The EUDI Wallet comes with meaningful privacy protections built in, but it also introduces real privacy risks that organisations and users should understand. The wallet is designed around principles like data minimisation and user control, yet risks around data misuse, tracking, and compliance responsibilities remain. This article walks through the most important privacy questions surrounding the European Digital Identity Wallet.
How does the EUDI Wallet handle personal data under eIDAS 2.0?
Under eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, the EUDI Wallet handles personal data through a privacy-by-design framework. Users store their own data locally on their device and choose what to share with which service. No centralised database holds all wallet data, and relying parties can only request the information they genuinely need for a specific interaction.
The regulation requires that wallet providers and relying parties comply with the General Data Protection Regulation (GDPR). This means data processing must have a legal basis, retention periods must be limited, and users must be informed about how their data is used. The wallet architecture is built so that personal data flows directly between the user and the requesting party, rather than being routed through a central broker.
In practice, this means a user presenting their age to access a service does not need to share their full name, address, or date of birth. The wallet issues attestations, which are cryptographically signed pieces of information that can be verified without revealing more than necessary. This approach brings eIDAS 2.0 closely in line with GDPR principles, but it also places real responsibilities on the organisations that receive and process that data.
What are the main privacy risks of the EUDI Wallet?
The main EUDI Wallet privacy risks include unlawful data collection by relying parties, insufficient user understanding of what they are sharing, the potential for data aggregation across services, and implementation weaknesses that could expose personal information. While the wallet framework is privacy-aware, risks emerge in how organisations deploy and use it.
Key privacy concerns to be aware of include:
- Over-requesting data: Relying parties may ask for more attributes than they actually need, leading to unnecessary exposure of personal information.
- Weak consent mechanisms: If the approval flow within the wallet is poorly designed, users may share data without fully understanding what they are agreeing to.
- Data retention after use: Organisations that receive wallet data may retain it longer than permitted, creating compliance and security risks.
- Insecure storage or transmission: Technical vulnerabilities in wallet implementations or relying party systems could expose received data.
- Cross-context profiling: Even with selective disclosure, patterns of wallet use could be analysed to build profiles of individuals over time.
These risks do not mean the EUDI Wallet is fundamentally unsafe. They do mean that privacy protection depends heavily on how well organisations on the receiving end of wallet presentations implement their own systems and processes.
Can the EUDI Wallet be used to track users across services?
The EUDI Wallet is specifically designed to prevent cross-service tracking, but the risk cannot be ruled out entirely. The technical architecture uses mechanisms like pseudonymous identifiers and selective disclosure to prevent a single persistent identifier from linking a user’s activity across different services. However, tracking risks can still arise through indirect means.
For example, if a relying party receives a unique cryptographic attribute that is consistent across presentations, that attribute could theoretically be used to correlate a user’s activity. The Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in the implementing acts, addresses this by specifying that wallet implementations should avoid issuing static, linkable identifiers where possible.
A more practical tracking concern comes from the relying parties themselves. If an organisation collects wallet-derived data and combines it with other data sources, it may be able to build a profile of a user even without a persistent wallet identifier. This is where GDPR enforcement and proper data governance on the organisation’s side become critical. The wallet limits what can be shared, but it cannot control what happens to data once it has been legitimately received. Tracking and profiling risks therefore cannot be excluded entirely, regardless of the wallet’s technical design.
How does selective disclosure reduce EUDI Wallet privacy risks?
Selective disclosure reduces EUDI Wallet privacy risks by allowing users to share only the specific attributes required for a transaction, rather than presenting a full identity document. A user can share a single confirmation that they are over a certain age, without revealing their date of birth or any other personal detail. This limits the amount of personal data exposed in any given interaction. Age verification of this kind relies on selective disclosure of a specific attribute, such as “age over 18”, and does not require zero-knowledge proofs.
This capability is one of the most significant privacy improvements the EUDI Wallet offers compared to traditional identity verification methods. With a physical document, the recipient sees everything on it. With selective disclosure, the user decides what is revealed.
The underlying technology uses cryptographic proofs, meaning the receiving party can verify the claim without the wallet provider needing to be involved in the transaction. This removes a common privacy risk in centralised identity systems, where a provider could log every time a user’s identity was checked. However, it is worth noting that not all verification steps can take place fully offline. Checking the revocation status of an attestation requires contact with the issuer’s status information, and validating the wallet unit attestation requires confirming that the presenting wallet runs on a certified wallet solution. Only the signature verification step, checked against the relevant national trusted list, can be completed fully offline.
