Under Article 11(c) of the ESPR, the economic operator that creates a Digital Product Passport stores it, on its own systems or through a DPP service provider. Article 10(4) adds a back-up copy, which must sit with such a provider. The EU registry holds identifiers, not the passport. The battery passport has no back-up rule.
Where is passport data stored?
With the business, not in an EU database. Article 11(c) of the Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, has the passport stored by the operator that creates it or by service providers.
The EU registry is an index. Under Implementing Regulation (EU) 2026/1778, each entry holds the identifiers, the commodity code and, where relevant, a reference to the provider. “The DPP Registry does not store the full DPP data,” says the Commission’s user guide.
What is a DPP service provider?
Article 2(32) defines it as an independent third party, authorised by the operator placing the product on the market. It processes the passport data so that those with a right of access can reach it. Article 11 bars it from selling or reusing that data beyond what its service needs, unless the operator agrees.
Is a service provider mandatory?
For the back-up copy, yes. Article 10(4) requires the operator, when placing the product on the market, to make a back-up copy available through a provider, and Article 29(2)(c) has the importer check it. Recital 38 explains why: the passport must survive an insolvency, a liquidation or the end of activity in the EU. The main passport can stay in-house.
| Law | Main passport stored by | Back-up through a provider |
|---|---|---|
| ESPR products | The operator or a provider, Article 11(c) | Required, Article 10(4) |
| Toys, Regulation (EU) 2025/2509 | The operator or a provider, Article 20(5) | Required from 1 August 2030, Article 19(13) |
| Detergents, Regulation (EU) 2026/405 | The operator or a provider, Article 22(e) | Required from 23 September 2029, Article 21(12)(c) |
| Batteries, Regulation (EU) 2023/1542 | The operator or an operator it authorises, Article 78 | None; data must outlive the operator |
Under Article 19(4) of the registry regulation, the operator stays fully responsible even where a third party registers for it.
Are DPP service providers certified yet?
No. Article 11 lets the Commission set provider requirements and, where appropriate, a certification scheme by delegated act. Its consultation page plans adoption in the fourth quarter of 2026, while its DPP page lists 2027, so there is no firm date. The registry will list verified providers under Article 3(f) of Regulation 2026/1778, but no list has been published. Whether a group company counts as “independent” is not yet settled.
Sources: ESPR, Regulation (EU) 2024/1781, Implementing Regulation (EU) 2026/1778, Regulation (EU) 2023/1542, Regulation (EU) 2025/2509, Regulation (EU) 2026/405, Commission initiative 14382, service providers, DPP Registry user guide, v1.03
GreenSutra’s DPP consulting prepares the product data and plans the identifiers. Storing and hosting the passport stay with the operator and the provider it chooses. The DPP guide tracks the provider act.