A Person Identification Data set (PID) is the foundational set of identity attributes that every European Digital Identity Wallet must contain. It is the digital equivalent of a government-issued identity document, structured in a standardised, machine-readable format that can be verified across EU member states. Under eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, the PID is the cornerstone of how individuals prove who they are in digital environments.
The sections below walk through the most important questions surrounding the PID in plain, practical terms.
What data does a Person Identification Data set actually contain?
A Person Identification Data set contains the core attributes needed to uniquely identify a natural person. At minimum, this includes a person’s first name and family name, date of birth, place of birth, current address, and a unique persistent identifier that links the individual to their home member state’s identity system. These attributes are defined in the eIDAS 2.0 regulation to ensure consistency across all EU wallets.
Beyond the mandatory minimum, the PID may also include additional attributes such as nationality, gender, and a portrait image, depending on what the issuing member state includes. The key principle is that the data set is standardised: regardless of whether a wallet is issued in Germany, Spain, or the Netherlands, the PID will follow the same structure and encoding format. This makes cross-border recognition technically reliable in a way that was not previously possible.
The data within the PID is expressed as verifiable attestations, meaning each attribute is cryptographically signed by the issuing authority. This allows a relying party to confirm not just what the data says, but that it has been issued by a trusted government source and is tamper-evident.
How does the PID differ from a traditional digital identity credential?
The PID differs from a traditional digital identity credential in three fundamental ways: it is issued directly by a government authority, it uses cryptographic proof, and it supports selective disclosure so users can share only the attributes a service actually needs. Traditional credentials typically rely on a central identity provider that authenticates users on behalf of a service, creating a dependency on that intermediary.
With a traditional eID or login credential, the identity provider often sees every transaction the user makes. The PID inside an EUDI Wallet changes this dynamic. Because the wallet sits on the user’s own device, the user presents identity attributes directly to the relying party. The issuing government authority does not need to be involved in every transaction, and the identity provider does not learn which services the user is accessing.
This architecture also means the PID is reusable across different services without re-verification. Once a person’s identity has been bound to their wallet and the PID has been issued, they can use that same verified identity data to open a bank account, access healthcare records, or sign a contract. This is a significant improvement over the current fragmented landscape where each organisation runs its own verification process independently.
Who issues the PID under eIDAS 2.0?
Under eIDAS 2.0, the Person Identification Data set is issued by a designated PID Provider in each EU member state. This is typically a government body or an authority officially recognised by the state, such as a national identity registry, a civil registration authority, or a body responsible for issuing national identity documents. The regulation requires that PID providers appear on national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL), so relying parties can verify their authenticity.
Member states have some flexibility in how they structure PID issuance. A government may operate the PID provider directly, or it may delegate this function to a certified organisation, as long as that organisation meets the strict requirements set out in the regulation and its implementing acts. What is not permitted is for a private company to issue a PID without official government recognition, because the PID must be rooted in a legally authoritative source of identity.
This is different from other attestations that can be stored in the EUDI Wallet. A university can issue a diploma as a verifiable attestation, and a bank can issue proof of account ownership. But only a state-authorised PID provider can issue the core Person Identification Data set that underpins the wallet’s identity layer.
It is also worth noting that governance of the overall framework is a shared responsibility. The European Commission manages the legal framework and adopts the implementing acts that contain binding requirements. Member states are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising the actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation between member states. National competent authorities, wallet providers, PID providers, qualified trust service providers, and relying parties each carry distinct roles within this structure. No single central European authority operationally manages all EUDI Wallets.
How is the PID stored and protected inside the EUDI Wallet?
The PID is stored inside the EUDI Wallet as a cryptographically signed attestation, bound to the wallet unit on the user’s device. The wallet unit comprises the wallet instance together with the Wallet Secure Cryptographic Application and the Wallet Secure Cryptographic Device in which the private keys are held. Those private keys do not leave the secure element. Protection relies on a combination of secure hardware, cryptographic key management, and the wallet’s certification requirements. The wallet solution must meet the high-level security standards defined in the eIDAS 2.0 implementing acts.
When a user presents their PID to a relying party, the wallet generates a cryptographic proof that demonstrates the attestation is genuine, was issued to this wallet unit, and is tamper-evident. Full verification involves three distinct checks: confirming the issuer’s signature against the relevant national trusted list; checking the revocation status through the issuer’s status information; and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline, so describing PID verification as entirely independent of any external contact is not accurate in all scenarios.
Selective disclosure is another important protection mechanism built into the PID’s technical design. The credential formats supported by the Architecture and Reference Framework are mdoc and SD-JWT VC. Using selective disclosure, a user can choose to share only specific attributes. For example, to prove they are over 18, they do not need to reveal their exact date of birth. To prove their nationality, they do not need to share their home address. This minimises the amount of personal data that flows to any given service, which directly supports compliance with the GDPR for both users and organisations.
What can organisations do with a verified PID?
