Home/Data Carriers & Registry Guide

TECHNICAL GUIDE

What Goes on the QR Code? DPP Data Carriers & the EU Registry

Published 24.09.2026 · Reading time ~4 min · by Lior Gabriel Graetz · LG Fashion Labs

A harmonised EU standard for exactly this already exists: EN 18220:2026, the CEN-CENELEC standard for data carriers, was cited as a harmonised standard in the Official Journal on 15 July 2026 — meaning a brand building to it now gets a presumption of conformity with ESPR Article 10. The most common assumption about the Digital Product Passport, though, is wrong: that the QR code on the garment holds the data. It doesn't. It holds a link. What's actually stored where — on the product, with your brand, or with the European Commission — is defined precisely in the ESPR's own text, and it's less centralised than most people expect.

This guide walks through the data carrier, the EU Registry that went live this summer, and the CEN-CENELEC standards behind both — sourced directly from EUR-Lex and CEN-CENELEC, checked live.

A link, not data

The QR code on a garment holds a link to the passport — not the passport data itself.

Open since 20 Jul 2026

The Commission launched the EU DPP Registry on 20 July 2026, and organisations can now enrol. The registry stores identifiers and registration metadata, not brand data. According to the Commission's user guide (v1.03, 16 September 2026), registering a passport is not yet possible.

CEN-CENELEC

The standards body behind both the data-carrier format and the registry's technical specifications.

1. What's actually on the carrier

The ESPR defines a "data carrier" broadly: "a linear barcode symbol, a two-dimensional symbol or other automatic identification data capture medium that can be read by a device" (Article 2, point 29). A QR code is the obvious example, but the definition also covers NFC chips, RFID tags and other formats — the law is carrier-agnostic.

What the carrier connects to is narrow and specific: a "persistent unique product identifier" (Article 10(1)(a)) — a string of characters that "enables a web link to the digital product passport" (Article 2, point 30). That's it. The carrier is a pointer, not a payload. Article 10(1)(b) requires it to be physically present on the product, its packaging, or documentation accompanying it. In the Commission's registry user guide for economic operators (v1.03, 16 September 2026), the data carrier encodes the passport's Unique Product Identifier (UPI), and the passport data must be resolvable at all times; for registration, the UPI must be a URL in a format compliant with JTC 24 standards, of at most 2,000 characters, starting with https://, that resolves to where the passport data are hosted.

One practical duty worth knowing: Article 10(3) requires the brand placing the product on the market to supply dealers and online marketplaces with a digital copy of the carrier or identifier, so they can make it accessible to a potential customer who can't physically access the product itself — the classic case being someone browsing a listing online, with no garment in front of them to scan. That copy or a webpage link has to be provided free of charge, within five working days of a request.

2. Where the real data actually lives

Not with the EU. Article 11(c) of the ESPR is explicit: the digital product passport "shall be stored by the economic operator responsible for its creation or by digital product passport service providers." CEN-CENELEC — the standards body building the technical framework — describes the result as a "hybrid structure": not a centralised government database, and not fully decentralised either, but a split of responsibilities between the Commission and third-party service providers, who are typically private companies.

The brand (or its service provider) also carries a resilience duty: Article 10(4) requires a back-up copy of the passport to be made available through a digital product passport service provider, and Article 11(e) requires the passport to stay available even if the original economic operator becomes insolvent or ceases trading.

3. What the EU Registry actually stores

The Commission-run "registry" is real, and it's live — but it stores far less than the word suggests. Article 13(1) required the Commission to set it up by 19 July 2026, storing "in a secure manner at least the unique identifiers" — a term that this provision does not define itself (Article 2 defines the unique product, operator and facility identifiers separately, in points 30, 31 and 33). The Commission's DPP Registry page describes a secure database that stores "the unique identifiers, registration data, and high-level metadata for each product", and its user guide for economic operators (v1.03, 16 September 2026) says the registry "records a subset of information necessary to identify and access the DPP, such as unique product identifiers and the location where the passport is hosted". The registration record binds the Unique Product Identifier (UPI) to a Unique Registration Identifier (URI) that the registry issues. CEN-CENELEC, the standards body, describes a registry "where the IDs of the products, the manufacturers and the factories are stored" (15 July 2026).

The registry separately stores commodity codes for goods entering the EU through customs; the registration form for batteries described in the Commission's guide has no commodity-code field and, apart from the product group and the pre-selected item level, asks only for the UPI and optional model and batch identifiers. The Commission adopted Implementing Regulation (EU) 2026/1778, which lays down how the registry operates, on 16 July 2026 and launched the registry, together with a test environment, on 20 July 2026 (Commission news item of that date).

Where things stand. The registry was launched on 20 July 2026. According to the Commission's user guide for economic operators (v1.03, last published 16 September 2026), it is open for EU Login accounts, organisation enrolment and identity verification, and a separate test environment is available. Completing the registration of a passport is not yet possible. The guide states: "Successful registration of DPPs for batteries is not currently available, as the semantic catalogue for this product group has not yet been defined. Currently, it is not possible to successfully register DPPs." Batteries are the first product group offered; other product groups are introduced progressively, in line with the ESPR Working Plan. Textiles are not part of this first phase.

