Selective disclosure in the EUDI Wallet means users can share only the specific pieces of information a service actually needs. Instead of handing over a full identity document, a user might confirm only their age or nationality. This privacy-first approach is built directly into the architecture of the European Digital Identity Wallet, and it is one of the features that makes eIDAS 2.0, which amends Regulation (EU) 910/2014, a significant step forward. Below, we answer the most common questions organisations ask about how selective disclosure works and what it means for them in practice.
What data can users choose to share with selective disclosure?
With selective disclosure in the EUDI Wallet, users can choose to share individual attributes from their digital identity rather than an entire document. For example, instead of presenting a full passport, a user can share only the attribute confirming they are over 18, or share only their nationality without revealing their name or address.
The EUDI Wallet stores a wide range of digital documents and credentials, including national identity details, driving licences, academic qualifications, professional certifications, and health information. Each of these credentials contains multiple attributes, and selective disclosure allows users to release only the attributes that are relevant to a specific transaction or interaction.
Here are some practical examples of what selective disclosure looks like in everyday situations:
- Proving you are over 18 to access an age-restricted service, without revealing your exact birthdate or name
- Confirming your professional qualification to an employer, without sharing your home address
- Verifying your nationality for a cross-border service, without disclosing your full identity document
- Sharing your health insurance status with a provider, without exposing unrelated personal data
This level of control was not possible with traditional physical documents. A passport or driving licence reveals everything at once. The EUDI Wallet changes that by giving users genuine control over which personal information they share in each transaction.
How does selective disclosure technically work in the EUDI Wallet?
Selective disclosure in the EUDI Wallet works through a combination of verifiable credentials and cryptographic techniques that allow individual attributes within a credential to be revealed independently. The credential is structured so that each attribute can be signed and verified separately, meaning a relying party can confirm the authenticity of a disclosed attribute without seeing the rest of the credential.
The technical foundation relies on credential formats designed for this purpose. The two most relevant formats in the EUDI Wallet context are SD-JWT VC (Selective Disclosure JSON Web Token Verifiable Credential) and mdoc, which is used for mobile driving licences under ISO/IEC 18013-5 for proximity presentation and ISO/IEC TS 18013-7 for online presentation. Both formats allow issuers to create credentials where each attribute is individually protected, and holders can choose which attributes to present during a transaction. Issuance follows the OID4VCI protocol; presentation follows OID4VP.
The process works as follows:
- An issuer (such as a government authority or institution) creates a verifiable credential containing multiple attributes, each cryptographically bound to the credential.
- The user stores this credential in their EUDI Wallet.
- When a service requests identity information, the wallet presents only the attributes the user has approved sharing for that specific request.
- The relying party verifies the authenticity of the disclosed attributes using the issuer’s cryptographic signature, checked against the relevant national trusted list. The relying party also checks the revocation status of the credential and validates the wallet unit attestation to confirm the presenting wallet runs on a certified wallet solution.
It is worth noting that only the signature check against the national trusted list can be performed fully offline. Revocation status and wallet unit attestation checks require a connection. Describing credential verification as a single offline cryptographic check would therefore be incomplete.
This architecture ensures that the verifying party learns nothing beyond what the user has approved for that transaction. The underlying credential remains intact and private, while the disclosed attributes carry tamper-evident proof of authenticity.
What is the difference between selective disclosure and zero-knowledge proofs?
Selective disclosure and zero-knowledge proofs (ZKPs) are both privacy-enhancing techniques, but they work differently. Selective disclosure reveals specific attributes from a credential while keeping others hidden. Zero-knowledge proofs go further: they allow a user to prove a statement is true, such as “I am over 18,” without revealing the underlying data at all, including the actual birthdate.
Proving age without revealing a birthdate does not require zero-knowledge proofs. Selective disclosure of an attribute such as “age over 18” already achieves this. Zero-knowledge proofs offer stronger privacy guarantees in certain scenarios but are more complex technically and are still maturing in terms of standardisation and widespread deployment.
For organisations building services that accept EUDI Wallet credentials, it is worth understanding this distinction because it affects what your systems need to support. Current implementations in the EUDI Wallet ecosystem focus on selective disclosure using SD-JWT VC and mdoc credential formats, as set out in the Architecture and Reference Framework (ARF). Zero-knowledge proof approaches may become more prominent over time as standards and tooling develop further.
Why does selective disclosure matter for eIDAS 2.0 compliance?
Selective disclosure is a core requirement under eIDAS 2.0. The regulation explicitly requires that wallets enable users to share only the data that is strictly necessary for a given transaction. This aligns directly with the GDPR principle of data minimisation, making selective disclosure a legal obligation that flows from the regulation itself and from the implementing acts adopted by the European Commission.
