What Is a Digital Product Passport (DPP)? Law, Data and What It Means for Manufacturers

 The Digital Product Passport (DPP) is a structured, machine-readable record, reachable through a data carrier on the product such as a QR code, that makes standardised information about a product available across its whole lifecycle. The European Union is making it mandatory, product group by product group, and for manufacturers and distributors that turns sustainability data into a legal obligation with deadlines attached. This article explains what a DPP is, the law behind it, which data it must hold, who is liable, and why the whole thing is, at heart, a product-data challenge.

What Is a Digital Product Passport?

A Digital Product Passport is the digital identity of a physical product. Scan the data carrier and you reach information that follows the item from raw material to disposal: what it is made of, which substances of concern it contains, how to repair it, how to recycle it, and where it came from. The audience is broad on purpose. Consumers use it to make better choices, businesses use it along the supply chain, and authorities use it to check compliance. The point is not a marketing label but a single, trustworthy place where a product’s environmental and technical facts live.

The Legal Basis: the EU Ecodesign Regulation (ESPR)

The DPP is created by the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, known as the ESPR. It was published in the Official Journal in June 2024 and entered into force on 18 July 2024, replacing the old Ecodesign Directive from 2009. The ESPR is a framework regulation, which is an important detail. It does not set the rules for a toaster or a t-shirt directly. Instead it empowers the European Commission to adopt delegated acts for each product group, and those acts decide the specific ecodesign and DPP requirements that apply. A product covered by such an act may only be placed on the market if its passport exists and is registered in a central, Commission-run DPP registry.

Timeline and affected product groups

The phasing runs through delegated acts, so the dates below mix firm statutory milestones with sector estimates that only become binding once the relevant act is adopted. Treat the non-battery sector years as guidance, not as hard deadlines.

The eleven priority groups named for early treatment include iron and steel, aluminium, textiles, furniture, tyres, detergents, paints, lubricants, chemicals, energy-related products and electronics. Batteries sit on their own legal track under the Battery Regulation and act as the working proof of concept for everything that follows.

Timeline by product group under the ESPR working plan 2025–2030

Which product groups come first is set out in the Commission’s first ESPR working plan of 16 April 2025. The years in it are indicative and refer to the adoption of each delegated act. Under Article 4(4) ESPR, companies generally have to apply the requirements no earlier than 18 months after the act enters into force, so the passport obligation follows with a delay.

Electronics and ICT have no dedicated delegated act in the first working plan. They are covered by the two horizontal measures and by the continued rules for energy-related products. A mid-term review is scheduled for 2028, and order and years may still shift at that point.

What Data a Digital Product Passport Must Contain

The exact fields come from each delegated act, but the ESPR sets the categories, and they are consistent enough to plan around. A passport typically has to carry the following.

• Product identity: name, model, batch, manufacture date and a unique product identifier.
• Materials and substances: composition, sourcing and any substances of concern.
• Reparability and durability: spare-parts availability, disassembly and repair instructions.
• Recyclability and end of life: recycled content, recycling and take-back guidance.
• Environmental performance: carbon footprint and other lifecycle indicators.
• Supply-chain traceability: information on origin along the chain.

Which jurisdiction that data sits in is a separate question, covered in where product data is stored.

Access has to be free of charge and through a standardised data carrier on the product, usually a QR code, RFID or NFC tag, tied to a unique identifier from the ISO 15459 family. The technical detail, meaning the data model, interoperability and access rights, is being defined by the CEN and CENELEC committee JTC 24 as a set of harmonised European standards, with GS1 contributing an application standard. The pattern is worth remembering: the ESPR creates the legal duty, and the standards bodies define how it works in practice. (The exact standard numbers should be checked against CEN-CENELEC before you cite them.)

Where the Sustainability Data Comes From

For information on material, origin and environmental impact, preparation does not end inside your own company. That is exactly what makes this part of the product passport the most demanding. Four types of data can be distinguished, and what separates them most is who has to supply them.

The practical consequence is uncomfortable: the hardest part of the product passport sits in the supply chain. A manufacturer can get its production data in order, but it cannot invent an upstream supplier’s material declaration. Scope 3 emissions show this most clearly. They depend on suppliers across several tiers, and many of them cannot yet deliver comparable, verifiable figures in digital form.

An early example from fashion shows how big the effort can get. London brand Nobody’s Child started piloting product passports in 2023 and collected around 110 data points per item for it, reaching down to tier-5 suppliers (Vogue Business).

What can be prepared is the structure. Once the required information exists as individual attributes with a unit and a value list, completeness can be measured per product group and the gap can be quantified. Only then can a requirement be put to suppliers that amounts to more than polite encouragement.

A second point is regularly underestimated: sustainability information goes out of date. Recycled content changes when a supplier changes, a carbon figure changes with the plant’s energy mix, a certificate changes with its expiry date. The product passport is therefore a maintenance process with owners and a review cycle, not a project with an end date.

