What a digital product passport actually contains

Most companies meet the digital product passport (DPP) as an acronym in a customer questionnaire or a tender document, and file it under IT. It is not an IT topic. It is a condition for putting a product on the EU market, and the work it requires sits in procurement, product and compliance long before it reaches a developer.

Here is what the record has to hold, who reads which part of it, and at what moment it has to exist.

The short answer

The European Commission describes the DPP as a digital identity card for products, components and materials: a structured record holding the information that supports a product's sustainability, its circularity and its legal compliance. It is reached by scanning a data carrier, a QR code or similar technology, placed on the product itself, on its packaging, or on the documents that accompany it.

Two things follow from that definition, and both are commonly missed.

The record is not the code. The carrier is how you reach the passport. The passport is the data behind it, and that data has to be accurate for as long as the product exists.

The record is not the same for every product. What a DPP must contain is set by the delegated act adopted for that specific product group under the Ecodesign Regulation, or by separate product-specific legislation. There is no single universal field list, which is why "what do we need to collect" only has an answer once you know which category you are in and which act applies to it. Our EU DPP regulation timeline sets out which categories are scheduled first.

What goes inside

The delegated act for your category is the authority on the exact fields. Across the acts drafted so far, the requirements consistently cluster into four groups, and they are worth understanding now because three of the four depend on data you do not hold yourself.

Identity. What the product is, which model it belongs to, which batch or item it is, and which economic operator placed it on the market. This is the only group that is fully inside your own systems.

Materials and composition. What the product is made of, the share of recycled content, and the substances of concern it contains. These fields are checked first by auditors and by customs, and they are the ones companies most often estimate rather than prove.

Supply chain. Which suppliers and which production facilities were involved. This lives upstream, in companies you influence but do not control, and collecting it is the longest part of any DPP project.

Lifecycle. Durability, repairability, disassembly and end of life. These are not optional extras. The regulation exists to drive circularity, and these fields are increasingly scored in tenders.

The practical consequence is a scheduling one. Identity data you can produce in a week. Supply chain and material provenance data takes months, because every missing field is a conversation with a supplier who has no obligation to answer quickly.

The same passport, four different readers

A DPP is not a page. It is one record that presents a different slice to each party entitled to see it. The Commission sets out four groups.

The economic operator, meaning the manufacturer, authorised representative, importer, distributor, dealer or fulfilment service provider, carries the primary responsibility. They compile the data in the structure the legislation specifies, register the passport in the EU DPP Registry, attach the physical data carrier to the product, its packaging or its documentation, and keep the data accurate across the product's whole life. That last duty is the one that turns a DPP from a project into a process.

The consumer scans the carrier and gets information before buying, which supports comparison between products, and after buying, where the passport can hold manuals, maintenance guidance and end-of-life instructions.

Public authorities use it for enforcement. Customs can search the Registry electronically at the point of entry to verify that a passport has been registered, which allows automated screening of imports. Market surveillance authorities can scan a carrier to reach the documentation and run targeted searches for non-compliant products. Note that the interconnection enabling automated customs verification is scheduled to be operational within four years of the relevant implementing act entering into force, so this tightens over time rather than all at once.

Repairers, refurbishers and recyclers get the technical layer, where the delegated act requires it: disassembly instructions, compatible spare parts, diagnostic information, material composition, and which components hold substances that must be removed safely.

One record, four audiences, different permissions. Designing for only the consumer view is the most common way to build a passport that fails its first audit.

What a digital product passport is not

It is not a QR code. The QR code is a carrier. Any print shop can produce one this afternoon. It proves nothing about what sits behind it, and a code anyone can copy proves nothing about the product either.

It is not a PDF. A document is a snapshot. The passport has to reflect the product as it is now, and products change: suppliers are replaced, formulations are adjusted, recall status changes. A record frozen at launch is wrong within a season, and wrong is worse than absent because it was declared.

It is not a product landing page. A scan that opens a marketing page with a sustainability story is marketing. A passport is a structured, verifiable record that an authority can query and a recycler can act on.

It is not a database the EU keeps for you. The architecture is hybrid. The EU DPP Registry holds unique identifiers and links each one to the location of the passport. It does not store your product data. The data itself is held in a decentralised way, by the economic operators or by service providers acting for them. If you assumed the Commission would store the passport, that assumption leaves a gap in your plan.

When it has to exist

The passport must be active and registered when the product is placed on the EU market, meaning when it is first made available there.

For products manufactured in the EU, that is before they are first sold or distributed. For imported products, it is before customs can release them for free circulation at the EU external border. Depending on where the product is made, the duty to create the passport and register its identifiers falls on the manufacturer, the authorised representative, the importer, the distributor, the dealer or the fulfilment service provider.

This is what makes the DPP a market access question rather than a reporting one. A missing passport does not produce a fine at the end of the year. It produces goods that cannot be sold.

It does not hold customer data

A question that comes up in every legal review, so it is worth stating plainly. The Ecodesign Regulation is built on data protection by design and by default. General access to product information is anonymous, with no identification needed. The regulation explicitly states that personal customer data is not to be stored in the DPP. The single exception is where an individual gives explicit, informed consent for a specific stated purpose, in full compliance with the GDPR.

The passport describes the product, not the person holding it.

What this means for the next twelve months

If your category's date is still indicative, the work in front of you is not technical. It is finding out which fields you can already prove with a document, which ones live with suppliers who have never been asked, and who inside your company is accountable for keeping the answer current. That is a twelve to eighteen month exercise done properly, and it does not get shorter by starting later.

Junction builds and keeps that record: it collects and enriches product and supplier data, generates the passport your category requires, keeps it current as the product changes, and binds one code per item that works as both a passport and a proof of authenticity.

Do you know where your company stands today?

Next: what has to be ready before your category's date, a ten step checklist.

Sources

• European Commission, *Digital Product Passport: Frequently Asked Questions*, January 2026 update.
• Questions 1, 2, 3, 11, 16 and 19.
• Regulation (EU) 2024/1781 (Ecodesign for Sustainable Products Regulation), Article 15(3) on the
• customs interconnection.
• ESPR Working Plan 2025-2030, COM(2025) 187, adopted 16 April 2025.