eIDAS 2.0 does not require biometric data to be stored inside the European Digital Identity Wallet itself. The regulation, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and focuses on enabling secure identity verification and data sharing, but it does not mandate that biometric information such as fingerprints or facial images must reside within the wallet. What eIDAS 2.0 does require is that any biometric data used in identity processes is handled in accordance with strict data protection rules, including the General Data Protection Regulation (GDPR). The sections below address the most common questions organizations have about biometrics, the EUDI Wallet, and what this means in practice.
Does eIDAS 2.0 require biometric data to be stored in the wallet?
No, eIDAS 2.0 does not require biometric data to be stored in the European Digital Identity Wallet. The EUDI Wallet is designed to hold verifiable credentials and digital documents, such as a driving licence or an educational certificate, but the regulation deliberately avoids mandating the storage of sensitive biometric data within the wallet itself. Biometrics may be used during the identity proofing process that takes place before a wallet is issued, but that is a separate step.
The distinction matters because many organizations assume that a digital identity wallet automatically implies a biometric database. In practice, the wallet stores attestations about a person’s identity, not raw biometric data. A wallet might contain a credential confirming that a person’s identity was verified at a high assurance level, without storing the fingerprint or facial image that was used to reach that conclusion.
This design choice reflects a core principle of eIDAS 2.0: data minimization. Users should share only what is strictly necessary. Storing biometric data inside the wallet would create unnecessary risk and conflict with that principle.
How does eIDAS 2.0 protect biometric data under GDPR?
eIDAS 2.0 works alongside GDPR to protect biometric data. Because biometric data is classified as a special category of personal data under GDPR Article 9, any processing of it requires an explicit legal basis, such as explicit user consent or a specific legal obligation. eIDAS 2.0 reinforces this by requiring that identity wallets respect user privacy and apply data minimization principles throughout every interaction.
In practical terms, organizations involved in identity verification or wallet issuance cannot collect or retain biometric data beyond what is strictly necessary for the purpose at hand. Once the identity proofing step is complete, the biometric data used during that process should not be retained unless there is a clear and lawful reason to do so.
The regulation also requires that wallet providers and relying parties implement appropriate technical and organizational security measures. This includes encryption, access controls, and audit trails. The combination of eIDAS 2.0 and GDPR creates a layered framework where biometric data is protected at both the regulatory level and through technical design.
What is the difference between biometric authentication and biometric verification in the EUDI Wallet?
Biometric authentication and biometric verification serve different purposes in the context of the EUDI Wallet. Biometric authentication happens on the user’s device and unlocks access to the wallet itself, for example using Face ID or a fingerprint sensor. Biometric verification refers to the process of confirming a person’s identity against a trusted reference, such as a passport photo, and typically happens during the initial onboarding or identity proofing stage.
This is an important distinction for organizations to understand because the two processes have very different data flows and compliance implications.
Biometric authentication: local and device-bound
When a user unlocks their EUDI Wallet using a fingerprint or facial scan, that biometric data never leaves the device. It is processed locally by the device’s secure element. No biometric data is transmitted to the wallet provider or any relying party. This approach is privacy-preserving by design and aligns with the data minimization principles embedded in eIDAS 2.0.
Biometric verification: identity proofing at onboarding
Biometric verification takes place when a person first enrolls and their identity is checked against a government-issued document. This process may involve a liveness check or a comparison between a selfie and a passport photo. This step happens before the wallet is issued and is governed by strict rules about data retention and purpose limitation. Once the identity has been confirmed and the wallet credential issued, the biometric data used in that process should not be stored indefinitely.
Who can access biometric data shared through an identity wallet?
In the EUDI Wallet model, biometric data is generally not shared through the wallet at all. What is shared are verifiable credentials that attest to a person’s identity or attributes, without exposing the underlying biometric data. The user remains in control of what they share and with whom. No relying party, such as a bank or government service, receives raw biometric data through a standard wallet interaction.
Access to any biometric data collected during the identity proofing process is strictly limited. Responsibility for that data rests with the entity that issued the wallet credential, typically an EU Member State authority or a certified trust service provider operating under national supervision, and only for the duration required by law. Governance of the EUDI Wallet is a shared responsibility: the European Commission sets the legal framework and adopts implementing acts, Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, and national competent authorities oversee certification and notification. No single central European authority operationally manages all EUDI Wallets.
eIDAS 2.0 is explicit about user control: individuals must be able to see what data is being shared, with whom, and for what purpose. This applies to all personal data exchanged through the wallet. Any attempt by a relying party to request more data than is necessary for the service they provide would be a violation of both eIDAS 2.0 and GDPR.
