Under the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, each product group’s delegated act decides who can read which passport data. In practice that gives three tiers: a public subset, a restricted tier for repairers, remanufacturers and recyclers, and a tier for market surveillance, customs and the Commission. Commercially sensitive data stays out of the public tier.
Access follows defined rights, not one open file
The Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, builds differentiated access into every Digital Product Passport depending on the type of data and the type of stakeholder. The regulation lists the actors that must be able to read or update data according to their access rights: economic operators such as manufacturers, importers and distributors, alongside value-chain actors including customers, professional repairers, refurbishers, remanufacturers, recyclers, market surveillance and customs authorities, and the Commission. A GreenSutra DPP readiness engagement maps which fields sit in which tier before a delegated act fixes the split.
The three DPP data access tiers
In practice the framework reads as three tiers, with the exact fields for each product group set later by the relevant delegated act.
| Tier | Who reads it | Typical data |
|---|---|---|
| Public | Anyone, including a consumer scanning the carrier | Open public subset of passport data |
| Restricted | Repairers, remanufacturers, second-life operators, recyclers | Durability, repair and end-of-life information |
| Authorities | Market surveillance, customs and the Commission | Registration identifier and commodity code verified against the central EU registry |
Economic operators retain write access to the fields they are responsible for, again according to their access rights.
Commercially sensitive data stays protected
Differentiated access keeps intellectual property and confidential business data away from the general public. Each product group’s delegated act fixes the exact split between public and restricted data. Two EU systems sit beside the tiers. The DPP registry has been live since 20 July 2026 and stores identifiers and commodity codes, not the passport data itself. Its user guide of 16 September 2026 says no passport can be registered yet. ESPR Article 14 also requires a public web portal, which the Commission’s DPP FAQ says is planned for the coming years. The EU battery passport, due from 18 February 2027, sets its tiers in Article 77(2) of Regulation (EU) 2023/1542. Its restricted tier is for persons with a legitimate interest. In GreenSutra engagements, exporters most often assume a passport is a single public file and are surprised by how much sits behind restricted, role-based tiers. A fuller walk-through of which field belongs in which tier sits in the DPP guide.
Sources: Regulation (EU) 2024/1781 (ESPR) · Regulation (EU) 2023/1542 (EU Battery Regulation)