Standards
EN 18221: Data Storage and Archiving
How EN 18221 defines how long and how passport data must be stored and archived — persistence, backup providers and version history.
ESPR Article 10 requires passport data to stay accessible for the expected lifetime of the product. EN 18221:2026 defines the technical answer: storage, archiving and persistence rules.
For how long?
"Expected lifetime" varies by product group:
| Product | Typical expected lifetime |
|---|---|
| Apparel | 3–8 years |
| Home appliances | 10–15 years |
| Furniture | 10–25 years |
| Industrial equipment | 20 years+ |
| Batteries (including second life) | 15 years+ |
That duration shapes your technology choices: the platform, formats and domain you pick today have to survive it.
Version history
When a passport is updated, the old version is not deleted. An audit must be able to answer "what was declared on that date?" — which requires an append-only store. See audit trails and versioning and passport lifecycle management.
Backup service providers
The reference architecture foresees independent providers mirroring the full data set. The purpose is clear: even if the operator becomes insolvent, the platform closes or the domain lapses, the passport must remain reachable.
That has to show up in your contracts: an export right, a backup arrangement and an exit plan. See what a DPP service provider is and data persistence and backup.
Implementation notes
- Choose formats for longevity: open, text-based formats rather than proprietary binaries.
- Domain strategy: keep your identity domain separate from marketing domains, and permanent.
- Archive access: older versions can be served from slower storage, but must remain reachable.
- Deletion policy: apart from personal data, passport data is not deleted. See GDPR and DPP data.
Frequently asked questions
The product is discontinued. Can I archive it?
Mark the status as discontinued but keep it accessible; units remain in use.
Can I do the backup myself?
Technically yes — but backup only means something in an insolvency scenario if it is independent of the operator.
How much data is this?
Passport data is mostly text and small in volume. The challenge is not size but continuity and accessibility.