Selective disclosure significantly reduces the surface area for data misuse. Organisations that accept wallet presentations should design their data requests around this principle, asking only for what they genuinely need.
Who is responsible for EUDI Wallet privacy compliance?
Responsibility for EUDI Wallet privacy compliance is distributed across multiple actors. The European Commission manages the legal framework and adopts the implementing acts that contain legally binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them through the relevant national competent authority, and supervising actors within their jurisdiction. Wallet providers must meet the technical and security requirements set out under eIDAS 2.0, while relying parties are responsible for how they request, receive, and process personal data. Under GDPR, the relying party acts as a data controller for any personal data it receives through a wallet transaction.
Wallet providers, which may be government bodies or certified private organisations, are responsible for the security of the wallet solution, the integrity of the attestations it issues, and the privacy of the user’s stored data. They must meet strict certification requirements under the eIDAS 2.0 framework. No single central European authority operationally manages all EUDI Wallets.
Relying parties, meaning the organisations that ask users to present wallet credentials, carry a separate and significant compliance responsibility. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data. Registration is per intended use: the relying party declares which attributes and attestations it will request, and the wallet checks each request against that registered scope. They must also:
- Have a lawful basis under GDPR for requesting and processing the data they receive.
- Only request the minimum data necessary for the specific purpose.
- Apply appropriate technical and organisational measures to protect received data.
- Respect retention limits and deletion obligations.
It is worth noting that a supplier processing wallet data on behalf of a client does not thereby become the relying party. The registration obligation rests with the organisation that delivers the service to the end user.
Organisations in regulated sectors such as financial services, healthcare, and government will also need to align their wallet-related data processing with sector-specific regulations alongside GDPR and eIDAS 2.0. A relying party has a separate GDPR legal basis for each processing purpose. Where health data is involved, an additional ground under Article 9(2) GDPR is required. Sector-specific legal requirements do not disappear simply because a wallet is used as the identity mechanism.
What should organisations do to address EUDI Wallet privacy risks?
Organisations should address EUDI Wallet privacy risks by reviewing their data minimisation practices, updating their privacy documentation, assessing their technical readiness to handle wallet-derived data securely, and ensuring their teams understand their compliance obligations as relying parties. Acting early gives organisations time to make considered decisions.
A practical starting point is to map out which use cases will involve wallet presentations and what data will be requested in each. From there, organisations can assess whether their current data governance frameworks are sufficient or need updating. Privacy impact assessments are a useful tool here, particularly for high-risk processing activities.
Technical teams should also review how received wallet data will be stored, who will have access to it, and how long it will be retained. These are not just compliance questions. They are also risk management decisions that affect user trust and organisational reputation.
Public sector bodies should note that the deadline for accepting notified wallets for online services requiring electronic identification is 24 December 2026. For relevant regulated private sector organisations, the acceptance obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027, where strong user authentication is required by law or contract. Very large online platforms (VLOPs) are subject to a separate provision under Article 5f: where a platform requires user authentication, it must accept the EUDI Wallet on a voluntary basis at the user’s request, for the minimum necessary data.
How the ID Connector addresses EUDI Wallet privacy risks
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations managing EUDI Wallet privacy risks, the ID Connector handles several of the technical controls that sit between a wallet presentation and the organisation’s own systems. These include:
- Verification of issuer signatures against the relevant national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL)
- Revocation status checks using issuer-provided status information
- Validation of wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcement of the registered attribute scope, so that only attributes declared in the relying party’s registration under CIR (EU) 2025/848 are processed
- Support for selective disclosure flows, so that data requests are limited to what is genuinely needed for each interaction
- Qualified signing via a connected qualified trust service provider (QTSP), where that is required
Organisations in financial services, healthcare, pharma, and government face the most immediate compliance timelines and the most complex data governance requirements. The ID Connector is built to fit into those environments without requiring organisations to manage the underlying trust infrastructure themselves. Get in touch with TrustTech to discuss how the ID Connector can support your organisation’s approach to EUDI Wallet privacy compliance.