The guide uses two abbreviations that are easy to confuse. The Unique Product Identifier (UPI) is the URL you supply (see section 1). The Unique Registration Identifier (URI) is issued by the registry after a successful registration and "connects to an existing DPP Data via an UPI". The registry processes the UPI at validation time and rejects, for example, URLs with an unsupported protocol, a disallowed domain, a non-permitted network port, excessive redirects or a redirect to a less secure protocol. The guide does not define a format for the registration identifier itself; Implementing Regulation (EU) 2026/1778, Article 8(8), requires only that it be unique and persistent.

The Commission can require additional data per product group (Article 13(2)), taking into account at least the need to allow for the verification of a passport's authenticity, the relevance of the information for improving the efficiency and effectiveness of market surveillance checks and customs controls, and the need to avoid a disproportionate administrative burden for economic operators and customs authorities. The full DPP dataset is not the default.

Not the same thing

Registry vs. web portal vs. the passport itself

The registry isn't textile-specific, either — Implementing Regulation (EU) 2026/1778 covers the same infrastructure for batteries, construction products, toys and detergents, each under their own product law. It's shared plumbing, not a fashion-only system. Shared doesn't mean low-stakes: once the registry is interconnected with the EU Customs Single Window Certificates Exchange System (EU CSW-CERTEX), due by 6 August 2030 at the latest, customs may release an imported product covered by a delegated act for free circulation only after verifying, as a minimum, that its unique registration identifier and its commodity code correspond to the data stored in the registry (ESPR Article 15(1) to (3)).

4. The standards that make it work

The technical detail sits with CEN-CENELEC Joint Technical Committee 24, "Digital Product Passport – Framework and System" (secretariat held by Germany's DIN), working under EU Standardization Request M/604. It has produced eight EN standards, including EN 18220:2026 "Digital product passport – Data carriers" — the one that governs exactly this topic.

Six of the eight, including EN 18220, were cited as harmonised standards in the Official Journal on 15 July 2026 (Commission Implementing Decision (EU) 2026/1736). That citation matters legally: compliance with a cited harmonised standard gives a "presumption of conformity" with the ESPR's essential requirements — meaning a brand using EN 18220 correctly doesn't have to separately prove its carrier meets Article 10. Two standards — covering access-rights security and data authentication — haven't been cited yet.

What none of this fixes yet: exactly which carrier technology fashion products must use. That detail is set per product group in each delegated act, and no textile delegated act has been adopted so far — so today, EN 18220 tells you how a compliant carrier must behave, not which one your garments will be required to carry.

DPP AUDIT

How ready is your collection for the DPP?

Benchmark one complete collection against the LGFL DPP Data Framework. 10 domains, four ESPR categories. Under NDA.

Start Your DPP Audit

Frequently asked questions

Does the QR code on a Digital Product Passport contain the full product data? +
No. Per Article 10(1)(a) of the ESPR, the data carrier only connects to a "persistent unique product identifier" — essentially a link. The actual product data is stored separately and reached by scanning through to it, not read directly off the carrier itself.
What data does the EU Digital Product Passport Registry actually store? +
By default, at least the unique identifiers — a term Article 13(1) does not define itself (Article 2 defines the unique product, operator and facility identifiers separately, in points 30, 31 and 33). The Commission describes the registry as storing "the unique identifiers, registration data, and high-level metadata for each product", and its user guide (v1.03, 16 September 2026) says the registry "records a subset of information necessary to identify and access the DPP, such as unique product identifiers and the location where the passport is hosted" — not the full passport data. CEN-CENELEC, the standards body, describes a registry "where the IDs of the products, the manufacturers and the factories are stored" (15 July 2026). Article 13(1) requires the unique identifiers "at least"; the Commission can require additional data per product group under Article 13(2), but the full DPP dataset itself stays with the economic operator or a digital product passport service provider.
Who is responsible for actually hosting a product's DPP data? +
The economic operator that places the product on the market, or a digital product passport service provider they authorise — not the European Commission. Article 11(c) requires the passport to "be stored by the economic operator responsible for its creation or by digital product passport service providers." The Commission's registry holds identifiers and registration data, not the dataset itself.
Which technical standard applies to DPP data carriers? +
EN 18220:2026 "Digital product passport – Data carriers", developed by CEN-CENELEC Joint Technical Committee 24. It was cited as a harmonised standard in the Official Journal on 15 July 2026 (Commission Implementing Decision (EU) 2026/1736), giving products that use it correctly a presumption of conformity with the ESPR's essential requirements. No textile-specific delegated act has been adopted yet, so which exact carrier technology fashion products must use isn't fixed.

Sources

The legal texts and the CEN-CENELEC page were accessed and verified directly on EUR-Lex and CEN-CENELEC's own site on 29.09.2026; the Commission's DPP Registry page, news item and user guide were accessed on 13.10.2026. This is general information, not legal, financial or investment advice.

GUIDE

Digital Product Passport for Fashion: The Complete 2026 Guide

REGULATION

ESPR Fashion Compliance: What EU Brands Need to Know Now

COMPLIANCE DEEP DIVE

How the EU Digital Product Passport Registry Actually Works

TECHNICAL GUIDE

Product Identifiers for Fashion Brands: Customs PIDs from 1 November 2026, the GTIN and the DPP Identifier