Under eIDAS 2.0, relying parties (the organisations requesting identity data) are only permitted to request the attributes they genuinely need for a specific purpose. A relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025, before it can request wallet data. That registration specifies, per intended use, which attributes and attestations the relying party is authorised to request. The wallet checks incoming requests against this registered scope. Requesting attributes outside that registered scope is not compliant.
The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements, setting out how wallet providers, issuers, and relying parties are expected to implement them in accordance with the implementing acts. Governance of the EUDI Wallet ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; national competent authorities and registrars play key roles at the national level; and the European Digital Identity Cooperation Group supports cross-border alignment. There is no single central European authority that operationally manages all EUDI Wallets.
From a digital identity compliance perspective, this has several important implications:
- Organisations must define exactly which attributes they need for each use case before they can accept EUDI Wallet credentials
- Systems must be capable of processing partial credential presentations rather than expecting full identity documents
- Privacy by design becomes a technical requirement embedded in the registration and verification process
- Audit and accountability processes need to reflect what data was requested, for what purpose, and under which registered scope
For sectors such as financial services and healthcare, where identity verification is frequent and sensitive, selective disclosure also reduces risk. Collecting less data means less liability in the event of a data breach, and it builds greater trust with customers and patients.
How should organisations prepare their systems for selective disclosure?
Organisations should start preparing for selective disclosure now by reviewing their current identity verification processes and identifying exactly which attributes they actually need for each use case. The technical and organisational changes required are substantial but manageable with a structured approach.
A practical preparation process involves several connected steps. First, organisations need to map their identity use cases: what information do they request, for what purpose, and at what point in the user journey? This mapping exercise often reveals that organisations collect more data than they strictly need, which creates both compliance risk and unnecessary friction for users.
Second, technical teams need to ensure their systems can handle verifiable credentials in the relevant formats, particularly SD-JWT VC and mdoc under ISO/IEC 18013-5 and ISO/IEC TS 18013-7. This means updating or building integrations that can receive, verify, and process partial credential presentations. Verification involves three separate checks: the issuer’s signature against the relevant national trusted list (part of the EU List of Trusted Lists), the revocation status of the credential, and the wallet unit attestation confirming the presenting wallet runs on a certified wallet solution.
Third, organisations operating in government or other regulated sectors should engage with the Architecture and Reference Framework (ARF) published by the European Commission, which provides the technical elaboration of the requirements that underpin the EUDI Wallet ecosystem. The ARF is not legislation, but its specifications describe how wallet providers, credential issuers, and relying parties are expected to implement the requirements set out in the implementing acts.
It is also important to understand the distinction between different aspects of the rollout. The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. This is an outer deadline, not a predicted launch date, and it does not guarantee that every national wallet will have reached the same level of maturity by that date, or that every cross-border use case will be fully operational throughout Europe from that moment. For private relying parties in regulated sectors, the acceptance obligation under Article 5f applies from 24 December 2027. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from that obligation. Practical interoperability and national rollout are likely to develop in phases. Organisations should engage with the process progressively and monitor national developments in the Member States most relevant to their operations. Sector-specific legislation continues to apply alongside eIDAS 2.0.
Finally, governance and compliance teams should update data protection impact assessments and internal policies to reflect the selective disclosure model. Note that approving a data request in the wallet is a separate matter from consent as a legal basis under the GDPR. A relying party needs its own GDPR legal basis for processing the attributes it receives. Documenting which attributes are requested, why they are necessary, under which legal basis they are processed, and how they are handled will be essential for demonstrating eIDAS 2.0 compliance.
How the ID Connector supports selective disclosure
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of selective disclosure, the ID Connector handles several technical functions that would otherwise require significant in-house development:
- Validating disclosed attributes against the issuer’s signature, checked against the relevant national trusted lists within the EU List of Trusted Lists
- Checking the revocation status of presented credentials via issuer-provided status information
- Validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope so that only attributes covered by the relying party’s registration under CIR (EU) 2025/848 are requested and processed
- Supporting SD-JWT VC and mdoc credential formats as used in the EUDI Wallet ecosystem
- Enabling qualified signing via a connected QTSP where the use case requires it
Organisations in financial services, healthcare, pharma, and government can use the ID Connector to connect their existing systems to the EUDI Wallet ecosystem without rebuilding their identity infrastructure from scratch. Get in touch with TrustTech to find out how the ID Connector fits your organisation’s selective disclosure requirements.