What biometric data can be included in verifiable credentials under eIDAS 2.0?
Certain digital documents that can be stored in the EUDI Wallet, such as a mobile driving licence or a digital travel credential, may include a facial image as part of the credential’s data set. These documents are digital representations of physical identity documents that already contain a photo. In that sense, a facial image can be part of a verifiable credential, but it is treated as an identity attribute rather than a biometric template.
The key difference is that a biometric template, such as a fingerprint map or a facial geometry model, is a processed representation used for matching. A facial image, such as the photo on a driving licence, is an identity attribute that a human or system can compare visually. eIDAS 2.0 and the Architecture and Reference Framework for the EUDI Wallet, which provides the technical elaboration of requirements set out in the implementing acts, allow facial images within specific credentials, but they do not introduce a general mechanism for storing or sharing biometric templates.
Organizations in sectors such as healthcare or financial services that handle identity verification should pay close attention to this distinction. Using a facial image from a wallet credential for automated biometric matching would constitute biometric data processing under GDPR Article 9 and would require a specific legal basis.
How should organizations prepare for biometric data requirements in eIDAS 2.0 compliance?
Organizations should start by mapping out where biometric data currently enters their identity processes and what legal basis they rely on for processing it. eIDAS 2.0 compliance is a legal and technical exercise that requires a clear understanding of data flows, retention policies, and the distinction between what happens during identity proofing and what happens during ongoing authentication.
Here are the key steps organizations should take:
- Audit your current identity proofing process. Identify where biometric data is collected, how long it is retained, and whether your current practices align with GDPR’s data minimization and purpose limitation principles.
- Clarify the legal basis for biometric processing. Biometric data is a special category under GDPR Article 9. Make sure you have a lawful basis documented for every stage where biometrics are processed.
- Separate authentication from verification in your architecture. Design your systems so that device-level biometric authentication, which unlocks the wallet, is clearly distinct from identity verification processes that may involve biometric checks.
- Review your data retention policies. Biometric data collected during onboarding should not be retained beyond what is legally required. Update your policies to reflect this.
- Prepare for wallet-based interactions. If your organization will act as a relying party accepting EUDI Wallet credentials, make sure your systems request only the attributes you genuinely need and never attempt to extract or reprocess biometric data from those credentials. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data, and must specify per intended use which attributes and attestations they will request.
The legal deadline for Member States to issue EUDI Wallets and for public-sector bodies to accept notified wallets for online services requiring electronic identification is 24 December 2026. For relevant regulated private-sector organizations, the acceptance obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027. This private-sector obligation covers sectors including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms are subject to a separate provision under Article 5f, which applies where the platform requires user authentication, on a voluntary basis at the user’s request and limited to the minimum necessary data.
These deadlines are legal deadlines, not predicted launch dates. Practical interoperability and national rollout are expected to develop in phases, shaped by each country’s certification and notification process, the readiness of relying parties, and sector-specific requirements that remain national in scope. Organizations in government and regulated industries should follow the technical specifications developed through the large-scale pilot programmes, as these will shape the practical requirements for wallet issuance and credential formats. Staying close to the latest developments in the implementing acts and the Architecture and Reference Framework is essential for organizations building or adapting identity infrastructure.
How the ID Connector supports biometric data compliance under eIDAS 2.0
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations managing biometric data in their identity processes, the ID Connector addresses several of the practical challenges that eIDAS 2.0 compliance creates:
- Wallet acceptance and trust management across every notified wallet solution, so relying parties do not need to build separate integrations per Member State
- Verification against national trusted lists, which are brought together in the EU List of Trusted Lists, to confirm that issuer signatures on credentials are valid
- Revocation status checks using issuer-provided status information, so that credentials presented through the wallet are checked for validity at the point of use
- Wallet unit attestation validation to confirm that the presenting wallet is running on a certified wallet solution
- Attribute scope enforcement aligned with the relying party’s registered intended use under CIR (EU) 2025/848, so that only the attributes the organization is authorized to request are processed
- Reuse of verified identity data across services, reducing the need for repeated biometric checks at onboarding
- Qualified signing via a connected qualified trust service provider, for use cases in financial services, healthcare, and government that require a qualified electronic signature
Organizations in financial services, healthcare, pharma, and government can explore how the ID Connector fits their identity architecture by visiting our identity solutions page or getting in touch to discuss what eIDAS 2.0 means for your specific situation.