ESPR
What Is a DPP Service Provider?
What a Digital Product Passport service provider does, which responsibilities can be delegated to one, which cannot, and what to check before signing.
ESPR allows an economic operator to delegate the technical operation of a passport to a third party under a written contract. That party is a "DPP service provider", and a dedicated delegated act on the topic is expected from the Commission.
What a provider does
| Function | Description |
|---|---|
| Hosting | Storing and serving the passport data |
| Resolver | Redirecting the identifier to the current address. See what a resolver is |
| API | Providing EN 18222 operations |
| Versioning | Append-only version history and audit trail |
| Signing | Content integrity and verification. See eIDAS and signing |
| Registry integration | Identifier registration and updates |
| Backup | The persistence duty. See data persistence and backup |
What you cannot delegate
Legal responsibility. A market surveillance authority knocks on the door of the economic operator who placed the product on the market, not the provider. Your contract may give you recourse, but the regulatory addressee does not change. See economic operators and their duties.
What belongs in the contract
- Data ownership: the data is yours, not the provider's — say so explicitly.
- Export: full data export in a standard format, free of charge, at any time.
- Exit plan: how passport links survive the end of the contract.
- Service level: an availability commitment — the passport must stay up for the product's lifetime.
- Subprocessors and hosting location: where the data physically sits.
- Security: access control, audit trail, incident notification. See cyber security for DPP systems.
The lock-in trap
ESPR Article 10 explicitly bans vendor lock-in. In practice the trap is usually printed QR codes: millions of labels bearing a provider's domain make the contract effectively binding. The fix is to run the resolver on your own domain, or to secure domain transfer in the contract.
Frequently asked questions
Do I have to use a service provider?
No. You can host the passport yourself; the obligations are unchanged. See build vs buy.
Can I use more than one provider?
Yes — hosting with one, backup with another, for instance. The standards already foresee independent backup providers.
What if my provider goes out of business?
The persistence duty stays with you. That is why backup arrangements and an export right are the most critical clauses in the contract.
