Product data guide

1 Find the rules that apply

The Ecodesign for Sustainable Products Regulation (ESPR) sets the framework. It does not impose one immediate DPP obligation on every product. Product-specific delegated acts determine the required information, passport granularity, data carrier, access rights and application dates. Other legislation can establish its own passport requirements.

The ESPR covers a broad range of physical goods, including components and intermediate products, with exclusions such as food, feed and medicinal products. A product being within the framework’s scope does not by itself establish a passport deadline. The working plan sets priorities and intended adoption years; an adoption target is not an application date.

• Record the product group, intended EU market, applicable legal act and your role: manufacturer, importer, distributor or another economic operator.
• Read the adopted act and its annexes for exemptions, required fields, transitional provisions and when the product may be placed on the market or put into service.
• Keep a requirements register linking each obligation to its article, responsible person, evidence and implementation status.

2 Define identity and the scan journey

An ESPR passport connects a persistent unique product identifier to a physical data carrier. The applicable act decides whether the record describes a model, batch or individual item and where the carrier must appear, such as on the product, packaging or accompanying documentation. A QR code is one possible carrier; it is not the whole passport.

• Maintain a mapping between your SKU, model, batch or serial number and the required unique identifier. Include operator and facility identifiers where required.
• Use a persistent resolution address and plan how it will survive a website redesign or provider change. Do not recycle an identifier for a different product.
• Test a printed carrier on the real surface and at its intended size. Check phone scanning, damaged labels, the correct record and an accessible mobile view. Plan online-sale access before purchase where required.

3 Build a useful data inventory

The categories below are preparation suggestions, not a universal mandatory schema. Use the applicable act to decide which values, calculation methods and documents must be included. Start with data you can substantiate and create a gap list for the rest.

4 Make every value traceable

A number without its source and scope is difficult to defend or update. As a preparation practice, keep an evidence record beside each field. Distinguish measured results, supplier declarations, calculations and estimates; an internal approval does not make a value independently verified.

• Record the field, value, unit, product scope, evidence document and version, supplier or issuer, calculation or test method, date, owner and approval status.
• Mark missing, disputed and not-applicable values explicitly. Record why and assign an owner; do not use zero to mean unknown.
• Check units, totals and boundaries. For example, 82% recycled aluminium in a housing is not 82% recycled content for the entire lamp. Retain the mass basis and supporting declaration.
• Request supplier evidence for the specific component and revision you buy, with a process for notifying material or production changes.

5 Set access rights and protect personal data

An ESPR DPP is not necessarily a fully public record. The applicable act specifies which actors may read particular data and who may create or update it. Consumers, repairers, recyclers, economic operators and authorities can have different rights. Access to the relevant data must be free according to those rights.

ESPR states that customer personal data must not be stored in the passport without explicit consent under the GDPR. Keep customer contact details and unrelated service or ownership information out of the public record. A product serial number can still become personal data when linked to an identifiable person.

• Prepare a field-level access matrix: audience, read permission, update permission, legal basis and responsible approver. Confidentiality labels do not override legally required access.
• Enforce restricted access on the server or data service. Hiding a field in the page does not protect it if it remains in a public JSON, PDF or API response.
• Test each role, including unauthenticated users. Review exports, attachments and service-provider access as well as the visible page.

6 Plan interoperable exchange

ESPR requires open standards and interoperable formats, with structured, searchable and machine-readable data as appropriate, avoiding vendor lock-in. A readable webpage or a downloadable JSON alone does not demonstrate conformity with those requirements.

The Commission’s harmonised-standards references are published in Decision (EU) 2026/1736. They cover exchange protocols (EN 18216), unique identifiers (EN 18219), carriers (EN 18220), storage and persistence (EN 18221), lifecycle APIs and searchability (EN 18222), and system interoperability (EN 18223), all 2026 editions. Assess the relevant standards and the requirements they cover before choosing an implementation.

• Define a data dictionary with field meaning, unit, allowed values, identifier scheme, schema version and links to source documents.
• Test export and import with a second system, including identifiers, units, access rights and document references. Agree migration and retrieval arrangements with your provider.

7 Keep the passport usable over time

ESPR requires accurate, complete and up-to-date data, with availability for the period specified in the applicable act, including after insolvency, liquidation or cessation of activity. A backup copy through a DPP service provider is part of the framework. Keeping a local file alone does not address these continuity obligations.

• Assign an owner for initial publication and for changes. Define triggers such as a material revision, corrected test result, repair event or change of responsible operator.
• Keep version history, change reasons, timestamps and approval records. Preserve links between a physical product and the information that applies to it.
• Agree hosting, retention, security, backup, restoration, provider exit and business-closure arrangements. Test recovery and the continued resolution of printed identifiers.

8 Separate the EU registry from passport storage

The EU registry records identifiers and registration information; it does not replace the operator’s obligation to maintain the passport. Implementing Regulation (EU) 2026/1778 sets registry arrangements, including identity verification, registration, versioning and operator accountability. Use the applicable product rules to establish the registration granularity and required information.

Registration proof is not proof of product conformity. Prepare the responsible operator’s identity, registration workflow and update process alongside product compliance evidence. Do not describe a QR landing page, registry entry or technical integration as a product certification.

9 Recognise sector-specific requirements

Batteries have a specific legal timetable. From 18 February 2027, each electric-vehicle battery, each light means of transport (LMT) battery and each industrial battery with a capacity greater than 2 kWh placed on the market or put into service must have a battery passport under Article 77 of the Batteries Regulation.

Annex XIII distinguishes model information from individual-battery information, with different access groups. It includes categories such as composition, carbon footprint, performance, durability and lifecycle status, subject to the applicable provisions. Some obligations and data points have their own application dates. The Commission’s battery guidance explains these dependencies; do not treat every listed field as mandatory at passport launch.

This battery deadline is not a deadline for every ESPR product. Construction products and other sectors can have separate legal frameworks. Identify the sectoral legislation before reusing a schema or timetable.

The Commission’s battery FAQ identifies restricted-data access rules as still under development. Check the final adopted implementing act before fixing who may access those fields and how they may reuse them.

10 Review readiness before publication

Use this practical checklist to organise a review. It supports preparation; it is not a conformity assessment or a replacement for the applicable legal act.

• Scope: the product, market, operator role, legal act and application date are documented.
• Completeness: required fields and supporting documents are mapped; gaps have an owner and a resolution date.
• Evidence: values have units, boundaries, sources, methods and approvals; claims match the evidence.
• Identity and access: the carrier opens the correct record; role permissions work across the page, downloads and interfaces.
• Continuity: updates, versioning, backup, recovery, retention and provider migration are tested.
• Regulatory process: required registration and product conformity procedures are completed separately, with evidence retained.

11 Turn gaps into an action plan

Start with one representative product and its suppliers. Assign product identity and bills of materials to engineering, declarations to procurement, methods and claims to sustainability or compliance, repair instructions to service, and access and continuity to IT. Name one accountable passport owner across these teams.

Track each gap as: required field or obligation, missing evidence, responsible person, next action and due date. Separate legal application dates from your internal pilot milestones. Review changes to adopted acts and official guidance before release and when the product changes.

Use our fictional Arc lamp to explore presentation, care, repair and downloadable data. All of its values are synthetic. Its JSON schema 2.0 is illustrative, not a harmonised DPP schema or a certified implementation. Its public files do not demonstrate restricted access, registry integration or long-term continuity.

Official sources to keep at hand

Use the legal text for obligations and the Commission’s guidance for interpretation and implementation context. Check the latest consolidated text, amendments and product-specific acts when assessing your product.

• ESPR: Regulation (EU) 2024/1781
• European Commission: implementation, working plan and FAQs
• Commission: general DPP questions and answers
• Commission: harmonised DPP standards, Decision (EU) 2026/1736
• DPP registry: Implementing Regulation (EU) 2026/1778
• Batteries: Regulation (EU) 2023/1542, Articles 77–78 and Annex XIII
• Commission: guidance for the digital batteries passport
• Commission: battery passport applicability and access FAQ