Opinion 5/2026 on the Proposal for a Regulation on the establishment of European Business Wallets

on the Proposal for a Regulation on the establishment of European Business Wallets

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the establishment of European Business Wallets . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 19 November 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the establishment of European Business Wallets.

The objective of the Proposal is to provide a harmonised, trusted, and user-friendly digital framework for economic operators and public sector bodies to securely identify, authenticate and exchange data with full legal effect across EU borders. The European Business Wallet would complement the European Digital Identity Wallets by introducing a market-driven digital tool designed for the specific needs of business transactions.

The EDPS understands the need for additional transparency, verifiability, traceability and accountability in a business-to-government and business-to-business context, which explains why different design choices may need to be made for European Business Wallets (used by economic operators acting in a commercial or professional capacity) in comparison to the European Digital Identity Wallet (used by individuals acting in a private capacity). That being said, the EDPS recalls that compliance with data protection rules must be ensured where data amounts to personal data. Against this background, the EDPS welcomes that the Proposal (1) recalls the need to ensure compliance with EU data protection rules; (2) provides for the functionality of selective disclosure; and that (3) the Commission would be required to make the European Digital Directory only accessible to European Business Wallet owners and their authorised representatives and providers of European Business Wallets. His recommendations relate to a further clarification of the applicable data protection rules and principles, and to establishing a duty for the European Commission as supervisory authority for Union entities issuing business wallets to cooperate with the EDPS.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 19 November 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the establishment of European Business Wallets (‘the Proposal’).

2. The objective of the Proposal is to provide a harmonised, trusted, and user-friendly digital framework for economic operators and public sector bodies to securely identify, authenticate and exchange data with full legal effect across EU borders . It aims to enable a new harmonised and digital approach to cross-border business-to-government and business-to-business interactions .

3. The European Business Wallets proposal aims at complementing the European Digital Identity Wallets by introducing a market-driven digital tool designed for the specific needs of business transactions .

4. The Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions of 29 January 2025 , subtitled ‘A Competitiveness Compass for the EU’, explicitly mentions the European business wallet as the cornerstone of doing business simply and digitally in the EU, providing a seamless environment for companies to interact with all public administrations .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 58 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

6. The EDPS welcomes the underlying objectives of the Proposal to further promote digitalisation in governments and increased uptake of trust services in the business environment and beyond.

7. The EDPS notes that, despite the similarity in names, the European Business Wallets and the European Digital Identity Wallets have different providers, offer partially different services and are based on different technical solutions. The EU Digital Identity Wallet is 9 10 issued by or on behalf of Member States to natural (or legal) persons , is based on mobile technology, and provides eID and Trust Services. The European Business Wallets as 11 12 provided for in the Proposal would be issued by service providers , to economic operators , would be cloud-based , and would offer additional services such as secure business-tobusiness or business-to-government communication, data sharing and access control mechanisms . The European Business Wallets would therefore complement the European Digital Identity Wallet, but not replace it.

8. The European Business Wallets would cover a wide range of use cases for economic operators, while building on the existing eIDAS framework. As an economic operator’s European Business Wallet would be in the cloud, several representatives of the operator could be empowered to use it at the same time and for different purposes . The European Business Wallets would support many different use cases, simplifying interactions in a business environment.

9. In addition, the Proposal would create a European Digital Directory. This Directory would serve as a trusted, Union-wide contact and discovery mechanism that allows economic operators and public sector bodies using European Business Wallets to be reliably identified and contacted, thereby increasing legal certainty in business-to-business and business-togovernment interactions . It would support secure, interoperable, and traceable communication across borders by providing a reference source maintained by the Commission, while avoiding duplication of existing registers and relying on authentic sources such as business registers .

10. The EDPS recalls that self-employed persons and sole traders that would use the European Business Wallets would be considered ‘data subjects’ under the GDPR. The same can be applicable in certain circumstances where legal persons would use European Business Wallets, notably where the official title of the legal person identifies the natural person behind the legal person .

11. Against this background, the EDPS welcomes the clarification in Recital 39 of the Proposal that the Regulation (EU) 2016/679 (‘GDPR’) applies to all personal data processing activities under the Proposal. As the European Digital Directory would be established and maintained by the Commission, the EPDS recommends also making reference to Regulation (EU) 2018/1725.

