Under eIDAS 2.0, which amends Regulation (EU) 910/2014, user consent is built on the principle that individuals must be in full control of what personal data they share, with whom, and when. The regulation requires that data sharing through the European Digital Identity (EUDI) Wallet is always deliberate and informed, meaning users actively choose what to disclose. This article walks through the most important questions organisations need to understand about eIDAS 2.0 consent rules.
How does eIDAS 2.0 define user consent for data sharing?
Under eIDAS 2.0, user consent for data sharing means that individuals must explicitly and actively agree to share specific identity attributes before any data is transmitted. Consent must be informed, granular, and freely given. Users are never required to share more information than is strictly necessary for a given interaction, and sharing cannot happen without a clear, deliberate action from the user.
This definition is embedded in the architecture of the EUDI Wallet itself. The wallet is designed so that every data disclosure requires a conscious decision by the user. When a relying party requests identity attributes, the wallet presents the user with a clear overview of exactly what is being requested and for what purpose. The user can then choose to approve, modify, or decline the request.
This approach is called selective disclosure. A user can share only the specific attributes that are needed, rather than an entire identity document. Booking an appointment at a healthcare provider might only require a name and date of birth, not a full national identity record. The regulation is explicit that anything beyond what is necessary should not be shared.
It is important to distinguish between approving a data request within the wallet and giving consent as a legal basis under the GDPR. When a user approves a presentation request in the EUDI Wallet, that approval is an action within the wallet interface. The relying party receiving the data still needs its own lawful basis under the GDPR for processing that data. Those two things are separate.
What specific rights do users have under eIDAS 2.0 consent rules?
eIDAS 2.0 gives users a clear set of rights when it comes to their identity data and how it is shared. These rights are designed to give individuals genuine control. Under the regulation, users have the right to:
- Choose which attributes to share and which to withhold
- Decide on a per-interaction basis, rather than giving blanket permission
- Access a log of what data has been shared, with whom, and when, through the wallet dashboard
- Stop sharing data at any point by declining individual requests
- Use digital services without being forced to share unnecessary personal data
- Access the EUDI Wallet and digital identity services without going through private platforms that collect additional data
The wallet dashboard is a facility for the user to review past disclosures. It is not a logging mechanism operated by the wallet provider.
These rights apply across both public and private sector interactions. Whether a user is accessing a government service, opening a bank account, or verifying their age for an online platform, the same principles apply. The regulation is designed to prevent situations where users feel pressured to over-share in order to access a service.
Are organisations required to obtain explicit consent every time?
In most cases, yes. eIDAS 2.0 requires that user approval is obtained at the point of each data sharing interaction, not stored as a general permission that covers all future requests. Each time a relying party requests identity attributes through the EUDI Wallet, the user must actively confirm what they are willing to share in that specific context.
There is an important distinction here between authentication and data sharing. A user may set up a trusted relationship with a service provider, but that does not give the provider ongoing access to the user’s identity data. Each new request still requires user action. This is fundamentally different from how many current digital identity systems work, where a one-time approval often leads to persistent data access.
Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data. As part of that registration, the relying party specifies per intended use which attributes and attestations it will request. The wallet checks incoming requests against that registered scope. Organisations in financial services and other regulated sectors need to factor this registration requirement into their onboarding redesign, alongside the move to per-interaction user approval.
What happens if a user refuses or withdraws consent?
If a user declines a data request under eIDAS 2.0, organisations are not permitted to deny access to a service solely on that basis, provided the requested data is not strictly necessary for the service in question. Users cannot be penalised for exercising their right to data minimisation. If an organisation requests more data than is genuinely required, the user has the right to decline without losing access.
Because each request requires individual approval by the user, there is no standing consent arrangement to withdraw in the traditional sense. A user who no longer wishes to share data simply declines future requests. Organisations must design their systems accordingly and must not rely on previously shared data as an ongoing authorisation to continue processing.
For organisations in healthcare or government services, where identity verification is often a legal requirement, there is more nuance. In these cases, certain data may be required by law, which creates a different legal basis for processing than consent. For health data specifically, a ground under Article 9(2) GDPR is also required. Even in these contexts, data minimisation principles still apply.
