What a DPP must technically do

Summary

Once a delegated act requires a Digital Product Passport for a product group, the passport has to meet the essential requirements in Articles 10 and 11 of Regulation (EU) 2024/1781, and the identifier rules in Article 12. These articles do not describe a product or a file format. They describe properties: how the passport is identified, where its data carrier sits, how open and interoperable the data are, who may read and write, and how long and how safely it must remain available.

The core of Article 10 is the link between a data carrier and a persistent unique product identifier. The data carrier must be physically present on the product, its packaging or accompanying documentation, as the applicable delegated act specifies. Both the carrier and the identifier must comply with the standards referred to in Annex III, which name the ISO/IEC 15459 series, or with equivalent European or international standards until references to harmonised standards are published.

The data themselves must be based on open standards and developed in an interoperable format. Where appropriate they must be machine-readable, structured, searchable and transferable through an open interoperable data exchange network without vendor lock-in. The data must refer to the product model, batch or item as the delegated act specifies, and personal data relating to customers may not be stored in the passport without explicit consent in compliance with Article 6 of the GDPR.

Two operational duties sit on the economic operator placing the product on the market. It must give dealers and online marketplaces a digital copy of the data carrier or the unique product identifier, free of charge and within five working days of a request, so that potential customers can reach the passport when they cannot touch the product. It must also make a back-up copy of the passport available through a DPP service provider.

Article 11 turns to operation. The passport must be fully interoperable with other passports, accessible free of charge and with ease to the actors who have access rights, stored by the responsible operator or by DPP service providers, and kept available even after insolvency, liquidation or cessation of activity in the Union. Data authentication, reliability and integrity must be ensured, with a high level of security and privacy and protection against fraud. The Regulation does not name a single carrier format or data model, and it would be wrong to claim that it does.

Key terms in Articles 10 to 12

The wording of these articles is precise, and several terms have a narrower meaning than in everyday use.

Persistent unique product identifier

The identifier to which the passport is connected through a data carrier. It must refer to the level named in the delegated act (model, batch or item) and comply with the Annex III standards or equivalents.

Data carrier

A linear barcode, a two-dimensional symbol or another medium for automatic capture of identification data that a device can read. Its layout and position are fixed by the delegated act, not by Articles 10 and 11.

Open standards and interoperable format

The data in the passport are to be based on open standards and be transferable through an open, interoperable data exchange network without vendor lock-in. Article 11 adds that the passport must be interoperable with other passports technically, semantically and organisationally.

DPP service provider

An independent third party that stores or processes passports on behalf of the economic operator. It may not sell, reuse or process the data beyond what is needed for the service, unless specifically agreed with the operator. The Commission may adopt delegated acts on requirements and certification for such providers.

Back-up copy

A copy of the passport that the operator placing the product on the market makes available through a DPP service provider (Article 10(4)). Its purpose is continuity, including after the original operator disappears.

Access rights

Customers, manufacturers, importers, distributors, dealers, repairers, recyclers, authorities and other relevant actors are to have access according to rights set in the delegated act. Rights to introduce, modify or update data are restricted in the same way.

The essential requirements, article by article

What this means in practice

Treat Articles 10 to 12 as a design brief, not a specification. They tell you which properties the passport must have, such as persistent identifiers, open standards, back-up availability and restricted write rights, but the concrete choices of data carrier, layout, level and retention period are set for each product group in its delegated act.

The Regulation names standards for identifiers and the carrier, namely the ISO/IEC 15459 series in Annex III, but it does not mandate a specific code symbology, a particular web identifier syntax or a data model. Statements that a given format is required by the ESPR go beyond the text. The Commission may also adopt implementing acts on procedures to issue and verify digital credentials of economic operators and other actors with access rights.

Continuity is a central theme. The back-up copy held by a DPP service provider, the requirement that the passport stays available after insolvency or cessation of activity in the Union, and the prohibition on service providers selling or reusing the data all point the same way: the passport must outlive the business that created it, and must not be locked to one supplier.

What the text leaves open

Articles 10 to 12 do not settle the following, and we offer no view on them.

• The exact data carrier and its symbology for any given product group, which the delegated act specifies.
• The data model and any common vocabulary for the passport content.
• The requirements and certification scheme for DPP service providers, which the Commission may set by delegated act.
• The rules for issuing agencies for unique identifiers and data carriers, which are also left to a delegated act.

Exemptions

These requirements apply only to products covered by a delegated act that requires a passport. A product group can be exempted from the passport itself in the cases in Article 9(4).

• Article 9(4): the Commission may exempt a product group where technical specifications are not available or where other Union law already provides digital information that achieves the same objectives.

Acts that make these requirements concrete

We have not verified the adoption status of any of them.

• Product-specific delegated acts under Article 4 that require a passport and set the carrier, level, access rights and retention period. Application not earlier than 18 months after entry into force, except in duly justified cases.

Where to start

This list is a practical suggestion, not wording taken from the Regulation.

1. Ask whether your systems can issue and keep stable, unique identifiers for products at model, batch and item level.
2. Check whether your product data can be exported in an open, structured, machine-readable form without depending on one vendor.
3. Identify who would host the back-up copy and what an independent DPP service provider arrangement would look like.
4. Define who in your business would need read or write access and how that would be authorised and logged.
5. Do not choose a carrier format before the delegated act for your product group says which one applies.

Frequently asked questions

Does ESPR require QR or GS1 Digital Link?

The regulation text does not name a specific carrier format; it requires a persistent unique identifier linked through a data carrier that complies with the Annex III standards (ISO/IEC 15459 series) or equivalent. Specific formats are expected from the product-specific delegated acts.

Sources

• Regulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, OJ L, 28.6.2024: Articles 9 to 12 and Annex III

Facts last checked against the Official Journal text on 6 November 2026.