DATA ACCESS GUIDE
Who Can See Your DPP Data? Access Rights, Confidentiality and Security Under ESPR
The most common worry we hear from fashion brands about the Digital Product Passport is exposure: will competitors see the supplier list, will the public see composition and chemical data, can the DPP provider reuse the data? ESPR, Regulation (EU) 2024/1781, does not answer those questions product by product. It does something more basic: it makes access to passport data depend on access rights that the delegated act for each product group is to define, and it sets essential requirements on who may change data, on integrity and on security that already bind every passport.
This guide separates what the Regulation already fixes from what is still open for apparel: the textile delegated act, the two harmonised standards on access rights and data integrity that are not yet cited, the delegated act on DPP service providers, and the implementing acts on digital credentials that ESPR allows but that have not been proposed. For where the data physically sits and what goes on the label, see our data-carriers and registry guide.
Per product group
Access to passport data follows the specific access rights at product group level set in the applicable delegated act (ESPR Article 10(1)(g)).
6 of 8
DPP standards cited in the Official Journal by Implementing Decision (EU) 2026/1736; EN 18239 (access rights) and EN 18246 (integrity) are not yet among them.
No resale
DPP service providers may not sell, reuse or process passport data beyond the service unless specifically agreed with the economic operator (ESPR Article 11).
1. What the Regulation already decides about access
Article 10(1)(g), Regulation (EU) 2024/1781 (ESPR)
"the access to data included in the digital product passport shall be regulated in accordance with the essential requirements set out in this Article and Article 11 and with the specific access rights at product group level as specified in the applicable delegated act adopted pursuant to Article 4"
Access is therefore not one rule for every product. Each delegated act must, as appropriate for the product group, specify "the actors that are to have access to data in the digital product passport and to what data they are to have access" and "the actors that are to create a digital product passport or update the data in a digital product passport and what data they may introduce or update" (Article 9(2), points (f) and (g)). Until the delegated act for apparel textiles exists, the law does not say which individual apparel data will be public and which will be restricted.
What the Regulation does fix is the circle of actors and the principle. Under Article 11, point (b), customers, manufacturers, importers, distributors, dealers, professional repairers, independent operators, refurbishers, remanufacturers, recyclers, market surveillance and customs authorities, civil society organisations, trade unions and other relevant actors "shall have free of charge and easy access to the digital product passport based on their respective access rights" set out in the applicable delegated act. Recital 33 explains the design goal: to optimise access to the data while also protecting intellectual property rights, the passport "needs to be designed and implemented in a manner that allows differentiated access to the data in the digital product passport depending on the type of data and the typology of stakeholders".
Three provisions shape access before a single apparel field is defined. The delegated act must specify, as appropriate, how the passport is made accessible to customers before they are bound by a contract for sale, hire or hire purchase, including in distance selling (Article 9(2), point (e)). The economic operator placing the product on the market must give dealers and online marketplaces a digital copy of the data carrier or unique product identifier so that customers who cannot physically access the product can reach the passport (Article 10(3)). And the economic operator, when placing the product on the market, "shall make available a back-up copy of the digital product passport through a digital product passport service provider" (Article 10(4)), so the rules on service providers in section 2 concern every brand, not only those that outsource hosting.
Two further points are already settled. The EU registry under Article 13 "stores in a secure manner at least the unique identifiers" and, for products to be released for free circulation, the commodity code (Article 13(1)); Implementing Regulation (EU) 2026/1778 adds registration data such as a reference to the DPP service provider (Article 8(9)); other passport data are stored there only where a delegated act says so (Article 13(2)). The registry is not public: the Commission, competent national authorities and customs authorities have access for their duties (Article 13(6)); economic operators have access, once verified, to register their passports (Article 4(3) of Implementing Regulation (EU) 2026/1778), and other value chain actors such as repairers or recyclers only once they have been verified (Article 5(3)). The public web portal the Commission must run under Article 14, by contrast, must let stakeholders search and compare passport data "in a manner that is consistent with their respective access rights".
