What is a Digital Product Passport (DPP)?
A Digital Product Passport is a digital record carrying a product's origin, composition and environmental data, accessed through a data carrier. Its legal framework is ESPR, and its first mandatory application is in batteries.
A Digital Product Passport (DPP) is a structured digital record of a product’s origin, material composition, repairability and environmental impact, accessed through a data carrier on the product (usually a QR code). Its purpose is to take product information out of the manufacturer’s archive and make it available along the whole chain: customs, buyers, consumers and recyclers.
What is the legal basis?
The framework is set by the Ecodesign for Sustainable Products Regulation (ESPR), 2024/1781. It entered into force on 18 July 2024 and replaced the Ecodesign Directive 2009/125/EC.
Key point: ESPR on its own does not impose a passport on any product. The concrete obligation (which product, which data fields, from which date) is set per product group by delegated acts, so the answer to “when does the DPP become mandatory?” depends on your sector.
The exception: batteries
Batteries did not wait for ESPR. Their own regulation, 2023/1542, defines the passport obligation directly and fixes the date: 18 February 2027, for LMT batteries, industrial batteries above 2 kWh and electric vehicle batteries. That makes batteries the first sector where the DPP applies in practice, and a de facto template for other sectors.
Which products will be covered?
The first ESPR working plan, published by the European Commission in April 2025, set the priority product groups:
- Iron and steel, and aluminium, as intermediate products upstream in the chain. A steel producer will need data not only on its own product but also from its suppliers.
- Textiles and apparel
- Furniture
- Tyres
No obligation arises until the delegated act is adopted. Delegated acts for textiles and for iron and steel are not yet adopted; expectations point to after 2027, which is indicative, not a deadline. The compliance window after a delegated act is usually 18-24 months, and collecting supply chain data alone takes longer than that.
What is inside a passport?
Data fields vary by product group, but the ESPR framework describes a common backbone:
Behind every field sits a quiet but decisive question: where did this value come from? A self-declaration states a number. A provable passport also carries the number’s source.
Data carrier and identity
The identifier in the data carrier (QR code, RFID or Data Matrix) must follow a standard to mean anything to customs or buyers. The de facto standard is GS1 Digital Link, which expresses existing GS1 identifiers such as the GTIN as a web address, for example /01/08698765432104/21/SN-4471, where 01 is the GTIN and 21 the serial number.
The passport page should be server-rendered: a page that needs JavaScript to show content may look empty to customs automation and archiving tools.
Is the DPP the same as CBAM?
| Criterion | DPP | CBAM |
|---|---|---|
| Purpose | Product information transparency and circularity | Equalising the carbon cost at the border |
| Who is obliged | The economic operator placing the product on the EU market | The EU importer, who asks the producer for the data |
| Consequence | Market access (no record, no sale) | Financial (cost of certificates) |
| Common ground | Both require installation-level, verifiable supply chain data. | |
Collecting the same data twice is waste. Read the CBAM summary.
Where to start
Confirm whether you are in scope
List your product groups at CN code level and map which regulation (ESPR delegated act, Batteries Regulation, CBAM) applies to which product, and from when.
Map the product tree and data owners
Identify which supplier holds which data field. Most of the required data usually sits with your suppliers, or with their suppliers.
Start collecting data now
Supplier data collection is operational work: reminders, verification, closing gaps. It cannot start on the deadline.
Standardise identity and publishing
Set up canonical identifiers on GS1 Digital Link, publish passports server-side and prepare records for the central EU registry.
Frequently asked questions
01Is a DPP mandatory for every product?
No. Obligations arrive product group by product group, through delegated acts. Batteries are currently the only category with a fixed date (18 February 2027).
02Will competitors see my passport data?
No. Passports are layered: the public layer shows origin, material class and care information, while emissions detail and the supply chain are open only to authorised authorities. Recipes, costs and supplier prices appear in no layer.
03Who is responsible for data accuracy?
The economic operator placing the product on the EU market. That is why a self-declared form is not enough.
See how Provscope works, or contact us to check your scope.
Read next
Privacy Policy
Explains which personal data we process on our website and on the Provscope platform, why we process it, who we share it with and…
Read more LEGALTerms of Service
These terms set out the rights and obligations that apply to the use of the Provscope website and the DPP and CBAM compliance platform.
Read more LEGALCookie Policy
Explains which cookies are used on our website and platform, which are not, and how you can manage cookies.
Read moreFind out in 30 minutes which obligations apply to you.
Tell us about your product groups and EU markets. We will map which dates apply and where the data has to come from.
- Obligations list for your product group
- Supplier data collection plan
- Default vs actual estimate for CBAM