Who Must Comply, Including Non-EU Manufacturers

The duty falls on the economic operator that places the product on the EU market or puts it into service, and that holds regardless of where the product was made. A manufacturer has to prepare the technical documentation, run the conformity assessment, draw up the EU declaration of conformity, affix the CE marking and create the passport. Importers and distributors are treated as manufacturers when they sell under their own name or trademark, or when they modify a product. A manufacturer based outside the EU has to appoint an authorised representative established in the Union, and online marketplaces are obliged to cooperate with market-surveillance authorities. Scope follows the product group rather than company size, so small and medium enterprises are included, with some lighter reporting in places.

Penalties and Liability

This is the part most explainers skip, and it is the part a decision-maker actually worries about. Member States set the penalties, and the ESPR requires them to be effective, proportionate and dissuasive. In practice that means fines and, notably, the possibility of being excluded from public procurement for a period, which for many B2B manufacturers is a direct commercial threat. Non-compliant products can be withdrawn or recalled, and there is exposure to civil and collective or representative actions brought on behalf of consumers. Market-surveillance authorities report on enforcement on a regular cycle. The takeaway is straightforward: a missing or wrong passport is not a paperwork nuisance, it can block sales and carry real liability.

What the DPP Means in Practice: a Product-Data Challenge

Without reliable data quality there is no dependable passport.

Strip away the regulation and the DPP is a data problem. A manufacturer has to assemble, govern and publish dozens of attributes for thousands of products, pulling in supplier data and supply-chain information that often sits in disconnected systems and spreadsheets today. This is precisely the work a PIM system is built for. The PIM holds and enriches the product attributes and syndicates them to a data carrier or DPP endpoint. Master data management governs the cross-domain and supplier master data, including the Scope 3 information that is hardest to collect. A DAM stores the linked documents such as repair manuals and certificates. Treating all of this with disciplined Data Governance is what makes a passport auditable rather than a scramble.

A practical example makes it concrete. A power-tools manufacturer with a large, variant-rich catalogue cannot compile repairability, materials and carbon data by hand for every SKU across every market. Once those attributes live in a governed product-data platform, the passport becomes an output of the system rather than a project repeated for every product group.

Does the Digital Product Passport Need a Blockchain?

Short answer: no. The legal frame does not prescribe any particular technology. The question is still worth answering, because it comes up in almost every vendor conversation and is often answered imprecisely there.

What a blockchain does: it stores entries so that any later change becomes visible, because each entry references the previous one. That makes it possible to show that a value has been unchanged since a given point in time, and a chain of handovers between several parties stays traceable.

What it does not do: it does not check whether the value entered is correct. Enter a wrong carbon figure and it stays wrong, permanently. A blockchain therefore assumes data quality. If you do not hear that sentence from a vendor, ask.

It becomes worthwhile where several companies with no shared system landscape pass evidence along and no party should hold the others’ data. For a façade element built from components of several upstream suppliers, that is a realistic scenario. The real effort then lies in getting everyone involved to supply comparable values in the first place.

In practice: product passports with Sustain360° and SiOtu

How this fits together is shown by the approach from the partnership with Sustain360°. Viamedici EPIM supplies the consolidated product data. Sustain360° runs the life cycle assessment and Scope 3 calculation and produces the passport metadata from it. SiOtu tokenization then links every passport to a token based on Sustain360°’s blockchain technology, so every party in the supply chain can check whether a passport has changed since it was issued.

A global power-tools manufacturer, exactly the case from the example above, produced its first passports this way in under a month. Its SAP ERP and Viamedici EPIM were connected, and no custom software development was needed. Rollout to further product lines followed. The order was right: structured attributes first, then the token.

For your own preparation that means: structure the attributes, measure completeness and settle approvals first, and only then decide on the form of storage. The reverse order is the most common and most expensive mistake in such projects.

How to Prepare for the Digital Product Passport

You do not need every delegated act finalised to start. The groundwork is the same across sectors, and the following sequence keeps it focused. At its core the DPP demands high data quality: complete, current and auditable product attributes.

1. Confirm whether and when your products are in scope, starting with the priority groups and the battery track.
2. Audit the data you already hold against the likely DPP categories, and find the gaps, especially supplier and Scope 3 data.
3. Assign ownership for product and sustainability data so someone is accountable for accuracy.
4. Build the attribute model in a PIM and connect suppliers, so the required fields are captured at the source.
5. Pilot one product group, generate a passport end to end, and connect the data carrier before scaling.

Conclusion

The Digital Product Passport is coming product group by product group. Manufacturers who treat it as a data discipline rather than a last-minute compliance exercise carry far less cost and risk. Start by mapping your products to the timeline, find the data you are missing and put it under one governed roof. Then your systems produce the passport on demand.