eIDAS 2.0, formally Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014, and GDPR are designed to work together. eIDAS 2.0 governs how digital identities are established, verified, and used across Europe, while GDPR governs how personal data is processed. Both frameworks share a common foundation: privacy by design, data minimisation, and user control. For organisations implementing the EUDI Wallet or working with verifiable attestations, compliance with one framework generally supports compliance with the other, but there are specific overlaps and responsibilities that require careful attention.
The sections below walk through the most common questions organisations ask when trying to understand how these two major European regulations interact in practice.
Where do eIDAS 2.0 and GDPR actually overlap?
eIDAS 2.0 and GDPR overlap wherever personal data is used to establish or verify digital identity. Both frameworks require data minimisation, purpose limitation, and user consent where applicable. eIDAS 2.0 builds on these GDPR principles by making them structural requirements of the European Digital Identity ecosystem, particularly through the design of the EUDI Wallet.
The most visible area of overlap is data minimisation. GDPR requires that only the minimum necessary personal data is collected for a given purpose. eIDAS 2.0 reinforces this directly: the EUDI Wallet is designed so that users share only the specific attributes needed for a transaction, and nothing more. For example, a user proving they are over 18 can share that fact alone through selective disclosure of the relevant attribute, without revealing their date of birth, name, or any other personal detail.
Both frameworks also emphasise user control. GDPR gives individuals rights over their personal data, including the right to access, correct, and erase it. eIDAS 2.0 extends this by giving users active control over what identity data is shared, with whom, and when. This is a regulatory requirement built into the architecture of the entire identity ecosystem, not merely a technical feature of the wallet.
Finally, both frameworks require organisations to implement appropriate security measures when handling personal data. Under eIDAS 2.0, trust service providers and relying parties must meet defined security standards. These requirements align closely with the GDPR obligation to implement technical and organisational measures to protect personal data.
Does eIDAS 2.0 override or conflict with GDPR?
No, eIDAS 2.0 does not override GDPR. The two regulations operate in parallel and are mutually reinforcing. eIDAS 2.0 explicitly states that it does not affect the application of GDPR. Where eIDAS 2.0 introduces new obligations around digital identity, those obligations must still be fulfilled in a way that is consistent with GDPR requirements.
In practice, this means that organisations cannot use eIDAS 2.0 compliance as a reason to bypass their GDPR obligations. For instance, even if a relying party is legally required to verify a user’s identity under eIDAS 2.0, it must still have a valid legal basis under GDPR for processing the personal data involved in that verification.
Where potential tension can arise is around record-keeping and audit trails. eIDAS 2.0 requires that certain transactions involving qualified electronic signatures and trust services are logged and verifiable. GDPR, on the other hand, limits data retention to what is necessary. Organisations need to ensure that their audit and logging practices are proportionate, clearly documented, and tied to a legitimate purpose under both frameworks.
The EU legislator designed eIDAS 2.0 with GDPR in mind. The architecture of the EUDI Wallet, for example, is built around selective disclosure and unlinkability, meaning that wallet providers cannot track which services a user accesses. This is a direct response to GDPR’s requirements around purpose limitation and data minimisation.
How does the EUDI Wallet affect GDPR data subject rights?
The EUDI Wallet strengthens GDPR data subject rights in meaningful ways. By giving users direct control over which attributes they share and with whom, the wallet makes it easier for individuals to exercise their rights in relation to data minimisation and purpose limitation. At the same time, organisations accepting wallet-based attestations must still fulfil their obligations under GDPR when they process the data they receive.
Consider the right to erasure. Under GDPR, individuals can request that an organisation deletes their personal data. When identity data is shared via the EUDI Wallet, the relying party receives an attestation containing specific attributes. That data, once received and processed, is still subject to GDPR. The relying party must have a retention policy in place and be prepared to respond to erasure requests where no legal obligation requires it to keep the data.
The wallet also affects how organisations think about consent and transparency. GDPR requires that individuals are clearly informed about how their data will be used. The EUDI Wallet’s selective disclosure mechanism makes it easier to present users with a clear picture of exactly what data is being requested and why. This supports GDPR’s transparency requirements in a way that traditional identity verification processes often struggle to achieve.
One area that organisations in financial services and other regulated sectors should pay attention to is the interaction between wallet-based identity verification and their existing GDPR frameworks. It is important to distinguish between a user approving a data request within the wallet and consent as a legal basis under GDPR. The wallet handles the identity verification step; your organisation still needs its own valid legal basis for any downstream data processing. Accepting an attestation from an EUDI Wallet does not replace the need to inform users about that processing.
Who is the data controller under eIDAS 2.0 — the wallet provider, the relying party, or the user?
Under eIDAS 2.0, data controller responsibilities are distributed across multiple parties, depending on the specific processing activity. Governance of the EUDI Wallet ecosystem is itself a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; and the European Digital Identity Cooperation Group supports cross-border alignment. Within this structure, wallet providers, credential issuers, qualified trust service providers, and relying parties each carry distinct obligations. GDPR’s concept of data controllership applies to each of them separately for their own processing activities.
