The portrait in the EUDI Wallet: what applies from August 2028

From 11 August 2028 the portrait is part of the mandatory person identification data in the EUDI Wallet – the digital ID data issued by each member state. This follows from Implementing Regulation (EU) 2026/1731, in force since 11 August 2026. The same regulation adds safeguards: the wallet warns before biometric data is shared, and relying parties generally may not retain the image. This guide explains what changes and what businesses that verify identities should plan for.

The data identifier is portrait; the regulation also calls it the user’s facial image.

What changes

References: annex of Implementing Regulation 2024/2977, Table 1, as amended by 2026/1731; previously Table 2 of the original version. Member states get until 2028 to adapt their national procedures (recital 3). Where the image comes from an ID card or passport, the quality rules for those documents continue to apply.

In SD-JWT VC the image is carried in the picture claim as a data URL with a base64-encoded JPEG; in mdoc it is the portrait element as a byte string (annex, Tables 7 and 6). Like every other attribute it can be shared on its own: member states must ensure selective disclosure explicitly for the portrait as well.

The safeguards

Implementing Regulation 2026/1731 inserts a new Article 3a “Protection of the portrait” into Implementing Regulation 2024/2977:

1. Warning: when a relying party requests the portrait, the wallet warns that the request involves sharing biometric data (para. 1).
2. Explicit confirmation: the user must explicitly and specifically confirm presenting the portrait (para. 2). Silence or pre-ticked boxes do not count (recital 2).
3. No retention: relying parties may not retain the portrait unless processing is necessary for identification and authentication under EU data protection law, or EU or national law provides for it (para. 3).
4. No transfers abroad: the portrait may only go to third countries or international organisations where EU data protection law permits (para. 3).

In addition, the wallet logs every transaction – date, relying party and the types of data requested – including incomplete ones (Art. 9 Implementing Regulation 2024/2979). Users can see in their dashboard who asked for their portrait.

What this means for relying parties

Request only what you registered. When registering, a relying party lists for each intended use which data it will request and why (Annex I points 9 and 10, Implementing Regulation 2025/848). If you need the portrait, it must be listed there. The registration certificate reflects this, and the wallet can warn the user about requests outside it. See relying party registration.

State the purpose clearly. According to recital 2, processing of the portrait should be limited to what the intended use requires, and that use should be explained to the user with the request in clear language. Requesting the portrait “just in case” – for a simple age check, for example – does not fit.

The GDPR applies on top. The confirmation in the wallet is expressly not a legal basis but a technical safeguard (recital 2). How the GDPR applies depends on what you do with the image:

• Automated face matching (software compares the portrait with a selfie or camera image): this is biometric data under Art. 4(14) GDPR. You need a legal basis under Art. 6 and an exception under Art. 9 GDPR; member states may add further conditions (Art. 9(4)).
• Visual check by staff (as with looking at an ID card today): under recital 51 GDPR, photographs are biometric data only when processed through specific technical means allowing unique identification. In our reading a purely visual comparison therefore does not fall under Art. 9; it still needs a legal basis under Art. 6.

Discard by default. Processes should drop the image after the check – including from logs, screenshots and support tickets. Retention is only allowed where one of the exceptions in Art. 3a(3) applies, for example a legal record-keeping duty. Whether anti-money-laundering rules require keeping the portrait after wallet-based identification had not been clarified as of 12 October 2026.

Plan for no portrait. Until August 2028 the image may be missing, depending on the country; afterwards it is missing for users who opted out where allowed. And any user can decline a single request. Processes that need a portrait therefore need a fallback.

Germany: photo from the ID card chip

Germany’s draft Digital Identities Act allows the PID provider to read the biometric photo from the ID card chip, convert, sign and transfer it to the wallet, after checking the card’s authenticity and the holder’s identity (§ 20(1) of the draft). It contains no user opt-out; the Federation of German Consumer Organisations (vzbv) has called for one. The Bundestag votes on the act on 15 October 2026. More in German: Lichtbild in der EUDI-Wallet.

Timeline

All other dates: EUDI Wallet deadlines. How requests and approval work technically: How the EUDI Wallet works.