PROVIDER GUIDE
Choosing a DPP Service Provider: The Back-Up Copy, Data-Use Limits, Switching Rights and the Coming EU Rules
A Digital Product Passport cannot be kept entirely in-house. ESPR, Regulation (EU) 2024/1781, requires a back-up copy of each passport to be made available through a DPP service provider, and it defines that provider as an independent third party. Once a delegated act that requires a passport for apparel applies, every brand that places apparel on the EU market will therefore need an arrangement with at least one DPP service provider, whether it hosts the live passport itself or outsources everything. A brand that signs a pilot or platform contract today does so before the EU has adopted the delegated act setting requirements for DPP service providers (ESPR Article 11, third subparagraph).
This guide sets out what the law already fixes for that relationship: the independence requirement and the back-up copy, the ban on providers using passport data beyond the service, what the EU registry records about providers, and the cloud-switching rules of the Data Act that likely apply to platform contracts. It then dates the rules still to come, chiefly the delegated act on DPP service providers, and ends with a list of contract points. For who may see which passport data, see our access-rights guide; for the cost of self-hosting versus using a provider, see our cost guide.
Independent third party
A DPP service provider is an independent third party authorised by the economic operator, and the back-up copy of the passport must be made available through one (ESPR Articles 2(32) and 10(4)).
No reuse
Providers may not sell, reuse or process passport data beyond what the service needs unless specifically agreed with the economic operator (ESPR Article 11, second subparagraph).
12 Jan 2027
From this date, providers of data processing services may not impose switching charges (Data Act Article 29(1)). Whether a DPP platform contract is covered depends on the service.
1. Why every brand needs a DPP service provider, even when it hosts the passport itself
Article 10(4), Regulation (EU) 2024/1781 (ESPR)
"The economic operator, when placing the product on the market, shall make available a back-up copy of the digital product passport through a digital product passport service provider."
ESPR allows two hosting models. The passport "shall be stored by the economic operator responsible for its creation or by digital product passport service providers" (Article 11, first subparagraph, point (c)). The back-up copy is a separate duty that applies in both models. Who can hold it follows from the definition in Article 2(32): a DPP service provider is "a natural or legal person that is an independent third-party authorised by the economic operator which places the product on the market or puts it into service and that processes the digital product passport data for that product for the purpose of making such data available to economic operators and other relevant actors with a right to access those data under this Regulation or other Union law". Recital 38 gives the reason: to keep the passport accessible for the required period, including after an insolvency, a liquidation or a cessation of activity in the Union, the back-up is to be made available "through a digital product passport service provider that is an independent third party". A brand therefore cannot act as the DPP service provider for its own back-up.
The duty is tied to placing the product on the market. Manufacturers, when placing a product on the market, and importers, before doing so, must ensure that a passport is available, "including a back-up copy of the most up-to-date version of the digital product passport stored by a digital product passport service provider in accordance with Article 10(4)" (Article 27(1), point (c), and Article 29(2), point (c)). Because the back-up must be of the most up-to-date version each time a product is placed on the market, in practice it has to be kept in step with updates, not only the first version. The passport itself must remain available for the period set in the product's delegated act, "including after an insolvency, a liquidation or a cessation of activity in the Union of the economic operator responsible for the creation of the digital product passport" (Article 11, point (e)), and that period "shall correspond to at least the expected lifetime of a specific product" (Article 9(2), point (i)).
Two points are still open. ESPR does not define what makes a provider "independent" beyond the words of Article 2(32), and it does not say whether the back-up must sit with a different provider from the one that hosts the live passport. The Commission's call for evidence on the provider rules (November 2024) describes providers storing and processing passport data for operators that do not do this themselves, and storing the mandatory back-up for operators that host the passport themselves. The delegated act on DPP service providers (section 5) may settle both points.
None of this applies to clothing yet. A passport, and with it the back-up, is required for products covered by a delegated act adopted under Article 4 (Article 9(1)), unless the Commission, when setting the passport requirements, exempts the product group on one of two grounds: technical specifications of the digital product passport are not available in relation to the essential requirements in Articles 10 and 11, or other Union law already includes a system for the digital provision of information on that product group which the Commission considers achieves the passport's objectives of ensuring that actors along the value chain can easily access and understand product information relevant to them and of facilitating the verification of product compliance by competent national authorities (Article 9(4)). The delegated act for textiles has not been adopted; the Commission's DPP page lists its adoption for Q3–Q4 2027. A delegated act applies no earlier than 18 months after its entry into force, except in duly justified cases (Article 4(4)). The cost side of self-hosting versus outsourcing is covered in our cost guide.
