The ESPR establishes the common architecture. Product-specific delegated acts decide the final data fields and implementation details. This guide separates the durable system requirements from product-specific rules that are still emerging.
The applicable delegated act determines which data must be included, which carrier is used, where it appears, whether the passport is model-, batch-, or item-level, who may access or update data, and how long the passport must remain available.
A DPP is not a one-time label. The regulation requires the passport data to be accurate, complete, and up to date for the applicable product.
The passport must be connected through a data carrier to a persistent unique product identifier.
The applicable act will specify whether the carrier is physically present on the product, its packaging, or accompanying documentation.
DPP data must use open standards and an interoperable format and, where appropriate, be machine-readable, structured, searchable, and transferable without vendor lock-in.
Personal data relating to customers cannot be stored in the DPP without explicit consent under applicable data-protection law.
The applicable product rules specify which actors can access which data. The technical design must make access easy and free of charge for actors according to their respective rights.
When placing a product on the market, the responsible economic operator must make a backup copy of the passport available through a Digital Product Passport service provider.
The system must support technical, semantic, and organisational interoperability for end-to-end communication and data transfer.
DPP availability must survive for the period specified in the product rules, including after insolvency, liquidation, or cessation of activity by the economic operator responsible for its creation.
The technical design must ensure data authentication, reliability, integrity, a high level of security and privacy, and protection against fraud.
The Commission states that in-scope DPPs must be registered in the EU DPP Registry in line with the relevant technical specifications and legal requirements before products are placed on the Single Market.
The exact data fields, identifier level, carrier placement, access rights, and retention period depend on the legislation or delegated act applying to the product group. Use this page as an architecture checklist, then verify the applicable sector rule before making a compliance decision.
TRACK UPCOMING SECTOR RULES↗