Your passport has to survive your vendor going out of business

Here is a question almost nobody asks a digital product passport (DPP) vendor during procurement, and it is the one the regulation cares about most.

Your provider goes under. Does your passport go dark with it?

The law says it cannot

The passport has to remain available for the product's lifetime, and the Ecodesign Regulation puts a specific mechanism behind that. Under Article 10(4), the economic operator must make available a back-up copy of the passport through a digital product passport service provider.

Annex III goes further: the passport itself has to carry the reference of the provider hosting that back-up. The continuity arrangement is not a private contract detail. It travels inside the compliance record.

So this is not a resilience nice-to-have that a procurement team can trade away for a better price. It is a requirement, and the absence of an arrangement is a gap in the passport itself.

Why the requirement exists

Because the passport outlives almost everything around it.

A product sold in 2029 with a fifteen year life needs a passport that resolves in 2044. Over that period, a supplier will be replaced, an ERP will be migrated, a hosting contract will be renegotiated, and there is a real chance that at least one vendor in the chain will be acquired, pivot, or fail.

Passport data is meant to serve recyclers and repairers at end of life, which is precisely the moment furthest from the sale, and the moment when the original commercial relationships are least likely to still exist.

What to ask a provider, including us

Four questions, and short answers are the good sign.

Where does the passport live, and can I export it in full, today, without asking? If export is a support ticket, a professional services engagement or a contractual negotiation, the data is already less portable than it looks.

Who holds the back-up copy under Article 10(4), and how is that reference carried in the passport? There is a right answer here and it is a name, not a reassurance.

What is the documented process if you cease trading? Escrow, a successor arrangement, an export trigger. Something written down.

Can the data be re-hosted elsewhere without re-issuing the identifiers? If moving provider means new identifiers, then every carrier already printed on a physical product becomes wrong, which is not a migration but a recall.

Why we put this page on our own site

Because the question cuts against every vendor including us, and a buyer who asks it is a buyer who will still be compliant in ten years. The regulation is explicit that service providers may not sell, reuse or process passport data beyond what the service requires unless the operator specifically agrees. A vendor whose commercial model depends on holding your data hostage is already at odds with the text.

Sources

• Regulation (EU) 2024/1781 (ESPR): Article 2(32) defining the DPP service provider, Article 10(4)
• on the back-up copy, Article 11 on service provider obligations, Annex III point (l) on carrying
• the back-up provider reference.