2. What a provider may do with your passport data
Article 11, second subparagraph, ESPR
"If the digital product passport is stored pursuant to point (c) of the first subparagraph or otherwise processed by digital product passport service providers, those digital product passport service providers shall not sell, reuse or process such data, in whole or in part, beyond what is necessary for the provision of the relevant storing or processing services, unless specifically agreed with the economic operator placing the product on the market or putting it into service."
The default is a prohibition, and the exception is in the brand's hands. A provider that holds the live passport or the back-up may use the data only as far as the storing or processing service requires. Anything beyond that, for example selling the data or reusing it for the provider's own analytics or other products, needs the brand's agreement, and the Regulation asks for an agreement made "specifically". On our reading, a clause that names the purpose and the data concerned meets that standard more clearly than general consent buried in standard terms. The agreement has to come from the economic operator placing the product on the market or putting it into service; where the brand and the importer are different companies, the contract should make clear which of them gives it.
The other essential requirements of Article 11 apply whoever hosts the passport: rights to introduce, modify or update data are restricted according to the access rights in the delegated act (point (f)), "data authentication, reliability and integrity shall be ensured" (point (g)), and passports must be designed and operated so that "a high level of security and privacy is ensured and fraud is avoided" (point (h)). Article 10(1), point (d), adds that passport data must be, as appropriate, "transferable through an open interoperable data exchange network without vendor lock-in" (wording as corrected by the corrigendum of 28 April 2025). ESPR therefore already points away from formats that only one provider can read; the Data Act, in section 4, adds rules on the switching process itself. Who may see which data is a separate question, covered in our access-rights guide.
3. What the EU registry records about your provider
Commission Implementing Regulation (EU) 2026/1778, in force since 6 August 2026, gives providers a defined place in the registry. The registry includes "a list of verified digital product passport service providers registered in the registry" (Article 3, point (f)). Recital 4 names DPP service providers among the value chain actors that "should be identified through a verification process", and Article 5 sets out how value chain actors obtain verified status, by proving their identity and, where applicable, their establishment.
When a passport is submitted for registration, the Commission reads its content and automatically confirms, among other things, "where relevant, the link to the back-up hosted by a digital product passport service provider" (Article 8(7), point (e)). It also stores, as part of the registration data, "where relevant, reference to the digital product passport service provider" (Article 8(9), point (c)). Both are qualified by "where relevant", so whether a back-up link is checked for apparel will depend on the rules that apply to that product group.
If a provider registers passports for you, it must be verified itself: where a verified economic operator authorises a third party to perform registration actions on its behalf, that third party has to follow the verification process of Article 5, and the economic operator "shall remain fully responsible for compliance with the obligations set out in this Regulation" (Article 19(4)). Outsourcing the registration does not outsource the responsibility.
On the passport side, Annex III to ESPR lists, as point (l), "the reference of the digital product passport service provider hosting the back-up copy of the digital product passport". Annex III is a list from which each delegated act specifies "what data are to or can be included in the digital product passport from among the following elements", so point (l) becomes a required field for apparel only if the textile delegated act says so. The registration process is explained step by step in our registry guide.
4. Switching providers: what the Data Act already provides
Our reading — an interpretation, not settled law
The Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025 (Article 50). Its switching rules (Chapter VI, Articles 23 to 31) cover data processing services, defined in Article 2, point (8), as "a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction". Recital 81 names the delivery models "Infrastructure as a Service (IaaS), Platform as a service (PaaS) and Software as a Service (SaaS)". A DPP platform offered online as a standard service therefore likely falls under these rules. Whether a particular contract does depends on how the service is built and offered, so check the contract and ask the provider whether it treats its service as covered by Chapter VI.