2. How confidential business information and personal data are protected
ESPR contains several protections that apply before any apparel act is written:
| Provision (ESPR) | What it says | What it means for a brand |
|---|---|---|
| Article 5(10), point (d) | When preparing ecodesign requirements, the Commission shall "take into consideration the protection of confidential business information". | Confidentiality is a factor the Commission must weigh when it sets the apparel requirements, not an afterthought. |
| Article 7(6), point (b) | Where relevant, a delegated act setting information requirements shall provide duly justified exemptions from substance-of-concern information requirements based, among other grounds, on "the need to protect confidential business information"; substances within the meaning of Article 2(27), point (a), present above 0.1 % weight by weight may not be exempted. | There is a legal route to keep some substance information out of the passport, but not for Candidate List substances (Article 2(27), point (a)) above that threshold. |
| Recital 33 | Differentiated access "depending on the type of data and the typology of stakeholders", to optimise access to the data while also protecting intellectual property rights. | The legislator expects that not every actor sees every field. |
| Article 10(1), point (e) | "personal data relating to customers shall not be stored in the digital product passport without their explicit consent" in compliance with Article 6 of Regulation (EU) 2016/679. | Customer data, for example from a resale or repair service, does not belong in the passport by default. |
| Article 11, second subparagraph | DPP service providers "shall not sell, reuse or process such data, in whole or in part, beyond what is necessary for the provision of the relevant storing or processing services, unless specifically agreed with the economic operator placing the product on the market or putting it into service". | Whatever a provider may do with your passport data beyond the service depends on what you agree to in the contract. |
On the wording, none of these provisions promises that a particular apparel field will stay confidential. They are the yardsticks against which the apparel delegated act will draw its access tiers. The substances-of-concern guide explains the 0.1 % threshold in detail.
3. Who may change data, and the security requirements
Reading data and writing data are treated separately. Article 11, point (f), provides that "the rights to introduce, modify or update data in the digital product passport shall be restricted based on the access rights specified in delegated acts adopted pursuant to Article 4". In practice, the delegated act is expected to say which actor, for example a brand, a supplier or a repairer, may add or update which information (Article 9(2), point (g)).
Two essential requirements apply to every passport regardless of the product group: "data authentication, reliability and integrity shall be ensured" (Article 11, point (g)), and passports "shall be designed and operated so that a high level of security and privacy is ensured and fraud is avoided" (Article 11, point (h)).
Article 11, last subparagraph, allows the Commission to adopt implementing acts setting out "procedures to issue and verify the digital credentials of economic operators and other relevant actors that have access rights to data included in the digital product passport". We found no such implementing act in the Publications Office records and no related initiative on the Commission's Have your say portal on 13 October 2026.
4. The two standards on access rights and integrity
Eight European standards were developed for the DPP. According to CEN and CENELEC (15 July 2026), they include EN 18239 "Digital Product Passport - Access rights management, information system security, and business confidentiality" and EN 18246 "Digital product passport - Data authentication, reliability and integrity". Implementing Decision (EU) 2026/1736 of 14 July 2026 published the references of six of the eight standards in the Official Journal; EN 18239 and EN 18246 are not among them.
That matters because of Article 41(2) of ESPR: a passport that conforms to harmonised standards whose references have been published in the Official Journal is presumed to conform to the requirements of Articles 10 and 11, to the extent covered by those standards. The two standards dedicated to access rights, security, confidentiality and integrity, EN 18239 and EN 18246, do not yet give a presumption of conformity. The Commission's DPP page listed the decision on the remaining two standards for September 2026 (its timeline is indicative); on 13 October 2026 we found no such decision in the Publications Office records, and on 17 October 2026 the page listed the decision for November 2026 instead.
5. What is still pending, and what each item will decide
| Item | Status on 13 October 2026 | What it will decide |
|---|---|---|
| ESPR delegated act for textiles (apparel) | Not adopted. The Commission's DPP page lists adoption of the delegated acts for textiles, aluminium and tyres for Q3–Q4 2027. | Which actors see which apparel data, and who may introduce or update which data (Article 9(2), points (f) and (g)). |
| Harmonised standards EN 18239 and EN 18246 | Not yet cited in the Official Journal; on 13 October 2026 the Commission's DPP page listed September 2026 for the decision, and as of 17 October 2026 it lists November 2026 (indicative). | Presumption of conformity for access rights, security, confidentiality and integrity (Article 41(2)). |
| Implementing regulation on access rights to parts of the battery passport | Planned for Q4 2026 (Have your say, initiative 16473); Article 77(9) of Regulation (EU) 2023/1542 set a deadline of 18 August 2026; the Commission published the draft on 19 October 2026, with feedback open until 16 November 2026. | Batteries only, not clothing. Regulation (EU) 2023/1542 already sorts battery-passport information into parts accessible to the general public, only to notified bodies, market surveillance authorities and the Commission, and only to persons with a legitimate interest (Article 77(2), Annex XIII); this act will specify who counts as a person with a legitimate interest and to what extent they can download, share, publish and re-use that information. |
| Delegated act on DPP service providers | Planned for Q4 2026 according to the Have your say record (initiative 14382); the Commission's DPP page lists it for 2027. | Requirements for becoming and operating as a DPP service provider and, where appropriate, a certification scheme (Article 11, third subparagraph). |
| Implementing acts on digital credentials | No initiative found. | How access-right holders are identified and verified (Article 11, last subparagraph). |
Outlook — European Business Wallets
The Commission's proposal for a regulation on European Business Wallets, COM(2025) 838 of 19 November 2025, has not been adopted; on 7 October 2026 the European Parliament confirmed its mandate to enter interinstitutional negotiations (procedure 2025/0358(COD)). Its explanatory memorandum mentions digital product passports, but its proposed articles do not refer to ESPR. Whether business wallets will be used to prove DPP access rights is therefore an open policy question, not law.
