What Data Goes Into a Digital Product Passport?

This article explains the layers of passport data and what you can already structure today.

Three layers of data

It helps to think of passport data in three layers.

System data. Identifiers, the data carrier and the registry entry that make the passport findable and trustworthy. These are the same for every product group.
Framework data. Content that the ESPR allows or requires in general, listed in Annex III.
Product-specific data. The fields a delegated act or sector regulation defines for one product group, such as carbon footprint for batteries or fibre composition for apparel.

Layers one and two are known. Layer three is known only where an act has been adopted.

Layer one: identifiers and registration

The ESPR defines three kinds of identifier in Article 2:

Identifier	Identifies	Typical use
Unique product identifier	The product, at model, batch or item level, and enables a web link to its passport	Encoded in the data carrier
Unique operator identifier	An actor in the value chain, such as the manufacturer or importer	Shows who is responsible
Unique facility identifier	A location or building involved in the value chain	Shows where something was made or processed

The unique product identifier must be persistent and must be registered. Under Implementing Regulation (EU) 2026/1778, the registry stores the unique identifiers, the commodity code where relevant, a reference to the DPP service provider that holds the back-up copy where relevant, and information about the registration itself. After a successful check, it returns a unique registration identifier. The ESPR is explicit that this identifier is not proof that the product complies.

Product identifiers already used in trade can serve as a basis. Annex III of the ESPR names the Global Trade Identification Number, known as GTIN, as one of the possible elements. If you want to see how a GTIN becomes a web link, try our GS1 Digital Link builder.

Layer two: what ESPR Annex III lists

Annex III of the ESPR lists the content from which delegated acts draw. In summary:

the information requirements set for the product group, including information on substances of concern
the unique product identifier at the level set by the delegated act
the GTIN or an equivalent
relevant commodity codes, such as the TARIC code
compliance documentation, such as the declaration of conformity, technical documentation or conformity certificates
user manuals, instructions, warnings and safety information required by other EU law
information about the manufacturer, including its unique operator identifier and contact details
unique operator identifiers of other economic operators
unique facility identifiers
information about the importer, including its EORI number
the name, contact details and identifier of the EU-based operator responsible under market surveillance or product safety law
the reference of the service provider hosting the back-up copy

The first item is where product-specific content enters. Article 7 of the ESPR describes what information requirements can cover: product performance, information for customers on installation, use, maintenance and repair, information for treatment facilities on disassembly, recycling and disposal, and the tracking of substances of concern across the life cycle.

Layer three: product-specific data

Batteries: Annex XIII

The battery passport, applicable from 18 February 2027, is the most concrete example. Annex XIII of Regulation (EU) 2023/1542 groups the information by audience:

Public, model level: labelling information, material composition, carbon footprint, responsible sourcing, recycled content, share of renewable content, capacity, voltage, power, expected lifetime, warranty period, declaration of conformity and waste management information.
Legitimate interest and Commission: detailed composition, spare part numbers and sources, dismantling information and safety measures.
Authorities and notified bodies: results of test reports proving compliance.
Individual battery: performance and durability values, state of health, battery status and use data.

See our battery passport guide for scope and responsibility.

Detergents: Annex VI

For detergents and end-user surfactants, the passport applies from 23 September 2029. Annex VI of Regulation (EU) 2026/405 includes the trade name, unique product identifier and an image of the packaging or label, the manufacturer's details and unique operator identifier, a reference to the back-up service provider, traceability information, a statement of compliance, commodity codes where relevant, and the full list of intentionally added substances.

Toys

For toys, the passport applies from 1 August 2030 and takes over the role of the EU declaration of conformity. It corresponds to a specific toy model and states that compliance has been demonstrated. The data carrier must be on the toy or on a label attached to it.

ESPR product groups: not final

For iron and steel, textiles, aluminium, tyres, furniture and mattresses, no delegated act had been adopted when this article was written. The Commission's pages name the expected kinds of information, for example recycled content and technical data for steel, or fibre composition, care, repair and origin information for apparel, and state that the exact requirements will be set in the delegated acts. The Joint Research Centre has published a methodology for defining DPP data requirements, which shows how the Commission derives fields for a product group.

Model, batch or item level

Each legal act decides the level of the passport.

Level	One passport per	Fits when
Model	Product type or variant	Data is the same for every unit
Batch	Production lot	Data varies by lot, such as origin of material
Item	Individual unit	Data changes over the life of the unit, such as state of health

The battery passport combines levels: model information plus data for the individual battery. The detergent and toy passports correspond to a specific model. For ESPR groups the level is open. The registry rules say that a product covered by several rules is registered at the most granular level, and that item-level passports link to batch and model identifiers where those exist.

Who may see which data

Passports are not open databases. The ESPR requires each delegated act to define access rights, and Article 11 requires free and easy access for the actors named there according to those rights. The usual groups are:

the public, including consumers
economic operators in the value chain, such as repairers, remanufacturers and recyclers
market surveillance authorities, customs authorities and the Commission

Two rules protect data. Personal data about customers may only be stored in a passport with explicit consent. And DPP service providers may not sell or re-use passport data beyond what is needed for the service, unless agreed otherwise.

What the harmonised standards add

In July 2026 the Commission cited six harmonised standards for the DPP system in the Official Journal:

Standard	Subject
EN 18216	Data exchange protocols
EN 18219	Unique identifiers
EN 18220	Data carriers
EN 18221	Data storage, archiving and data persistence
EN 18222	APIs for passport lifecycle management and searchability
EN 18223	System interoperability

Two more, EN 18239 on access rights management, information system security and business confidentiality, and EN 18246 on data authentication, reliability and integrity, were not yet cited when this article was written. Applying a cited harmonised standard correctly gives a presumption of conformity with the corresponding ESPR requirements. CEN and CENELEC stress that these standards are product-agnostic: they do not decide which data a product's passport must store.

How to structure your data now

Even without a final field list you can prepare a data inventory:

For each product, record the identifiers you have: GTIN, model number, batch logic.
For each kind of information in Annex III, note whether you hold it, in which system, and in which format.
Mark data that comes from suppliers and whether you receive it in structured form.
Mark data that you would not want to be public, so you can check the access rules when the act is published.

Our DPP data checklist builder turns this into a printable list per product group. For the next steps, see how to prepare for the DPP.

Checklist: data readiness

Every product has a persistent, unique identifier.
You know your own operator details and those of your importers or suppliers.
Compliance documents are available digitally and linked to the right product.
Composition and substance data are stored in structured fields.
Use, repair and end-of-life information exists per product.
You know which data originates from suppliers.
You have noted which level, model, batch or item, your systems can support.

Sources

This article is general information, not legal advice. Status checked on 11 November 2026.

FAQ

Is there one fixed list of DPP data fields?

No. The ESPR sets a menu of possible content in Annex III, and each delegated act selects and details the fields for its product group. Other regulations, such as those for batteries, detergents and toys, define their own lists.

What is the difference between model, batch and item level?

A model-level passport describes a product type, a batch-level passport a production lot, and an item-level passport a single unit. The delegated act for each product group decides which level applies.

Is all passport data public?

No. Each legal act defines which data is public and which is restricted to authorities or to parties with a legitimate interest, such as repairers and recyclers.

Do the EN 18216 to EN 18223 standards define the data fields?

No. They define how passports are identified, carried, stored, exchanged and accessed. Which data a product must carry is decided by product legislation.

How long must passport data stay available?

Under the ESPR, the delegated act sets the period, which must cover at least the expected lifetime of the product. The regulations for toys and detergents require ten years after placing on the market.