How do eIDAS 2.0 consent rules interact with GDPR?
eIDAS 2.0 and GDPR operate alongside each other and are designed to be complementary. GDPR sets the overarching framework for personal data processing in the EU, including the conditions under which consent is valid as a lawful basis. eIDAS 2.0 builds on these foundations by embedding data minimisation and user control directly into the technical architecture of the EUDI Wallet.
When a user shares identity attributes through the EUDI Wallet, the organisation receiving that data must still comply with GDPR obligations. This includes having a lawful basis for processing, respecting retention limits, and honouring data subject rights such as access and erasure. For KYC purposes, the lawful basis is typically a legal obligation rather than consent.
One area where the two frameworks interact closely is purpose limitation. Under GDPR, data collected for one purpose cannot be freely reused for another. eIDAS 2.0 reinforces this by requiring that user approval is specific to each interaction and each stated purpose. An organisation cannot use identity data shared during onboarding for a different process later without a fresh lawful basis.
Organisations should treat eIDAS 2.0 compliance and GDPR compliance as connected workstreams. A structured implementation approach that maps data flows, approval mechanisms, and legal bases across both frameworks will reduce duplication and close compliance gaps more efficiently.
What should organisations do now to prepare for these consent requirements?
Organisations should start by auditing their current identity and data sharing processes to understand where they do and do not align with eIDAS 2.0 principles. The key questions to ask are: what data are we currently requesting, do we actually need all of it, and how are we obtaining and recording user approval today?
From there, a practical preparation plan should include the following steps:
- Map your data requests: Identify every point in your customer or user journey where identity data is collected or shared, and assess whether each data point is strictly necessary.
- Review approval mechanisms: Check whether your current flows are granular, per-interaction, and clearly documented in line with both eIDAS 2.0 and GDPR requirements.
- Prepare for EUDI Wallet integration: Understand how relying party registration works under CIR (EU) 2025/848 and what technical requirements apply to organisations that want to accept wallet-based identity credentials. Registration takes place with the national authority of your Member State of establishment, and requirements may differ depending on where you operate.
- Update internal policies: Ensure your data protection policies, privacy notices, and internal procedures reflect the per-interaction model and the rights users have under eIDAS 2.0.
- Train relevant teams: Compliance, legal, IT, and product teams all need to understand the implications of eIDAS 2.0 for their specific responsibilities.
24 December 2026 is the legal deadline by which Member States must make the EUDI Wallet available and public sector bodies must accept notified wallets for online services that require electronic identification. The obligation for relevant regulated private sector organisations, set out in Article 5f of the amended regulation, applies from 24 December 2027. Practical interoperability and the maturity of individual national wallet solutions are likely to develop in phases, so organisations should plan incrementally. Those in sectors such as government services or education may find it useful to review the outcomes of the EU large-scale pilot programmes, which tested real-world EUDI Wallet use cases between 2023 and 2025 and generated practical insights that can inform implementation planning. More background and guidance is available through TrustTech’s resources.
How TrustTech supports EUDI Wallet acceptance
Meeting eIDAS 2.0 requirements for user-controlled data sharing requires the right technical infrastructure and clear processes. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of consent and data sharing, the ID Connector specifically handles:
- Wallet-ready identity infrastructure that supports selective disclosure and per-interaction approval flows
- Verification against national trusted lists, brought together in the EU List of Trusted Lists, covering issuer signature verification, revocation status checks, and wallet unit attestation validation
- Scope enforcement that checks incoming attribute requests against the relying party’s registered intended use under CIR (EU) 2025/848
- Reusable, verifiable credentials that reduce friction while keeping users in control of what they share
- Compliance alignment across eIDAS 2.0 and GDPR, covering data flows and lawful bases without duplicating effort
The ID Connector is relevant for organisations in financial services, healthcare, pharmaceuticals, and government, where consent and data sharing requirements are most demanding. Get in touch with TrustTech to discuss how the ID Connector can support your organisation’s EUDI Wallet acceptance.