Where the rules apply, the rights of the customer and the obligations of the provider on switching must be "clearly set out in a written contract", which the provider must make available before signing (Article 25(1)). Article 25(2) lists what that contract must contain at least. The elements most relevant to a passport platform are:
| Element (Data Act) | What the contract must provide |
|---|---|
| Notice period (Article 25(2), point (d)) | "a maximum notice period for initiation of the switching process, which shall not exceed two months" |
| Transitional period (Article 25(2), point (a), and Article 25(4)) | Switching, or moving all exportable data to your own infrastructure, without undue delay and "not after the mandatory maximum transitional period of 30 calendar days, to be initiated after the maximum notice period referred to in point (d)", during which the contract remains applicable and the provider must assist and "act with due care to maintain business continuity". If 30 days are technically unfeasible, the provider must justify this within 14 working days and propose an alternative period, "which shall not exceed seven months". |
| Data in scope (Article 25(2), point (e)) | "an exhaustive specification of all categories of data and digital assets that can be ported during the switching process, including, at a minimum, all exportable data" |
| Data retrieval (Article 25(2), point (g)) | "a minimum period for data retrieval of at least 30 calendar days", starting after the end of the transitional period. |
| Erasure (Article 25(2), point (h)) | Full erasure of the exportable data and digital assets after the retrieval period or a later agreed date, provided that the switching has been completed successfully. |
| Exit support (Article 25(2), point (b)) | An obligation of the provider to support the customer's exit strategy, including by providing all relevant information. |
On cost, Article 29(1) sets a fixed date: "From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process." Until then, reduced charges are allowed that do not exceed the costs directly linked to the switching (Article 29(2) and (3)). Switching charges are not the only price of leaving, though. Their definition excludes "standard service fees or early termination penalties" (Article 2, point (36)), and recital 89 confirms that parties may agree "contracts for data processing services of a fixed duration, including proportionate early termination penalties to cover the early termination of such contracts, in accordance with Union or national law". Before the contract is concluded, the provider must give clear information on the standard service fees and early termination penalties that might be imposed (Article 29(4)). From 2027, switching itself will be free of switching charges, but leaving a fixed-term contract early may still cost money.
Two exemptions matter for DPP projects. Services "provided as a non-production version for testing and evaluation purposes and for a limited period of time" are outside Chapter VI altogether (Article 31(2)), which may cover a time-limited pilot. For services of which the majority of main features has been custom-built for an individual customer, or all of whose components were developed for that customer, and that are not offered at broad commercial scale via the provider's service catalogue, the rules on functional equivalence (Article 23, point (d)), on switching charges (Article 29) and parts of Article 30 do not apply (Article 31(1)), and the provider must say before the contract is concluded which obligations do not apply (Article 31(3)). A pilot contract may therefore give you fewer rights than the production contract that follows it.
Outlook — Digital Omnibus (a proposal, not law)
The Commission's proposal COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)) would amend the Data Act. Its draft Article 31(1b) would allow a provider of data processing services other than pure infrastructure services (those referred to in Article 30(1)) to include proportionate early termination penalties in a fixed-duration contract. That sentence carries no limit by contract date, so if adopted it would also reach new DPP platform contracts. The lighter regimes in draft Article 31(1a) (services adapted to the needs of a customer) and in the rest of draft Article 31(1b) (providers that are SMEs or small mid-caps) concern only contracts concluded on or before 12 September 2025; both keep Article 29 on switching charges, and clauses in such contracts contrary to Article 29(1), (2) or (3) would be null and void. On 16 October 2026 the European Parliament's Legislative Observatory showed the procedure awaiting a committee decision, with a draft report of 22 June 2026 and amendments tabled on 27 July 2026. Nothing has been adopted.
5. The coming EU rules for providers, and when to expect them
ESPR already empowers the Commission to regulate providers. Article 11, third subparagraph, allows delegated acts "setting out the requirements that digital product passport service providers are to comply with in order to become such providers, and, where appropriate, a certification scheme to verify compliance with such requirements, and by setting out the requirements that those service providers are to comply with when providing digital product passport services". Recital 40 adds that the Commission could carry out an impact assessment to "investigate the appropriateness of developing a certification scheme for digital product passport service providers". A certification scheme is therefore possible, not decided.