The wallet provider is responsible for the infrastructure that stores and transmits identity attributes. However, eIDAS 2.0 explicitly prohibits wallet providers from tracking which services a user accesses or combining data across transactions. This limits the wallet provider’s role as a data controller to the minimum necessary for operating the wallet itself.
The relying party, meaning the organisation that requests and receives identity data from the wallet, becomes a data controller the moment it processes that data. From that point, all GDPR obligations apply: lawful basis for processing, data subject rights, retention limits, and security requirements. Organisations in government services and healthcare that rely on identity verification for access to sensitive services need to be particularly clear on this point. It is also worth noting that under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data. Registration is scoped per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A vendor that processes wallet data on behalf of a client does not thereby become the relying party. The registration obligation rests with the organisation that delivers the service to the end user.
The credential issuer, such as a government authority that issues a digital driving licence or qualification certificate, is a data controller for the issuance process. Once the attestation is in the user’s wallet, the issuer’s processing role typically ends, unless it is required to maintain records for legal or audit purposes. An issuer must also make revocation status available and support re-issuance when a user moves to a new device, since private keys do not leave the secure cryptographic device and attestations cannot simply be copied across.
The user is not a data controller in the legal sense, but they are the central actor in the approval and disclosure flow. The wallet puts users in a position of genuine control, which is consistent with GDPR’s emphasis on individual rights, without making them legally responsible for the processing that happens downstream. The wallet’s dashboard is a tool for the user to review past presentations. It is not a logging facility for the wallet provider.
What compliance steps should organisations take to align eIDAS 2.0 with their GDPR obligations?
Organisations should treat eIDAS 2.0 implementation as an opportunity to strengthen their GDPR compliance posture. The two frameworks share enough common ground that a well-designed digital identity approach can satisfy both simultaneously. The key is to be deliberate about how identity data flows through your systems and who is responsible at each stage.
Here are the most important steps to take:
- Map your identity data flows. Understand exactly what personal data is collected, from which sources, for what purpose, and how long it is retained. This is a GDPR requirement and the foundation of any eIDAS 2.0 implementation.
- Establish a lawful basis for each processing activity. Accepting identity attestations from an EUDI Wallet still requires a valid legal basis under GDPR. Document this clearly, especially where you are relying on legal obligation or legitimate interest. For KYC processes, the legal basis is typically a statutory obligation rather than consent.
- Review your privacy notices. Users must be informed about how their identity data will be processed after verification. Update your privacy notices to reflect the wallet-based verification flow and any new data sources.
- Implement data minimisation by design. Work with your technical teams to ensure that your systems only request the attributes they genuinely need. Configure your registered attribute scope under CIR (EU) 2025/848 accordingly. This is both a GDPR requirement and a core principle of eIDAS 2.0.
- Define your data retention policies for identity data. Audit logs and identity records must be retained only as long as necessary. Balance eIDAS 2.0 audit requirements with GDPR’s storage limitation principle.
- Clarify data controller responsibilities with third parties. If you work with a trust service provider or wallet infrastructure partner, ensure that your data processing agreements are up to date and clearly define who is responsible for what.
Organisations in sectors such as healthcare and pharmaceuticals face additional complexity because they process special category data under GDPR. In these cases, a lawful basis under Article 9(2) GDPR is required in addition to a standard processing ground, and a data protection impact assessment (DPIA) is strongly recommended before implementing any eIDAS 2.0-based identity verification process.
It is also worth keeping the implementation timeline in perspective. The legal deadline for Member States to make EUDI Wallets available and for public bodies to accept notified wallets for online services requiring electronic identification is 24 December 2026. For relevant regulated private sectors where strong user authentication is legally or contractually required, the acceptance obligation under Article 5f applies from 24 December 2027. That date covers sectors including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms are subject to a separate provision under Article 5f, which applies where the platform requires user authentication, on the user’s voluntary request and limited to the minimum necessary data. Both dates mark legal obligations, not predicted launch dates, and practical interoperability and national rollout are expected to develop in phases. Organisations should plan their compliance roadmaps accordingly.
How TrustTech helps with eIDAS 2.0 and GDPR compliance
Aligning eIDAS 2.0 with your existing GDPR obligations requires the right technical infrastructure and clear data governance. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations working through the eIDAS 2.0 and GDPR intersection, the ID Connector addresses several of the practical challenges directly:
- Wallet acceptance built on European digital identity standards, with eIDAS 2.0 compliance by design
- Selective disclosure capabilities that support GDPR data minimisation, so your systems receive only the attributes they are registered to request
- Verification against national trusted lists, revocation status checks, and validation of wallet unit attestations as part of each presentation
- Reusable identity flows that reduce repeated data collection, lowering your compliance exposure
- Qualified signing via a connected QTSP, with a tamper-evident audit trail for each interaction
The ID Connector is relevant for organisations in financial services, government, healthcare, and pharma that need to accept EUDI Wallet presentations and manage the associated data governance obligations. Explore our digital identity solutions or get in touch with our team to discuss your specific compliance and implementation needs.