What goes in a Digital Product Passport? The data, the carrier, and who sees it
"A customer says we need a Digital Product Passport" is one of the most common ways businesses first meet the ESPR. The natural next question is: a passport of what, exactly? Here is what a DPP actually carries, how it is reached, and why most of the precise fields are not pinned down yet.
TL;DR
- A DPP is a structured, machine-readable record of a product's sustainability and circularity data, reached through a data carrier (a QR code, GS1 DataMatrix or RFID/NFC tag) linked to a unique product identifier.
- It typically carries identifiers, composition, substances of concern, durability and reparability, recycled content, carbon and environmental footprint, and end-of-life information.
- Access is differentiated - consumers, repairers, recyclers and authorities each see the parts relevant to them.
- The model is decentralised (no single EU mega-database), with a Commission registry due before 19 July 2026.
- The exact fields for your product are set by your product group's delegated act, so most fields are still expected, not confirmed.
What a DPP is
A Digital Product Passport is a defined set of product data with agreed data-management and access rules, conveyed through a unique product identifier and read electronically via a data carrier. Its job is to carry the information needed for sustainability and circularity - reuse, repair, remanufacturing and recycling. The cross-sector concept comes from the EU-funded CIRPASS project.
The data it carries
Exact fields are set per product group, but the categories are consistent:
- Identifiers - a unique product identifier (model, batch or item level), plus unique operator and facility identifiers.
- Composition - materials and their proportions.
- Substances of concern - presence and location of substances that affect safety, repair or recycling.
- Durability and reparability - expected lifetime, spare-part availability, repair documentation, and a repairability score where one is defined.
- Recycled content - where the delegated act requires it.
- Carbon and environmental footprint - a product carbon footprint and/or a wider Product Environmental Footprint, flagged especially for iron & steel and aluminium.
- End-of-life - disassembly and recycling information for waste operators.
We keep a working field-by-field view, marked confirmed versus expected, on the DPP data requirements guide, and a fill-in DPP data field template.
The data carrier
The passport is reached through a data carrier physically on the product, its packaging or its documentation - a QR code, GS1 DataMatrix or RFID/NFC tag - that links to the product's unique identifier. The relevant standards (via CEN-CENELEC) are still being finalised, so treat exact carrier and encoding rules as not-yet-settled.
Who sees what
Not everyone sees everything. A DPP uses differentiated, need-to-know access: consumers, repairers, recyclers and market-surveillance or customs authorities each see the datasets relevant to them, while commercially sensitive information is protected. The JRC methodology defines who can access which datasets.
Where the data lives
There is no single EU database holding every product's data. The DPP uses a decentralised model: the data stays with economic operators or their solution providers. The Commission must set up a central DPP registry before 19 July 2026, but it holds the list of data carriers and unique identifiers so passports can be located and used by customs - not the product data itself. See the CIRPASS FAQ.
Why most fields are still "expected"
ESPR is a framework law. The precise data fields, the granularity (model, batch or item) and the access rules for any given product are set by that product group's delegated act - and most are not yet adopted. The first live DPP is the EU Battery Passport, mandatory from 18 February 2027, which is the working template for the rest.
What to do now
- Read the plain-English Digital Product Passport explainer and check your scope and timing.
- Start assembling the data you will almost certainly need - identifiers, composition, recycled content and footprint figures - much of which sits with suppliers.
- Use the free DPP Readiness Checklist to separate what to do now from what waits for your delegated act.
FAQ
What data does a Digital Product Passport contain? Identifiers (product, operator, facility), material composition, substances of concern, durability and reparability, recycled content, carbon and environmental footprint, and end-of-life information - with exact fields set per product group by its delegated act.
Is there one big EU database for DPP data? No. The data is decentralised and stays with operators or their providers; the Commission runs a registry of identifiers and data carriers, due before 19 July 2026.
Who can see the data in a DPP? Different audiences see different datasets under a need-to-know model - consumers, repairers, recyclers and authorities - while commercially sensitive data is protected.
Get plain-English DPP updates as the data fields firm up - subscribe to The ESPR Brief.
Related reading
ESPR Ecodesign Requirements Explained: What the Rules Actually Demand
ESPR doesn't regulate products directly - delegated acts do. Here's what kinds of rules they can impose: performance thresholds on durability, repairability and recycled content, plus information requirements via the DPP.
The ESPR ban on destroying unsold textiles: what large firms must do by 19 July 2026
From 19 July 2026, large companies can no longer destroy unsold textiles, clothing accessories and footwear. It's one of the few firm ESPR dates. Here's who's in scope, what counts, and the disclosure that comes with it.
The 2025–2030 ESPR Working Plan: which products come first
The first ESPR Working Plan names the products that get ecodesign rules and Digital Product Passports first. Here's the order, the indicative dates, and how to tell "indicative" from the two dates that are actually fixed.