Mostly through access rights. A Digital Product Passport (DPP) does not show everything to everyone. Each product group’s rules decide who may see which data, so sensitive details can be kept for authorities or professionals. Service providers hosting the data may not use it for their own purposes. The limit is substances of concern, where confidentiality only goes so far. As of October 2026, no product group under the EU’s Ecodesign Regulation has a passport duty yet.
How is sensitive data kept out of public view?
The Ecodesign Regulation asks for different access to different data, by type of data and type of reader, partly to protect intellectual property. Each product group’s rules will then name who may see which data, and who may add or change it. The regulation itself also requires passport data to be authentic, reliable and intact, with a high level of security and privacy and protection against fraud.
How that split works in practice is covered in who can access passport data.
Can the service provider hosting the data use it?
No, beyond what its service needs. A DPP service provider may not sell, reuse or process passport data for anything else unless the business that hired it has specifically agreed.
Can information on harmful substances stay confidential?
Only up to a point. Where relevant, each product group’s rules must allow justified exemptions from the information on substances of concern, and protecting confidential business information is one reason. But substances of very high concern under the EU’s REACH chemicals law cannot be kept out above 0.1% by weight of the product, its relevant parts or spare parts.
What do other passport laws do?
The battery passport has public and restricted parts, and its access rules, not yet adopted, must keep the handling of commercially sensitive information to the minimum necessary. For construction products, the passport rules must weigh intellectual property and sensitive commercial information when setting access.
Is there a standard for it?
Yes, though not yet with legal weight. EN 18239, one of the DPP standards, covers access rights, security and business confidentiality. It was published on 16 September 2026 but has not been cited by the EU, so following it does not yet give a presumption of compliance.
Where this comes from: Ecodesign Regulation (EU) 2024/1781, recital 33 and Articles 2(27), 7(6), 9(2), 10 and 11; Battery Regulation (EU) 2023/1542, Article 77; Construction Products Regulation (EU) 2024/3110, Article 75; Implementing Regulation (EU) 2026/1778.