The Commission is preparing this act as initiative 14382 on its Have your say portal, as a delegated act (planned as a delegated decision, according to the portal's record). Its call for evidence of 12 November 2024 provisionally grouped the possible requirements into three areas: information security and services for the passport data that operators entrust to providers, the financial viability of providers to guarantee long-term access to passport information, and assurance that providers comply with the requirements. It named self-declaration, enforcement efforts and an ex ante certification scheme as possible ways to ensure compliance, and noted that certification costs might be passed on to operators. The call for evidence (12 November to 10 December 2024) received 178 feedback contributions and the public consultation (8 April to 1 July 2025) 275 responses. No draft act has been published for feedback.
| Item | Status on 16 October 2026 | Why it matters for a provider contract |
|---|---|---|
| Delegated act on DPP service providers (ESPR Article 11, third subparagraph) | Not adopted; no draft published. The Have your say record (initiative 14382, last modified 26 June 2026) shows adoption planned for Q4 2026. The Commission's DPP page (updated 15 October 2026) lists the act under Q2 2027 and Q3 2027 in a timeline it describes as indicative. The call for evidence of November 2024 had indicated Q1–Q2 2026. | May set requirements for becoming and operating as a provider and, where appropriate, a certification scheme. Once adopted, it enters into force only if neither the European Parliament nor the Council objects within two months, a period that can be extended by two months, or if both state earlier that they will not object (Article 72(6)). |
| ESPR delegated act for textiles | Not adopted. The Commission's DPP page lists adoption for Q3–Q4 2027. | Unless it exempts apparel from the passport requirement (Article 9(4)), triggers the passport and back-up duties for apparel, no earlier than 18 months after its entry into force except in duly justified cases (Article 4(4)). Decides whether the provider reference (Annex III, point (l)) is part of the apparel passport. |
| Data Act: end of switching charges | Fixed in law: no switching charges from 12 January 2027 (Article 29(1)). The Data Act has applied since 12 September 2025. | Relevant to platform contracts covered by Chapter VI, except the custom-built services exempted by Article 31(1) (section 4). |
| Digital Omnibus, proposal COM(2025) 837 | Proposal only. European Parliament: awaiting committee decision (draft report 22 June 2026; amendments 27 July 2026). | Would expressly allow proportionate early termination penalties in fixed-duration contracts (draft Article 31(1b)). |
| DPP standards EN 18239 and EN 18246 | Not cited in the Official Journal. The Commission's DPP page lists an implementing decision on the remaining two DPP standards for November 2026 (on 13 October 2026 it showed September 2026). | They cover access rights, information security, business confidentiality and data integrity, the areas a provider has to deliver in practice. |
The two Commission sources disagree on timing, and we found no official explanation. The DPP page was updated more recently and is the latest indication, which points to 2027; the Have your say record has not been changed since June 2026. Either way, the record shows the draft act as upcoming for feedback, so it could open at any time.
Technical standards will shape the provider market as well. Implementing Decision (EU) 2026/1736 cites six of the eight European DPP standards in the Official Journal, among them EN 18221 on "Data storage, archiving, and persistence". Passports that conform to cited harmonised standards are presumed to conform to the requirements of Articles 10 and 11 of ESPR to the extent the standards cover them (Article 41(2)), so it is a fair question to ask a provider which cited standards it implements.
6. What to put in the contract now
Neither ESPR nor the Data Act prescribes the clauses below in this form. They are our recommendations for a provider contract signed before the textile delegated act and the delegated act on DPP service providers exist, each tied to the provision it helps you meet.