12. The EDPS also welcomes the explicit reference to the core data protection principles of data minimisation and purpose limitation, as well as obligations such as data protection by design and by default, in the second sentence of the Recital. However, the EDPS notes that these references are only made in relation to the European Digital Directory, whereas these requirements and principles are of general application. Therefore, the EDPS recommends rephrasing the second sentence of Recital 39 of the Proposal so that it applies to all personal data processing under the Proposal and not only to the European Digital Directory.

13. The EDPS takes note of the explanations provided in the Explanatory Memorandum and Staff Working Document regarding the need for additional transparency, verifiability, traceability and accountability in the context of a trusted, standardised channel for business-to-government and business-to-business interactions . The EDPS welcomes these clarifications, which explain why different design choices may need to be made for European Business Wallets (used by economic operators acting in a commercial or professional capacity) in comparison to the European Digital Identity Wallet (used by individuals acting in a private capacity). The EDPS acknowledges the need to document transactions, including the fulfilment of reporting obligations, the conclusion of contracts, and other use cases for the communications channel, including legally binding proof of delivery, and information on who represented the economic operator in these transactions.

14. That being said, the EDPS recalls that compliance with data protection rules must be ensured where data amounts to personal data. Against this background, the EDPS welcomes the Business Wallet functionality of selective disclosure, which facilitates compliance with the data minimisation principle. The EDPS further welcomes that the Commission would be required to make the European Digital Directory only accessible to European Business Wallet owners and their authorised representatives and providers of European Business Wallets .

3. Governance

15. The EDPS notes that in contrast with the European Digital Identity Wallet, a certification of European Business Wallets is not mandatory and not provided for in the Proposal. While the EDPS fully supports the mandatory certification requirement for the European Digital Identity Wallet, he notes that in a business environment a different approach may be adequate, provided necessary safeguards are in place. Additionally, important elements such as trust services that may become part of the European Business Wallet will already be certified under the eIDAS Regulation .

16. The EDPS further notes that entities that intend to provide European Business Wallets would be required to notify that intention together with certain information to the competent supervisory body , simplifying ex-post surveillance.

17. In each Member State, the supervisory bodies designated pursuant to Article 46a of Regulation (EU) No 910/2014 would also be the supervisory bodies for the purposes of the Proposal . Their role would be to monitor compliance with the requirements laid down in the Proposal and to unfold ex post supervisory activities where necessary . The EDPS welcomes that those auhorities would be obliged to cooperate with supervisory authorities established pursuant to Article 51 of the GDPR, in particular, by informing them, without undue delay, where personal data protection rules appear to have been breached and about security breaches which appear to constitute personal data breaches under the GDPR .

18. Article 15(1) of the Proposal recognises the possibility that a Union entity is a provider of a European Business Wallet. In that case, the European Commission shall be its supervisory body. By analogy to Article 13(5)(g) of the Proposal, concerning the cooperation between a Member State’s supervisory authorities, the EDPS recommends including a similar duty for the Commission to cooperate with the EDPS under Article 15 of the Proposal.

4. Amendments to Regulation (EU) No 910/2014

19. The EDPS notes that the Proposal would remove the reference to legal persons in Article 5a(1) of the amended eIDAS Regulation as beneficiaries of European Digital Identity Wallets . The intention seems to be to reposition the EUDIW as a citizen-centric instrument, and to shift professional and organisational use cases for legal persons to the European Business Wallet (EBW) framework, as the Proposal explicitly acknowledges that uncertainty around EUDIWs for legal persons has created legal and technical complexity .

20. The EDPS notes that the Proposal already allows self-employed persons and sole traders to use European Digital Identity Wallets to access European Business Wallet trust services and the secure communication channel.

5. Conclusions

21. In light of the above, the EDPS makes the following recommendations: (1) to rephrase Recital 39 of the Proposal so that it applies to all personal data processing under the Proposal and not only to the European Digital Directory and to also make reference to Regulation 2018/1725; (2) to include in Article 15 of the Proposal a duty for the Commission as supervisory authority over Union entities providing Business Wallets to cooperate with the EDPS, in analogy with Article 13(5)(g) of the Proposal. Brussels, 20 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI