What Is a Digital Product Passport (DPP)?

The Digital Product Passport (DPP) is one of the central concepts in the EU's new product policy. If you sell products in the EU market, a growing share of them will need such a passport in the coming years. This article explains what a DPP really is — and what it is not.

The Digital Product Passport in brief

A DPP is a structured digital record linked to a specific product, model or batch. It brings together, in one place, information about the product's identity, regulatory compliance, composition, environmental impact, repair options and end-of-life handling.

In other words, the passport organises data that today is scattered across spec sheets, declarations of conformity and technical files. It makes that data available in a form readable both by people and by IT systems. That "machine readability" is exactly what sets a passport apart from an ordinary online product page.

Why the product passport exists

The purpose of the passport is transparency across the whole product life cycle. The regulator wants the information needed for repair, reuse, recycling or compliance checks to be available when it is needed — rather than buried in a manufacturer's archive.

For a company this is a shift in mindset: product data stops being an internal document and becomes part of the product itself. A well-prepared passport makes it easier to work with trading partners, repairers and material-recovery operators.

The three parts of every DPP

Every passport rests on three connected parts:

• A unique identifier that unambiguously recognises the product.
• A data carrier — most often a QR code — placed on the product, its packaging or a label.
• A machine-readable digital record that the carrier points to.

These layers work together: the identifier says which product it is, the carrier lets you reach it, and the record holds the actual data. We expand on this in our article on the three pillars of a DPP.

A DPP is a data layer, not a QR-code page

The most common misconception is to equate the passport with the QR code. A QR code is only a carrier — an access mechanism that points to data. It is not the passport itself, just as a phone number is not the conversation.

The passport is the structured set of data the code leads to. This distinction matters in practice: data can be updated, versioned and served in several languages without changing the code printed on the product. We cover this in DPP vs QR code.

What information the passport holds

The exact data scope depends on the sector, but a useful model groups it into a few layers:

• product identity — identifiers, model, variant,
• responsible-operator data — who places the product on the market,
• composition and materials — what the product is made of,
• environmental and life-cycle information — impact, durability, reparability,
• traceability and evidence — links to compliance documentation.

This is a helpful framing, not a rigid legal list — the specific fields are set by the delegated act for each product group.

Model, batch or item

A DPP can describe a product at three levels of detail:

• Model — the whole product line or variant.
• Batch — a specific production run.
• Item — a single, individually identifiable unit.

The right level depends on the sector and the regulatory goal. Batteries, for example, require a passport at the level of the individual item. More in Model, batch, item.

ESPR: the framework that introduces the DPP

The DPP obligation stems from the ESPR (Ecodesign for Sustainable Products Regulation), Regulation (EU) 2024/1781. ESPR is a horizontal framework: it establishes the passport mechanism itself but does not, on its own, define what data a specific product must carry.

Those details come from delegated acts adopted separately for individual product groups. That is why requirements for batteries, textiles or furniture will differ — despite the shared legal framework.

A phased rollout: batteries first

ESPR does not take effect for all products at once. Obligations arrive in waves, sector by sector. The first area with a product passport is batteries — under a separate instrument, Regulation (EU) 2023/1542, the battery passport applies from 18 February 2027.

Further product groups will join in later years as delegated acts are adopted. We lay out the full picture in the ESPR timeline.

Who is responsible, and where the data lives

Responsibility for the accuracy of passport data sits with the economic operator — the manufacturer or importer placing the product on the market. A platform provider does the technical work but does not take on that legal responsibility.

The data itself stays decentralised, with the company or its service provider. The EU registry acts as an index and a verification layer for identifiers, not a central database of full passports. This is a deliberate design that limits the risk of a single point of failure.

Layered access to data

Not all passport data is public. ESPR provides for layered access: some information is public, while some is reserved for market-surveillance authorities, notified bodies or parties with a legitimate interest. This lets consumers see what concerns them while sensitive data stays protected.

The model balances transparency toward the customer with protection of the manufacturer's trade secrets.

The DPP and the data you already have

A passport rarely requires creating data from scratch. It usually draws on information the company already holds — in ERP systems, spec sheets, declarations of conformity or supplier documentation. The challenge is bringing it together into one consistent, complete and up-to-date record.

That is why rolling out a DPP is largely a data-tidying project. The better organised your product data is, the easier the passport is to build and to maintain over time.

Key takeaways

• A DPP is a digital data record tied to a product, model or batch — not the QR code itself.
• It rests on three parts: an identifier, a data carrier and a digital record.
• The legal basis is ESPR (2024/1781); the details come from delegated acts.
• Obligations arrive in waves — batteries first, from 18 February 2027.
• The manufacturer or importer owns the data; the EU registry is an index, not a data warehouse.

See how CyfroPass lets you build and publish a Digital Product Passport without writing code. Visit cyfropass.pl and start with your first product.