In most cases, your data is not permanently lost if you lose access to your EUDI Wallet. The documents and credentials stored in your wallet are either held by the original issuers or can be backed up through mechanisms defined by your wallet provider. What happens in practice depends on how your wallet was set up, which credentials were stored, and whether a recovery process was available and used. This article walks through the most important questions around EUDI Wallet data loss, so you know exactly where you stand.
Is your data permanently lost if you lose access to your EUDI Wallet?
No, your data is not necessarily gone forever when you lose access to your EUDI Wallet. The credentials stored in your wallet, such as your national ID, driving licence, or educational certificates, were issued by official institutions that still hold the original records. The underlying data exists independently of your wallet app, and in most cases it can be reissued or re-imported.
Think of your EUDI Wallet as a secure digital container whose contents can be traced back to their sources. The recovery process is not always instant or automatic. You may need to re-verify your identity and re-request certain credentials from their original issuers, which takes time and depends on the services available in your country.
The key distinction to understand is between the wallet instance (the application installed on your device) and the credentials themselves (the verified attestations stored within it). Losing the wallet instance does not mean losing the right to those credentials. It means you need to re-establish access to them through a new wallet instance or a recovery flow. Because private keys associated with your Person Identification Data and other attestations are held inside the Wallet Secure Cryptographic Device and never leave it, credentials cannot simply be copied to a new device. They must be reissued by the original issuer.
What happens to your verifiable credentials when a wallet is deleted or lost?
When a wallet instance is deleted or a device is lost, the credentials stored locally on that device are no longer accessible through that instance. The credentials themselves are not destroyed. They were issued by trusted parties, and those issuers retain the authority to reissue them. The data behind each credential, such as your identity details or diploma, still exists in official registries and systems.
Credentials in the EUDI Wallet framework follow a specific technical structure. Each credential is cryptographically signed by its issuer and tied to your identity. If you lose the wallet instance, you lose the signed instance of that credential, but you do not lose your identity or your entitlement to that credential. You can request a new signed version from the issuer once you have re-established your wallet.
Some credentials may be easier to recover than others. Government-issued documents like a national ID or passport equivalent are typically straightforward to reissue through official channels. More complex credentials, such as professional certifications or healthcare records, may require additional steps depending on the issuing organisation and the country involved.
Does the EUDI Wallet include a backup or recovery mechanism?
eIDAS 2.0, formally Regulation (EU) 2024/1183 which amends Regulation (EU) 910/2014, sets out the legal framework. Technical elaboration is provided through the Architecture and Reference Framework (ARF), which is not legislation but does address the need for wallet continuity. The specific backup and recovery mechanisms are largely determined at the national level by each Member State and its wallet provider. Recovery options can therefore vary depending on which country’s wallet you use, and the maturity of those options will develop over time as national rollouts progress.
In general, wallet providers are expected to offer users a way to recover access to their wallet in the event of device loss, theft, or app deletion. This might include:
- Cloud-based backup of wallet metadata and credential references
- Re-authentication through a national identity scheme to restore wallet access
- The ability to re-import previously issued credentials from their original issuers
- A secure recovery key or passphrase generated during wallet setup
Even where backup mechanisms exist, they are designed with privacy and user control in mind. The EUDI Wallet framework emphasises that users should always control what data is shared and stored. Fully automatic cloud sync of all credential data is not necessarily the default approach, as that would conflict with the wallet’s privacy principles. Because private keys never leave the Wallet Secure Cryptographic Device, a new wallet instance on a replacement device requires fresh issuance of each credential, not a simple restore from backup.
The practical advice is straightforward: when you set up your EUDI Wallet, take the time to understand and activate any recovery options your wallet provider offers. Do not wait until something goes wrong to find out what the recovery process looks like.
Who is responsible for protecting your data under eIDAS 2.0 and GDPR?
Under eIDAS 2.0 and the General Data Protection Regulation (GDPR), responsibility for protecting your data is shared across multiple parties. The governance structure involves the European Commission, which manages the legal framework and adopts implementing acts containing legally binding requirements; EU Member States, which provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; national competent authorities; wallet providers; credential issuers, including issuers of Person Identification Data and qualified attestations; qualified trust service providers; and relying parties. Each plays a defined role in the trust framework, and no single central European authority operationally manages all EUDI Wallets.
