The Digital Product Passport Guide (2026)

A Digital Product Passport (DPP) is a structured digital record that carries a product's identity, material composition, environmental performance, compliance evidence and end-of-life instructions, reached through a data carrier attached to the physical product — usually a QR code. In the European Union it is becoming mandatory for specific product groups under ESPR (EU) 2024/1781.

This guide walks through everything a manufacturer, importer or exporter placing products on the EU market needs to know, in order: the definition, the legal basis, the data content, the technical architecture, the timeline and the preparation steps.

What is a Digital Product Passport?

A DPP stores the data generated across a product's life cycle in a machine-readable, verifiable form. It has three components:

1. A unique product identifier (UPI) that addresses the product globally at model, batch or item level.
2. A data carrier — QR, Data Matrix, NFC or RFID — that binds that identifier to the physical product.
3. The passport data itself: a structured, product-group-specific data set served at the address the identifier resolves to.

For the basics see what is a Digital Product Passport; for definitions, the DPP glossary.

The legal basis: ESPR

The legal basis is the Ecodesign for Sustainable Products Regulation — ESPR (EU) 2024/1781, in force since 18 July 2024. ESPR is a framework regulation: on its own it imposes no passport duty on any product. The duty arises when a product-specific delegated act is adopted and its transition period expires.

See the ESPR guide and what ESPR is and who it covers.

Which products, and when?

The ESPR Working Plan 2025–2030 named six priority product groups and two horizontal measures. Adoption years are indicative, and a transition period of typically 18–36 months follows.

Separately, the EU Battery Regulation (EU) 2023/1542 makes a passport mandatory on 18 February 2027 for EV, LMT and industrial batteries above 2 kWh — the first mandatory DPP in the EU. For the full calendar see the DPP timeline guide, and for the scoping logic, which products need a DPP.

What data does a passport carry?

The exact set comes from each delegated act, but the same core headings recur:

• Identity and origin: manufacturer, model, batch/serial, production facility, country of origin.
• Material composition: material shares, hazardous-substance declarations, recycled content.
• Environmental performance: carbon footprint, energy and water use, life cycle assessment results.
• Circularity: repairability, disassembly, spare parts, recycling instructions.
• Compliance: declarations of conformity, test reports, certificates.

For the technical shape of the data set see the DPP data model guide.

Access tiers: one QR, several depths

The most common misconception is that everything in a passport is public. In reality the passport is tiered:

• The public tier — free, no login, no app download. This is what a consumer sees.
• Restricted tiers — opened by authentication to roles such as repairers, recyclers, customs and market surveillance authorities.

FprEN 18239 standardises this model; see restricted data tiers. Tiering is exactly what makes trade-secret protection possible.

Technical architecture

CEN/CENELEC JTC 24 produced eight system standards under standardisation request M/604; the first six were published on 27 May 2026. The architecture has three parts:

1. EU central services — the DPP Registry, a web portal and a semantic repository.
2. Decentralised passport data — hosted by the economic operator or a DPP service provider.
3. Third-party services — notably backup providers, for data persistence.

What each standard does is covered in the DPP standards guide; carrier and access rules in EN 18220. On identifiers, the dominant practical choice is a URI built on GS1 Digital Link.

The EU DPP Registry

ESPR Article 13 required the Commission to establish a central DPP Registry by 19 July 2026, and it went live. The registry is an index, not a database: it holds unique identifiers, pointers to where each passport is hosted, customs commodity codes and verification data. The passport content stays with the operator.

At import, customs matches the declared commodity code against the registered identifier. See the EU DPP Registry guide.

Who is responsible?

Responsibility sits with the economic operator placing the product on the EU market — for a non-EU manufacturer, in practice the importer or authorised representative. Distributors and online marketplaces must verify that a compliant passport and data carrier exist before offering the product.

Technical operation can be contracted to a DPP service provider in writing; legal responsibility cannot be transferred. See economic operators and their duties.

Where to start: eight steps

1. Scope it: which of your product groups fall in, and when?
2. Inventory the data: which fields already exist in ERP/PLM, and which do not exist at all?
3. Map your suppliers: at which tier does the missing data sit?
4. Choose an identifier strategy: GTIN plus GS1 Digital Link, or your own scheme?
5. Decide granularity: model, batch or item level?
6. Run a pilot end to end on a single product family.
7. Set up data governance: who updates, who approves, who signs?
8. Wire up registry submission.

For step-by-step lists see the EU exporter compliance checklist and the data collection checklist; small teams should start with the SME guide.

What does it cost?

Market data puts compliance-only setups below €15,000 a year, while bespoke enterprise programmes exceed €100,000. Per-passport costs typically land between €0.50 and €2.00, with QR printing under €0.02 a unit. For a small brand under 100 SKUs, first-year total cost is usually €2,500–€10,000 and drops 35–50% in year two.

See the DPP cost guide for the full breakdown — and the cost of non-compliance for the other side of the ledger.

Frequently asked questions