Selective disclosure is a privacy technique that lets a person share only the specific pieces of identity data that a service actually needs, rather than handing over an entire document or credential. Instead of showing your full passport to prove your age, for example, you share only a confirmation that you are above a certain threshold. Under eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, selective disclosure is built directly into the European Digital Identity Wallet, making it a legal and technical requirement rather than an optional feature.
This article walks through how selective disclosure works, why it matters for the EUDI Wallet, which cryptographic standards make it possible, and what your organisation should be doing about it now.
How does selective disclosure actually work in practice?
Selective disclosure works by allowing a holder to present only chosen attributes from a credential, while a verifier can still confirm those attributes are genuine and tamper-evident. The holder selects exactly which fields to share, and the underlying cryptography proves those fields are part of a valid, trusted credential.
Imagine a user wants to rent a car. The rental company needs to know the customer holds a valid driving licence and is over 21. With selective disclosure, the user shares just those two facts. The rental company receives a cryptographically verified confirmation, without ever seeing the user’s home address, national ID number, or date of birth.
This is a significant departure from how identity works today. When you hand over a physical ID card or upload a passport scan, you expose far more data than the service needs. Selective disclosure changes this dynamic: the user is in control of what leaves their wallet, and the receiving party gets only what they asked for.
What role does selective disclosure play in the EUDI Wallet?
Selective disclosure is one of the foundational principles of the EUDI Wallet. The European Digital Identity Wallet is designed so that users can choose exactly which identity data to share with any given service, and nothing more. This is a core regulatory requirement under eIDAS 2.0.
The wallet stores a range of certified digital documents, from national identity credentials to professional qualifications and health data. When a user interacts with a public or private service, they can present only the attributes that are relevant to that specific interaction. The wallet interface makes this selection explicit, so users always know what they are sharing and with whom.
This approach directly supports the eIDAS 2.0 goal of giving EU citizens, residents, and businesses genuine control over their personal data. It also addresses one of the most common friction points in current digital services: users repeatedly proving themselves from scratch every time they engage with a new organisation. With the EUDI Wallet and selective disclosure, a verified identity attribute can be reused across contexts without over-sharing.
It is worth understanding how responsibility is shared across the EUDI Wallet ecosystem. The European Commission manages the legal framework and adopts the implementing acts that contain the binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this framework. No single central European authority operationally manages all EUDI Wallets.
For organisations in sectors such as financial services or healthcare, this has direct implications for how onboarding, consent, and compliance processes need to be redesigned.
Which cryptographic standards enable selective disclosure under eIDAS 2.0?
Two main cryptographic formats support selective disclosure in the eIDAS 2.0 and EUDI Wallet context: SD-JWT VC (Selective Disclosure JSON Web Token Verifiable Credential) and ISO/IEC 18013-5 mdoc. Both are included in the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in the implementing acts that govern the EUDI Wallet. The ARF is technically informative; the implementing acts are legally binding.
SD-JWT VC
SD-JWT VC is a format built on the widely used JSON Web Token standard. It allows an issuer to include individual claims in a credential in a way that each claim can be independently disclosed or withheld. The holder decides which claims to reveal when presenting the credential, and the verifier can confirm the authenticity of those specific claims without seeing the others. For online presentation, the relevant protocol is OID4VP. SD-JWT VC is particularly well suited to web-based interactions and API-driven services.
ISO/IEC 18013-5 mdoc
The mdoc format originates from the mobile driving licence standard and is optimised for proximity interactions, such as presenting a credential via NFC or Bluetooth in a physical setting, as defined in ISO/IEC 18013-5. For online presentation of mdoc credentials, ISO/IEC TS 18013-7 applies. It uses a similar principle: the issuer signs the full credential, but the holder can present a subset of attributes. The verifier receives only what was selectively disclosed, along with proof that it comes from a trusted issuer.
Both formats are designed to work within the common toolbox being developed for the EUDI Wallet, and both are covered by the High Assurance Interoperability Profile (HAIP). Organisations building integrations with the wallet will need to support one or both of these formats depending on their use case and sector.
How verification works
Verification of a selectively disclosed credential involves three distinct checks. First, the verifier checks the issuer’s signature against the relevant national trusted list, which forms part of the EU List of Trusted Lists (LOTL). This check can be performed fully offline. Second, the verifier checks the revocation status of the credential using status information provided by the issuer, which requires a connection. Third, the verifier checks the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. These three checks together establish that the disclosed attributes are genuine, current, and presented from a trustworthy wallet.
What is the difference between selective disclosure and zero-knowledge proofs?
Selective disclosure and zero-knowledge proofs are related concepts, but they work differently. Selective disclosure lets a user choose which specific data fields to reveal from a credential. Zero-knowledge proofs go further: they allow a user to prove a statement is true without revealing any underlying data at all.
With selective disclosure, you share the actual value of a chosen attribute. If a service asks for your nationality, you share the nationality field but withhold everything else. The verifier sees the real value of that attribute.
With a zero-knowledge proof, you can prove a derived fact without sharing the raw data. For example, you prove mathematically that you are over 18 without revealing your date of birth. The verifier learns only that the condition is met, not the underlying value.