| Contract point | What to ask for | Legal hook |
|---|---|---|
| Role and independence | Confirmation that the provider acts as a DPP service provider authorised by you, and that the company holding your back-up is a third party independent of yours. | ESPR Articles 2(32) and 10(4); recital 38. |
| Back-up copy | A back-up of the most up-to-date version of every passport, the update interval, how the back-up link is supplied for registration, and a tested restore procedure. | ESPR Article 27(1), point (c), and Article 29(2), point (c); Implementing Regulation (EU) 2026/1778, Article 8(7), point (e). |
| Data use | A clause that repeats the default: no sale, reuse or processing of passport data beyond the service. Any exception named specifically, with its purpose and the data concerned. No blanket consent in general terms. | ESPR Article 11, second subparagraph. |
| Availability and continuity | Availability for the full period the delegated act will set, which is at least the product's expected lifetime; what happens if the provider becomes insolvent or leaves the market (for example a transfer to a successor provider); what happens if your company ceases activity. | ESPR Article 9(2), point (i), and Article 11, point (e). |
| Exit and portability | Open, documented export formats; notice of no more than two months; a transition of no more than 30 calendar days; at least 30 calendar days to retrieve data; erasure afterwards; switching charges only as Article 29 allows until 12 January 2027 and none after that date; early termination penalties stated before signing. | ESPR Article 10(1), point (d); Data Act Articles 25 and 29, where Chapter VI applies. |
| Registry actions | If the provider registers passports for you: confirmation that it is verified, who holds the registry credentials, and how errors are corrected. You remain responsible. | Implementing Regulation (EU) 2026/1778, Article 19(3) and (4). |
| Security and standards | How the provider ensures integrity, security and fraud prevention, which cited harmonised DPP standards it implements, and how it reports security incidents to you. | ESPR Article 11, points (g) and (h), and Article 41(2); Implementing Decision (EU) 2026/1736. |
| Change in law | An obligation to comply with the delegated act on DPP service providers and any certification scheme once adopted, and a right for you to terminate without penalty if the provider cannot. | ESPR Article 11, third subparagraph. |
| Pilot terms | If the pilot is a time-limited test version, the Data Act switching rules may not apply, so agree export and erasure terms in the pilot contract itself. | Data Act Article 31(2). |
DPP AUDIT
Know what your DPP set-up has to cover before you sign.
We assess your product data, systems and supplier inputs against the ESPR passport requirements, so you know what any DPP set-up must deliver, whichever provider you choose. Under NDA.
Start Your DPP AuditFrequently asked questions
Do we need a DPP service provider if we host the passport ourselves?
Can our DPP service provider use our product data for its own purposes?
Can we switch DPP provider, and what will it cost?
When will the EU rules for DPP service providers be adopted?
Will DPP service providers have to be certified?
Sources
- ESPRRegulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, amending Directive (EU) 2020/1828 and Regulation (EU) 2023/1542 and repealing Directive 2009/125/EC. Recitals 38 and 40; Articles 2(32), 4(4), 9(1), (2) and (4), 10(1) and (4), 11, 27(1), 29(2), 41(2) and 72(6); Annex III. Read in the Official Journal version; the Regulation has not been amended; corrigenda checked: the corrigendum of 28.4.2025 (OJ L, 2025/90356) corrects the spelling of the word vendor in Article 10(1), point (d), which is quoted here as corrected; none otherwise affects the passages cited. CELEX 32024R1781 ↗
- DPP registryCommission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781 of the European Parliament and of the Council. Recital 4; Articles 3, 5, 8(7) and (9), 19 and 24. CELEX 32026R1778 ↗
- Data ActRegulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act). Recitals 81 and 89; Articles 2(8) and (36), 23, 25, 29, 30, 31 and 50. Read in the Official Journal version; the Regulation has not been amended; the six corrigenda published up to 24.09.2026 were checked, and none changes the English text of the passages cited. CELEX 32023R2854 ↗
- Harmonised DPP standardsCommission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781 of the European Parliament and of the Council. CELEX 32026D1736 ↗ · CEN and CENELEC, news of 15.07.2026 listing the eight DPP standards. CEN-CENELEC ↗
- Provider initiativeEuropean Commission, Have your say, initiative 14382, Digital product passport – rules for service providers, including the call for evidence for an impact assessment, Ref. Ares(2024)8031852 of 12.11.2024 (record accessed 16.10.2026). Have your say ↗
- Commission timelineEuropean Commission, Digital Product Passport page, indicative DPP timeline (updated 15.10.2026; accessed 16.10.2026). Commission DPP page ↗
- Digital OmnibusProposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus), COM(2025) 837 final of 19.11.2025; point 15 of the proposed amendments to the Data Act (new Article 31(1a) and (1b)); a proposal, not law. CELEX 52025PC0837 ↗ · European Parliament, Legislative Observatory, procedure 2025/0360(COD) ↗.
ESPR, Implementing Regulation (EU) 2026/1778, Implementing Decision (EU) 2026/1736 and the Data Act were read in their Official Journal versions, and the Digital Omnibus proposal in the version of 19.11.2025, all published by the EU Publications Office (EUR-Lex); corrigenda were checked; the Publications Office records were searched on 16.10.2026 and showed no delegated act on DPP service providers; the European Commission, Have your say, Legislative Observatory and CEN-CENELEC pages were accessed on 16.10.2026. This is general information, not legal, financial or investment advice.