Organisations that accept a verified PID can use it to confirm a user’s identity with a level of assurance equivalent to in-person document verification. This opens the door to fully digital, high-assurance onboarding for services that currently require physical ID checks. Financial services, healthcare, and government services stand to benefit most directly, as these are areas where identity verification is both mandatory and often burdensome.
Practical use cases for organisations accepting a verified PID include:
- Opening a bank account or completing KYC checks remotely, without requiring the customer to visit a branch or upload document scans. Note that whether verified PID data can be reused for KYC purposes depends on applicable AML legislation, not on eIDAS 2.0 alone.
- Granting access to government portals or public services across EU member states using a single trusted identity
- Verifying patient identity in healthcare settings before sharing medical records or prescriptions. Processing health data requires a legal basis under both Article 6 and Article 9(2) of the GDPR.
- Streamlining employee onboarding by accepting verified identity and qualification data directly from the wallet. Recognition of professional qualifications continues to be governed by Directive 2005/36/EC.
- Enabling legally binding electronic signatures linked to a verified identity. A qualified electronic signature (QES) requires a qualified certificate and a qualified signature creation device (QSCD), and has the same legal effect as a handwritten signature under eIDAS 2.0. National form requirements continue to apply.
Organisations must register as relying parties under CIR (EU) 2025/848, adopted on 6 May 2025, with the national authority of the member state in which they are established, before they can request wallet data. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which wallet provider issued it. Sector-specific legislation continues to apply alongside the eIDAS 2.0 requirements. This registration process ensures that only legitimate services can request identity data, and that users can see exactly who is asking for what before they approve sharing anything. For organisations in regulated sectors, accepting a PID can also simplify compliance reporting, since the identity data comes with a built-in audit trail and cryptographic proof of its origin.
When will the PID become available across EU member states?
The legal deadline for member states to fulfil their EUDI Wallet obligations is 24 December 2026, as set out in eIDAS 2.0, which entered into force on 20 May 2024. By this date, member states must provide a wallet to all citizens, residents, and businesses within the EU, and public sector bodies must accept notified wallets for online services that require electronic identification. Meeting this deadline does not mean that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe at that point. Practical interoperability and national rollout are likely to develop in phases, and the pace will differ between member states.
A separate obligation applies to the private sector. From 24 December 2027, Article 5f of eIDAS 2.0 requires relevant regulated private sector entities to accept the EUDI Wallet where strong user authentication is legally or contractually required. The sectors covered include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) are subject to a distinct provision under Article 5f: the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the private sector obligation.
The timeline for practical availability varies by country. Some member states are further along than others. The first four large-scale pilots ran from April 2023 to 2025 and have concluded. The POTENTIAL consortium piloted government services, opening a bank account, SIM registration, mobile driving licences, remote qualified signing, and electronic prescriptions. The EWC consortium focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments, and DC4EU covered education and social security. These pilots were instrumental in testing the technical architecture and collecting real-world feedback. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
National wallet status, including whether a wallet is live, in a pilot phase, certified, or officially notified, is time-sensitive information that organisations should verify against current authoritative national sources before drawing conclusions about availability in a specific country. It is also important to distinguish between an existing national digital identity system and a certified EUDI Wallet: the two are not automatically the same thing.
For organisations, the relevant question is not just when the PID becomes available, but when relying party infrastructure needs to be in place to accept it. Building that readiness takes time, and organisations that start preparing their technical and compliance frameworks now will be better positioned to offer wallet-based services as national rollouts mature. The regulatory pressure is real: under eIDAS 2.0, certain categories of online services will be required to accept the EUDI Wallet as a means of authentication. Rollout will happen progressively across member states, so there will be no single European go-live moment.
The implementation steps involved, from registering as a relying party under CIR (EU) 2025/848 with the relevant national authority to integrating wallet flows into existing onboarding processes, are worth mapping out well in advance. Organisations in financial services, government, and healthcare in particular should treat 24 December 2026 as a firm legal deadline and plan accordingly.
How the ID Connector helps organisations accept PID-based identity
Implementing PID-based identity verification touches compliance, customer experience, data governance, and system architecture all at once. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations preparing to accept PID-based identity, the ID Connector handles:
- Wallet acceptance across certified wallet solutions, so a relying party can receive PID presentations from any notified EUDI Wallet regardless of the issuing member state
- Verification against national trusted lists, including issuer signature validation and revocation status checks, as well as wallet unit attestation validation to confirm the presenting wallet runs on a certified wallet solution
- Attribute scope enforcement, ensuring that each data request stays within the scope registered under CIR (EU) 2025/848
- Reuse of verified identity data across services, so that once a user has presented their PID, that verified data can support subsequent interactions without the user repeating the full presentation flow each time they approve a new request
- Qualified signing via a connected QTSP, enabling relying parties in financial services, healthcare, pharma, and government to offer QES-based workflows that meet eIDAS 2.0 requirements
Get in touch with TrustTech to discuss how the ID Connector can connect your organisation’s onboarding and compliance workflows to EUDI Wallet-based identity flows.