interact, enabling secure and trusted digital exchanges without creating new data silos or dependencies. Organisations in financial services, healthcare, pharma, and government can use it to move from manual or fragmented identity processes to wallet-ready flows that are built for the EUDI Wallet era. Ready to take the next step? Get in touch with TrustTech to discuss how your organisation can prepare for eIDAS 2.0.