The data minimization principles in eIDAS 2.0 require that only the personal data strictly necessary for a specific purpose may be requested or processed during an identity interaction. This means organizations can no longer ask for a full identity profile when a simple age confirmation or nationality check will do. The sections below unpack what this looks like in practice, what it means for your organization, and how to prepare.
How does data minimization work in practice under eIDAS 2.0?
Under eIDAS 2.0, data minimization means that every request for identity data must be limited to what is genuinely necessary for the task at hand. If a service only needs to confirm that a user is over 18, it should receive a yes or no confirmation, not a full date of birth, name, and address. This principle is built directly into the architecture of the European Digital Identity Wallet.
In practical terms, the EUDI Wallet allows users to share individual attributes from their digital identity credentials rather than handing over an entire document. Think of it as showing only one page of a passport instead of the whole booklet. A user applying for a prescription service shares only the relevant health attestation. A user accessing an age-restricted platform shares only an age confirmation, for example the attribute “over 18”, disclosed through selective disclosure without revealing the underlying date of birth. The personal data stays with the user.
This approach reflects a deliberate shift in how identity verification is designed. Organizations must define upfront exactly what data they need and why, rather than collecting broadly and deciding later what to use. That design-first mindset is central to eIDAS 2.0 compliance.
What specific obligations does eIDAS 2.0 place on relying parties?
Relying parties, meaning the organizations that request and receive identity data from a user’s EUDI Wallet, have clear obligations under eIDAS 2.0. They must only request attributes that are necessary and proportionate to the service they are providing. Requesting more data than needed is a compliance violation.
The key obligations for relying parties include:
- Purpose limitation: Each data request must be tied to a clearly defined and legitimate purpose.
- Proportionality: The scope of the data request must match the minimum needed to fulfil that purpose.
- Registration and transparency: Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national competent authority of their Member State of establishment before requesting wallet data. For each intended use, they register which attributes and attestations they will request. The wallet checks incoming requests against this registered scope, making the relying party’s data requests visible to both regulators and users.
- No retention beyond necessity: Data received through the wallet may not be stored or reused for purposes beyond the original transaction without a separate legal basis.
- User approval and control: Users must be able to see what is being requested and actively choose to share it. This approval within the wallet is distinct from consent as a legal basis under the GDPR. Relying parties must establish their own GDPR legal basis for processing the data they receive.
These obligations align closely with GDPR principles, but eIDAS 2.0, which amends Regulation (EU) 910/2014, goes further by embedding them into the technical layer of the wallet interaction itself, making compliance easier to audit. The legally binding requirements are set out in the implementing acts adopted by the European Commission. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements and defines how the components of the EUDI Wallet fit together in practice, but is not itself a legislative instrument.
How does selective disclosure differ from traditional identity verification?
Selective disclosure is the technical mechanism that makes data minimization possible in the EUDI Wallet. It allows a user to share a single verified attribute from a credential without revealing the rest of the underlying data. Traditional identity verification typically involves presenting a full document or submitting a complete data set, leaving the service provider to decide what to use.
In a traditional verification flow, a user might upload a passport to confirm their nationality. That process also reveals their full name, date of birth, document number, and expiry date, even if none of that information is needed. With selective disclosure, the wallet presents only the nationality field as a cryptographically signed claim, and nothing else is transmitted.
This is a fundamental change in the trust model. The service provider receives only a verified, purpose-specific answer, while the user retains control over the underlying data. The result is less data exposure, reduced storage liability for organizations, and greater privacy for individuals. For organizations operating in financial services or other regulated sectors, this shift also reduces the risk of data breaches involving sensitive identity information.
Which technical standards support data minimization in the EUDI Wallet?
The EUDI Wallet relies on a set of established technical standards to make data minimization and selective disclosure work reliably and interoperably across Europe. These standards define how credentials are structured, how attributes are disclosed, and how trust is established between parties.
The most relevant standards include:
- ISO/IEC 18013-5 (mdoc): The standard for mobile documents, including mobile driving licenses. It supports selective disclosure of individual fields and is used for proximity presentation. For online presentation, ISO/IEC TS 18013-7 applies.
