What Is the Digital Product Passport (DPP)?

This guide explains the definition, the laws behind it, the roles involved and what is fixed versus still open.

The legal definition in one paragraph

The Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781 (ESPR), defines the digital product passport as a set of data specific to a product that includes the information specified in the applicable delegated act and that is accessible via electronic means through a data carrier (Article 2). Three things follow from that sentence:

The passport is data, not a document. It is not a PDF or a label. It is structured, machine-readable information.
The content is set per product group. The ESPR itself does not list the fields. A delegated act for each product group does.
Access goes through a data carrier. A data carrier is a barcode, a two-dimensional symbol such as a QR code, or another automatic identification medium that a device can read.

Which laws create a Digital Product Passport

The DPP is not one law. It is a common technical system used by several EU acts. The table shows the status on 11 November 2026.

Legal act	Product scope	Status of the passport obligation
ESPR, Regulation (EU) 2024/1781	Almost all physical goods, group by group	In force since 18 July 2024. No delegated act with DPP requirements adopted yet.
Batteries Regulation (EU) 2023/1542	LMT batteries, industrial batteries above 2 kWh, electric vehicle batteries	Adopted. Battery passport applies from 18 February 2027.
Detergents Regulation (EU) 2026/405	Detergents and end-user surfactants	Adopted. Applies from 23 September 2029.
Toy Safety Regulation (EU) 2025/2509	Toys	Adopted. Applies from 1 August 2030.
Construction Products Regulation (EU) 2024/3110	Construction products	Framework adopted. The passport system needs a further delegated act, which the Commission indicates for 2027.

The European Commission also names the Packaging and Packaging Waste Regulation and the Critical Raw Materials Act as legislation that can define passport requirements. For a date-by-date view, see our DPP timeline by product group.

What the ESPR covers and what it excludes

The ESPR is a framework. It applies to any physical good placed on the market or put into service, including components and intermediate products. A few categories are excluded in Article 1, among them food, feed, medicinal products, veterinary medicinal products, living plants and animals, and certain vehicles for the aspects that sector-specific law already regulates.

Being in scope of the framework does not mean a passport is due. An obligation only arises when the Commission adopts a delegated act for a product group. The first ESPR working plan, published in April 2025, prioritises iron and steel, aluminium, textiles (apparel), furniture, tyres and mattresses, plus a set of energy-related products.

How the passport works technically

The ESPR sets out the building blocks in Articles 9 to 15. In practice the system has five parts.

Unique product identifier. Each passport is tied to a persistent identifier at model, batch or item level, as the delegated act decides.
Data carrier. The identifier is encoded in a data carrier that is physically present on the product, its packaging or the accompanying documentation.
Decentralised data. The passport data is stored by the responsible economic operator or by a DPP service provider acting for it. The operator must also make a back-up copy available through a service provider, so that the data survives an insolvency.
EU registry. The Commission's DPP registry stores the unique identifiers and registration metadata, not the full product data. It went live on 20 July 2026, and its rules are in Implementing Regulation (EU) 2026/1778.
Access rights. Some data is public, some is restricted to authorities or to parties with a legitimate interest, such as repairers and recyclers.

Six harmonised European standards (EN 18216, EN 18219, EN 18220, EN 18221, EN 18222 and EN 18223) were cited in the Official Journal in July 2026. They cover data exchange protocols, unique identifiers, data carriers, data storage, APIs and interoperability. Two further standards, on access rights management and on data authentication, were still pending when this article was written. The standards describe how a passport works, not which data a product needs. More detail is in our article on what data goes into a DPP.

Who has to do what

The ESPR assigns duties by role, not by company size.

Role	Main passport-related duty
Manufacturer	Ensures a passport is available, with a back-up copy, before placing the product on the market. Keeps the data accurate, complete and up to date.
Importer	Only places products on the market for which a passport exists. Verifies it and adds its own details where required.
Distributor	Checks before making a product available that it carries the required data carrier or link.
Dealer, including online sellers	Makes sure customers can access the passport, also in distance selling.
Online marketplace	Cooperates with market surveillance authorities and removes non-compliant offers when ordered.

A company can hold several roles at once. A brand that has products made under its own name is the manufacturer in the legal sense. A retailer that imports directly from a non-EU supplier is the importer for those products. The roles are explained in depth in ESPR for SMEs.

What is fixed and what is still open

In force and applicable

The ESPR framework, including the passport rules in Articles 9 to 15.
The EU DPP registry and its implementing regulation.
Six harmonised standards for the DPP system.

Adopted but not yet applicable

The battery passport: 18 February 2027.
Passports for detergents (23 September 2029) and toys (1 August 2030).

Expected, dates indicative

The first ESPR delegated act, for iron and steel, which the Commission's timeline places in the fourth quarter of 2026.
Delegated acts for textiles, aluminium and tyres in 2027, furniture in 2028 and mattresses in 2029.
A delegated act on DPP service providers in 2027.
The two remaining harmonised standards.

For ESPR product groups there is a built-in buffer. Under Article 4, a delegated act may not apply earlier than 18 months after it enters into force, except in duly justified cases. An act adopted in late 2027 would therefore normally bite in 2029 at the earliest.

Common misunderstandings

"The DPP starts in 2026 for everyone." No. 19 July 2026 was the deadline for the Commission to set up the registry. It created no duty for products.

"A QR code linking to our website is a passport." No. The passport is a defined data set with access rules, a registered identifier and a back-up copy. A QR code is only the door.

"Small companies are exempt." Not from the passport. The ESPR has relief for micro and small enterprises in the rules on unsold consumer products, but passport duties follow the product and the role.

"All data will be public." No. Delegated acts decide which data is public and which is restricted.

What you can do now

You do not need to wait for every act to start. Three steps are safe under any outcome:

List your products and match them to the regimes above. Our DPP scope and timeline checker gives a first orientation.
Find out which role you hold for each product line.
Check whether your products already have unique, standardised identifiers such as GTINs.

A fuller plan is in how to prepare for the DPP.

Checklist: do you understand your starting position?

You know which EU act would create the passport for each of your product groups.
You know whether the obligation is in force, adopted or only expected.
You know your legal role per product line.
You know which identifiers your products carry today.
You have a named person who follows the Commission's DPP page.
You treat indicative timelines as planning assumptions, not as deadlines.

Sources

This article is general information, not legal advice. Status checked on 11 November 2026.

FAQ

What is a Digital Product Passport in simple terms?

It is a structured set of data about a product that is reached by scanning a data carrier, such as a QR code, on the product, its packaging or its documents. EU law defines which data it must contain for each product group.

Is the Digital Product Passport already mandatory?

Not yet for any product group as of 11 November 2026. The first fixed date is 18 February 2027 for certain batteries. For products under the ESPR, the obligation only starts once a delegated act for the product group has been adopted and its transition period has passed.

Who has to create the Digital Product Passport?

The economic operator that places the product on the EU market, usually the manufacturer or, for products from outside the EU, the importer. Distributors, dealers and online marketplaces have checking and display duties.

Does the DPP apply to products made outside the EU?

Yes. The rules apply to products placed on the EU market regardless of where they were made. For imports, the registration identifier of the passport is intended to be checked by customs.

Is there one central EU database with all product data?

No. The passport data stays with the responsible company or its service provider. The EU registry, live since 20 July 2026, only stores identifiers and registration metadata.