Security
Data Persistence and Backup Providers
How to keep DPP data reachable for the product's lifetime — backup service providers, exit planning and domain strategy.
The most overlooked obligation in ESPR Article 10 is this: passport data must stay accessible for the expected lifetime of the product. It looks like a technical detail but it shapes business continuity and contract design.
Three failure points
| Risk | Consequence | Mitigation |
|---|---|---|
| Platform shutdown | Passport unreachable | Data export plus a backup provider |
| Domain loss | Every printed QR becomes a dead link | Your own permanent identity domain |
| Organisation ceases | No responsible operator | Backup mirror and handover arrangement |
Domain strategy
This is the most common mistake: the passport link is printed on the provider's domain. Once millions of labels exist, the contract becomes effectively binding — the opposite of ESPR's ban on vendor lock-in.
The right approach:
- Reserve your own identity domain (for example
id.brand.com). - Keep it separate from marketing domains, which change often.
- Automate renewal on a long horizon.
- Manage redirection through a resolver.
Backup service providers
The reference architecture foresees independent providers mirroring the full data set, so the passport survives the operator disappearing.
In practice that is more than an archive copy: the backup must be able to serve the same identifier with the same access tiers. See EN 18221 data storage and archiving.
What belongs in the contract
- Data export: in a standard format, free of charge, at any time.
- Exit plan: how links survive the end of the contract.
- Backup arrangement: who mirrors what, where and how often.
- Domain transfer: guaranteed if the provider's domain is used.
See what a DPP service provider is and build vs buy.
Frequently asked questions
Is hosting on my own servers enough?
Technically yes, but organisational continuity risk remains. An independent backup addresses it.
How much data is involved?
Passport data is mostly text; volume is not the problem. Continuity of access is.
Can I delete it once the product is discontinued?
No. Units remain in use, so the passport must stay reachable. See passport lifecycle management.
