CSDDD due diligence and DPP: how they connect

More and more companies hear two acronyms at once: CSDDD and DPP. Although both relate to sustainability and the supply chain, they concern entirely different things. This article explains what the due-diligence directive is, why it is not a product passport — and how the data behind a DPP can support due-diligence processes.

What CSDDD is

CSDDD is the Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760. It places human-rights and environmental due-diligence obligations on companies across the value chain.

In practice this means identifying, mitigating and accounting for adverse impacts — not only of a company's own operations, but also those of its partners in the supply chain. The obligations are set to phase in around 2029 (the directive was amended by Directive (EU) 2026/470). The exact scope and timeline are still taking shape, so they are best followed with some caution rather than pinned to firm details.

CSDDD is not a DPP

The most important distinction: CSDDD is not a Digital Product Passport. It is an obligation placed on the company, not on the product.

• A DPP describes a specific product, model or batch — its identity, composition and compliance. We cover this in What is a DPP.
• CSDDD concerns processes within the enterprise — how the company manages risks across its value chain.

In other words, a DPP is a data layer about the product, while CSDDD is a duty to act on the part of the organisation. The two should not be confused, and a passport should not be treated as a CSDDD compliance tool.

Where CSDDD and DPP meet

Despite their different nature, both regimes rest on the same discipline: reliable, well-organised supply-chain data. This is where a practical synergy appears.

A well-run DPP organises information that can feed due-diligence processes:

• identifiers of products and components,
• composition and materials the product is made of,
• data on responsible operators in the chain,
• evidence and documentation confirming origin and compliance.

The same data a company gathers for the passport can help document where materials come from and who is responsible for each stage. That shared foundation is what makes the two efforts reinforce one another.

An example: from material to evidence

Imagine a furniture maker who wants to show where the wood in its products comes from. If its product passport already holds organised component identifiers, material information and supplier data, a large part of the documentation work is already done.

The due-diligence process can draw on that data: it becomes easier to flag risky links in the chain, ask a supplier for additional evidence and record the steps taken. The passport does not assess the risks for the company, but it provides a solid starting point — an organised, product-linked base of facts to work from.

A DPP does not replace due diligence

An important caveat: a DPP is not a CSDDD compliance tool and does not, on its own, satisfy due-diligence obligations. Due diligence is a process — risk assessment, corrective action and monitoring — not a set of data.

One way to put it: the passport supplies structured material on which the due-diligence process can build. It is the shared data discipline that supports both obligations, even though each remains distinct. We describe similar links between regimes in ESPR, batteries and CBAM and The Data Act and access to product data.

One discipline, many obligations

It is worth noticing a broader pattern: the same well-organised product data recurs across many EU regulations. A consistent set of information about a product and its supply chain, gathered once, can serve the passport, environmental reporting and due-diligence processes at the same time.

That is why investing in data quality rarely concerns just one obligation. Companies that treat product data as a shared foundation adapt more easily to each new requirement, instead of rebuilding everything from scratch every time a new rule appears.

How to prepare

For many companies the best starting point is bringing product data and supply-chain data together in one place. A complete, up-to-date and traceable data set makes both building a passport and later due-diligence processes easier.

It is worth keeping a sense of proportion: since the scope and timeline of CSDDD are still taking shape, running too far ahead of the detail can be risky. A solid data foundation, however, is an investment that pays off regardless of the final shape of the rules — because the same material serves several obligations at once.

Key takeaways

• CSDDD (Directive (EU) 2024/1760) is a company duty of human-rights and environmental due diligence.
• The obligations phase in around 2029 (amended by Directive (EU) 2026/470).
• CSDDD is not a DPP: it concerns processes within the enterprise, not a product passport.
• DPP data (identifiers, composition, operators, evidence) can support and document due diligence.
• A DPP does not replace due diligence — it supports it with the same data discipline.

See how CyfroPass helps you organise product and supply-chain data in one place. Visit cyfropass.pl and build a solid foundation for the obligations ahead.