It is worth noting that age verification without revealing a date of birth can also be achieved through selective disclosure of a specific attribute such as “age over 18”, without requiring zero-knowledge proofs. In the EUDI Wallet ecosystem, selective disclosure is the primary mechanism because it is simpler to implement at scale and is well supported by the SD-JWT VC and mdoc standards. Zero-knowledge proofs offer stronger privacy guarantees but are more complex to deploy and are not the default in the eIDAS 2.0 technical framework. Both approaches reflect the broader principle of minimal data sharing, which sits at the heart of privacy by design.
How does selective disclosure support GDPR compliance?
Selective disclosure directly supports GDPR compliance by operationalising the principle of data minimisation. Under GDPR, organisations should collect and process only the personal data that is strictly necessary for a defined purpose. Selective disclosure makes this technically enforceable at the point of identity verification, rather than relying on policy commitments alone.
Several GDPR principles align closely with how selective disclosure works in practice:
- Data minimisation: Only the attributes genuinely needed for a transaction are shared, reducing the volume of personal data processed.
- Purpose limitation: Because the user selects what to share for a specific interaction, data is tied to that purpose rather than collected broadly.
- Storage limitation: If a verifier receives only a confirmed attribute rather than a full document, there is less personal data to store and manage.
- Transparency and control: The user sees exactly what is being shared before they confirm, making the approval meaningful and informed.
For organisations in regulated sectors, this is significant. Selective disclosure embeds privacy into the identity exchange itself. This is what is meant by privacy by design: compliance is an architectural feature, not an afterthought.
It is worth noting that selective disclosure does not automatically make an organisation GDPR compliant. Organisations still need appropriate legal bases for processing, clear retention policies, and robust security measures. For health data, a legal basis under Article 9(2) GDPR is required in addition to a general processing ground. It is also important to distinguish between a user approving a data request within the wallet and providing consent as a GDPR legal basis: these are separate things, and a relying party must establish its own GDPR legal basis for processing the attributes it receives. Selective disclosure does, however, remove one of the most common sources of unnecessary data exposure in digital services.
What should organisations do to support selective disclosure today?
Organisations should start preparing for selective disclosure now. The legal deadline for Member States to make wallet solutions available is 24 December 2026, by which date public sector bodies must also accept notified wallets for online services requiring electronic identification. For relevant regulated private sector organisations, the acceptance obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027. The sectors covered include financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros are exempt. Very Large Online Platforms are subject to a separate provision under Article 5f, where the obligation applies when the platform requires user authentication, on voluntary request of the user and for the minimum necessary data.
Practical interoperability and national rollout are expected to develop in phases. Not every national wallet will reach the same level of maturity on 24 December 2026, and not every cross-border use case will be fully operational across all Member States immediately. The technical standards, regulatory requirements, and user expectations are already taking shape, and early preparation reduces the risk of costly redesigns later.
Here are the most important steps to take:
- Audit your current identity data collection. Map which personal data attributes you collect during onboarding or authentication, and ask honestly whether each one is necessary for the service you provide.
- Review your relying party requirements. Under CIR (EU) 2025/848, adopted on 6 May 2025, organisations that request data from EUDI Wallet users must register with the national competent authority in their Member State of establishment before doing so. Registration is per intended use, specifying which attributes and attestations will be requested. The wallet checks requests against this registered scope. Engage with the relevant national competent authority in your jurisdiction and start defining these requirements now.
- Evaluate your technical infrastructure. Check whether your systems can receive and process credentials in SD-JWT VC or mdoc format, using OID4VP for presentation. Many existing identity stacks will need updates or new integrations.
- Align with your compliance and legal teams. Selective disclosure has direct implications for GDPR documentation, data processing agreements, and the legal bases your organisation relies on for processing identity data. These teams need to be part of the conversation early.
- Follow the outputs of the pilot programmes. The first four Large Scale Pilots ran from April 2023 to 2025 and have concluded. Their findings cover areas including government services, financial onboarding, mobile driving licences, education credentials, and social security. A second wave of pilots started in 2025. Following their outputs helps organisations stay ahead of implementation realities.
Organisations in government services, healthcare, and financial services face the most immediate obligations, but any business that verifies identity or processes personal data should be reviewing their approach. The shift to verifiable credentials and selective disclosure is already underway across Europe. Cross-border use cases may also be subject to sector-specific legislation and national requirements that remain applicable regardless of technical interoperability at European level.
For practical guidance on how to approach this transition, the TrustTech resources section offers relevant insights for organisations navigating eIDAS 2.0 readiness.
How the ID Connector supports selective disclosure
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of selective disclosure, the ID Connector handles the verification steps that sit behind every wallet presentation. It checks the issuer’s signature against the relevant national trusted lists, which are part of the EU List of Trusted Lists (LOTL). It checks revocation status using the issuer’s status information. It validates the wallet unit attestation to confirm the presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope, so that your organisation only receives the attributes you declared during relying party registration under CIR (EU) 2025/848.
For organisations in financial services, healthcare, pharma, or government, the ID Connector provides the technical infrastructure to receive selectively disclosed credentials in SD-JWT VC and mdoc format, without building and maintaining that verification logic in-house.
Get in touch with TrustTech to discuss how your organisation can prepare for selective disclosure and the broader requirements of the EUDI Wallet.