- SD-JWT VC (Selective Disclosure JSON Web Token Verifiable Credential): A credential format that allows individual claims within a credential to be disclosed separately, giving users fine-grained control over what they share. SD-JWT VC is one of the two credential formats specified in the ARF alongside mdoc.
- OID4VCI (OpenID for Verifiable Credential Issuance): The protocol used to issue credentials into the wallet.
- OID4VP (OpenID for Verifiable Presentations): The protocol used to request and present credentials in the wallet ecosystem, supporting minimal disclosure flows.
- Architecture and Reference Framework (ARF): The technical blueprint developed by the eIDAS Expert Group that defines how all these components fit together in the EUDI Wallet. The ARF elaborates on the requirements set out in the implementing acts. Check the current ARF version number before publication to ensure references are up to date.
Together, these standards create a technical foundation where data minimization is a built-in feature of every identity interaction. Organizations building or integrating with digital identity solutions should ensure their systems are compatible with these specifications.
How should organizations prepare their systems for eIDAS 2.0 data minimization?
Preparing for eIDAS 2.0 data minimization requires both a technical and an organizational shift. The starting point is a thorough review of every identity verification flow your organization currently operates, with the goal of identifying what data is collected, why, and whether all of it is genuinely necessary.
A practical preparation approach looks like this. First, map your current data collection points and assess each one against the principle of necessity. Ask: what is the minimum we need to complete this interaction? Second, review your legal basis for each data request, since eIDAS 2.0 tightens the link between purpose and data scope. Third, assess your technical infrastructure for compatibility with wallet-based credential presentation and selective disclosure formats. Many legacy systems were built to receive full identity documents, not individual verified attributes.
Organizations in sectors such as healthcare or government services will often find that their verification flows collect far more data than the underlying process requires. Redesigning these flows around minimum necessary data is a compliance requirement that also reduces data liability and improves user experience by making interactions faster and less intrusive.
It is also worth understanding how the EUDI Wallet framework distributes responsibility. The European Commission sets the legal framework and adopts implementing acts. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this ecosystem. No single central European authority operationally manages all EUDI Wallets.
On timing, 24 December 2026 is the legal deadline for Member States to fulfil their wallet obligations under eIDAS 2.0, including the requirement for public-sector bodies to accept notified wallets for online services that require electronic identification. This is a legal deadline, not a predicted launch date, and it does not mean that every national wallet will reach the same level of maturity on that date, or that every cross-border use case will be fully operational throughout Europe from that point. From 24 December 2027, the acceptance obligation under Article 5f extends to relevant regulated private sectors where strong user authentication is legally or contractually required. This includes banks and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms are subject to a separate provision under Article 5f: the obligation applies where the platform requires user authentication, on the voluntary request of the user, and for the minimum data necessary. Practical interoperability and national rollout are expected to develop in phases. Organizations should begin preparing now, since readiness will vary by country and use case.
Training compliance, IT, and product teams on what data minimization means in practice is equally important. The principle is straightforward, but applying it consistently across complex service journeys requires deliberate effort and clear internal governance.
How the ID Connector supports eIDAS 2.0 data minimization
Implementing data minimization in line with eIDAS 2.0 requires rethinking how your organization collects, uses, and stores identity data at a fundamental level. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For data minimization specifically, the ID Connector:
- Enforces the registered attribute scope per intended use, so that only the attributes declared during registration under CIR (EU) 2025/848 are requested in each wallet interaction
- Handles verification against national trusted lists, which are brought together in the EU List of Trusted Lists, so that issuer signatures on presented attributes can be checked
- Supports revocation status checks and wallet unit attestation validation, confirming that the presenting wallet runs on a certified wallet solution
- Supports selective disclosure flows using mdoc and SD-JWT VC, so that only the specific attributes needed for a given transaction are presented
- Enables reuse of verified identity data across interactions without repeated full-document collection, reducing data exposure at every step
- Connects qualified signing via an integrated qualified trust service provider, covering use cases in financial services, healthcare, pharma, and government where a qualified electronic signature is required
Get in touch with TrustTech to discuss how the ID Connector fits your organization’s identity verification flows and compliance requirements.