6. What a brand can do now
None of the following is required by ESPR today; it is how we recommend preparing while the apparel rules are open:
| Step | Why |
|---|---|
| Classify your product data by sensitivity: public, partners only, authorities only, internal. | Recital 33 and Article 9(2), point (f), point to differentiated access. A classification now makes it fast to map your data to the tiers the delegated act sets. |
| Read the data-use clause of any DPP pilot or provider contract. | Under Article 11, second subparagraph, reuse beyond the service needs your specific agreement. Avoid blanket consent. |
| Decide who may write which data, especially suppliers. | Article 11, point (f), restricts write rights according to the access rights. Role-based permissions in pilots now avoid rework later. |
| Keep customer personal data out of the passport. | Article 10(1), point (e), requires explicit consent under the GDPR. |
| Ask providers how they will meet EN 18239 and EN 18246 once cited. | Until then, Articles 10 and 11 apply without the presumption of conformity for these aspects. |
DPP AUDIT
Know which of your product data can be public, and which must not be.
We map your product data against the DPP requirements and the open access-rights questions, so your supplier data, contracts and access model are ready when the textile act arrives. Under NDA.
Start Your DPP AuditFrequently asked questions
Will my supplier and factory list be public in the DPP?
Can my DPP service provider use my product data?
Who can change the data in my passport?
Is there a standard for DPP access rights we can follow now?
Can customer data be stored in the passport?
Sources
- ESPRRegulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, amending Directive (EU) 2020/1828 and Regulation (EU) 2023/1542 and repealing Directive 2009/125/EC. Recital 33; Articles 2(27), 5(10), 7(6), 9(2), 10(1), (3) and (4), 11, 13, 14 and 41(2); Annex III. Read in the Official Journal version; corrigenda checked; none affects the passages cited. CELEX 32024R1781 ↗
- Harmonised DPP standardsCommission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781 of the European Parliament and of the Council. CELEX 32026D1736 ↗ · CEN and CENELEC, news of 15.07.2026 listing the eight DPP standards. CEN-CENELEC ↗
- DPP registryCommission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781 of the European Parliament and of the Council. Articles 4(3), 5(3) and 8(9). CELEX 32026R1778 ↗
- Battery passportRegulation (EU) 2023/1542 of the European Parliament and of the Council of 12 July 2023 concerning batteries and waste batteries, amending Directive 2008/98/EC and Regulation (EU) 2019/1020 and repealing Directive 2006/66/EC. Article 77(2) and (9); Annex XIII. Read in the consolidated version of 13.08.2026. CELEX 02023R1542-20260813 ↗
- Commission timelineEuropean Commission, Digital Product Passport page (accessed 13.10.2026; the timeline entry for the remaining two standards accessed again on 17.10.2026). Commission DPP page ↗
- Pending actsHave your say, initiative 16473, implementing regulation on access rights to certain parts of the battery passport ↗; initiative 14382, Digital Product Passport service providers ↗; COM(2025) 838, proposal for a regulation on the establishment of European Business Wallets CELEX 52025PC0838 ↗; European Parliament, Legislative Observatory, procedure 2025/0358(COD) ↗.
ESPR, Implementing Decision (EU) 2026/1736 and Implementing Regulation (EU) 2026/1778 were read in the Official Journal versions and Regulation (EU) 2023/1542 in its consolidated version, all published by the EU Publications Office (EUR-Lex); consolidated versions are documentation tools without legal effect, the authentic text being the Official Journal; the Publications Office records were searched on 13.10.2026; the European Commission, Have your say, Legislative Observatory and CEN-CENELEC pages were accessed on 13.10.2026, and the Have your say entry for initiative 16473 again on 20.10.2026. This is general information, not legal, financial or investment advice.