The wallet provider, which is typically a government body or a government-certified private entity, is responsible for the security and integrity of the wallet infrastructure. They must ensure the wallet solution meets the high assurance level required under eIDAS 2.0 and comply with GDPR as a data controller or processor depending on their role.
The credential issuers, such as government agencies, banks, or healthcare providers, are responsible for the accuracy and security of the data they issue. They remain accountable for the personal data they process when creating and signing a credential. Issuers of attestations must also make revocation status available and support reissuance when a user moves to a new device.
The user also plays an active role. The EUDI Wallet is designed around the principle of selective disclosure, meaning you choose what data to share and with whom. This puts real control in your hands, but it also means you carry some responsibility for how you manage your wallet, including setting up recovery options and keeping your device secure. Each time you respond to a data request, you approve that specific presentation. Approval of a data request in the wallet is a separate matter from consent as a legal basis under the GDPR. The relying party receiving your data needs its own GDPR legal basis for processing it.
GDPR gives you clear rights in this context: the right to access your data, the right to erasure, and the right to data portability. If you lose access to your wallet and believe your data has been mishandled, you have the right to raise this with your wallet provider and, if necessary, with your national data protection authority.
What should organisations do to prepare for wallet data loss scenarios?
Organisations that accept or rely on EUDI Wallet credentials need to plan for the reality that users may sometimes lose access to their wallets. This is a predictable scenario that should be built into your digital identity workflows from the start.
Here are the key steps organisations should take:
- Map your credential dependencies: Identify which user journeys in your services rely on EUDI Wallet credentials. Understand what happens to those journeys if a user cannot present their wallet.
- Design fallback identity verification paths: Ensure users can still access critical services through alternative identity verification methods while they recover their wallet. This is both a usability requirement and, in many regulated sectors, a compliance consideration.
- Inform users proactively: If your service issues credentials to users’ wallets, communicate clearly what happens if they lose access and how they can re-request credentials from you.
- Align with your wallet provider’s recovery protocols: Understand the recovery mechanisms offered by the wallet providers your users are likely to use, and align your support processes accordingly.
- Review your data retention policies: Under GDPR, you need to retain only what is necessary. For reissuance purposes, you should understand which data points you are permitted and required to retain so you can support users in recovery scenarios without overstepping data minimisation principles.
Organisations in regulated sectors such as financial services, government, and healthcare face additional considerations, as identity verification is often tied to regulatory compliance requirements. A user losing wallet access should not create a compliance gap in your processes. Building resilience into your identity infrastructure now is far more effective than addressing it reactively.
24 December 2026 is the legal deadline by which Member States are required to make EUDI Wallets available to citizens and businesses. This is an outer deadline, not a predicted launch date, and it does not guarantee that every national wallet will reach the same level of maturity on that date, or that every cross-border use case will be fully operational throughout Europe from that point. Practical interoperability and national rollout are expected to develop in phases. From 24 December 2027, the private sector acceptance obligation under Article 5f of eIDAS 2.0 applies to relevant regulated sectors where strong user authentication is legally or contractually required, including financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total not exceeding ten million euros are exempt. Organisations that have not yet mapped out wallet data loss scenarios should begin doing so now. Explore the available resources to stay informed as the rollout progresses.
How the ID Connector supports organisations dealing with EUDI Wallet data scenarios
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of wallet data loss, the ID Connector addresses several practical challenges that organisations face when a user needs to re-present credentials from a newly issued wallet instance:
- Accepting credentials from any notified wallet solution, so a user recovering on a different national wallet is not blocked at your service
- Verifying issuer signatures against the relevant national trusted lists, which are aggregated in the EU List of Trusted Lists, to confirm that reissued credentials come from a legitimate source
- Checking revocation status against issuer-provided status information, so credentials that were revoked during a loss or theft incident are not accepted
- Validating wallet unit attestations to confirm that the presenting wallet instance runs on a certified wallet solution
- Enforcing the registered attribute scope so that only the data your organisation declared under CIR (EU) 2025/848 is requested from the user’s wallet
Organisations in financial services, healthcare, pharma, and government can connect through the ID Connector to handle these verification steps without building and maintaining the underlying trust infrastructure themselves.
If your organisation is working through the practical implications of the European Digital Identity Wallet, get in touch with TrustTech to see what the ID Connector can do for your specific situation.