Digital Product Passport Data Requirements

Introduction: Why Data Requirements Matter

The value of a Digital Product Passport (DPP) is ultimately determined by the quality and completeness of the data it contains. A passport with sparse, inaccurate, or poorly structured information fails to serve its intended purposes, whether those are enabling informed consumer choices, supporting circular economy processes, or satisfying regulatory compliance obligations.

The Ecodesign for Sustainable Products Regulation (ESPR), formally adopted as EU Regulation 2024/1781, establishes a framework for defining exactly what data DPPs must contain. While the regulation itself sets out general categories, the specific mandatory data fields are defined through delegated acts for each product category.

DPP Data Requirements at a Glance

This article provides a thorough overview of the data requirements businesses need to understand and prepare for. Whether you are just beginning your DPP journey or refining an existing implementation, getting the data right is the single most important step in building compliant, valuable Digital Product Passports.

Mandatory Data Categories Under the ESPR

The ESPR defines several broad categories of information that DPPs must contain. While the exact fields within each category will be specified by delegated acts for each product group, the general structure is clear and consistent across sectors.

The regulation requires the following core data categories to be included in every DPP:

• Product identification: a unique product identifier (typically a GTIN with serial number), product name, model number, batch or lot number, and manufacturer or brand identity.
• Manufacturer and economic operator details: the legal name, registered address, and contact information of the manufacturer, as well as details of the authorised representative within the EU and the importer where applicable.
• Material composition: a detailed breakdown of materials used in the product, including the percentage of recycled content, the presence and concentration of substances of concern, and any critical raw materials.
• Environmental impact data: carbon footprint calculations (covering at minimum the production phase, and ideally the full lifecycle), energy consumption during use, water usage, and other relevant environmental indicators.
• Compliance and conformity information: references to applicable regulations, declaration of conformity details, notified body information where relevant, test report references, and certification status.
• Circularity and end-of-life information: expected product lifespan, repairability score, availability of spare parts, disassembly instructions, recyclability assessment, and applicable take-back schemes.

Product Identification Requirements

Product identification is the foundational data layer of any DPP. Without a unique, globally recognised identifier, a passport cannot be reliably linked to the specific product it describes. The ESPR specifies that products must carry a unique product identifier conforming to ISO/IEC 15459 or equivalent standards.

In practice, this means using GS1 identifiers, specifically the Global Trade Item Number (GTIN) for product model identification and a serial number for individual product instance identification. Together, these create a unique identifier for every single product unit, enabling traceability from manufacture through to end of life.

The identifier must be encoded in a GS1 Digital Link URI, which takes the form of a resolvable web address. For example: https://id.example.com/01/09506000134352/21/ABC123, where 01 indicates a GTIN and 21 indicates a serial number. This URI is then encoded into a QR code or other data carrier affixed to the product.

Beyond the primary identifier, DPPs should also capture related identifiers such as batch or lot numbers, model numbers, and any classification codes relevant to the product category (such as customs tariff codes or product category codes). These secondary identifiers support supply chain management, regulatory reporting, and market surveillance activities.

Material Composition and Substances of Concern

One of the most impactful data requirements under the ESPR relates to material composition. Businesses must disclose what their products are made from, with specific attention to substances of concern and critical raw materials.

Substances of concern are chemicals or materials that may pose risks to human health or the environment. The ESPR requires that DPPs identify the name, concentration, and location within the product of any substances of concern present above defined thresholds. This information serves multiple purposes: it enables consumers to make informed choices, it supports recycling facilities in safe material handling, and it provides market surveillance authorities with data for enforcement activities.

Critical raw materials, as defined in the EU Critical Raw Materials Act, must also be declared. These are materials that are economically important to the EU but face supply risks due to geopolitical factors or limited availability. Declaring their presence in products supports the EU's strategic objectives around resource security and recycling.

Recycled content is another mandatory data point for many product categories. Businesses must declare the percentage of recycled material used in their products, broken down by material type where required. This data supports the EU's circular economy targets and enables consumers and procurers to favour products with higher recycled content.

Collecting accurate material composition data can be challenging, particularly for products with complex supply chains involving multiple tiers of suppliers. We address strategies for this in our ESPR compliance checklist.

Environmental Impact Data

Environmental impact data quantifies the ecological footprint of a product across its lifecycle. The ESPR places particular emphasis on carbon footprint, but the scope of required environmental data will expand as delegated acts are published for each product category.

Carbon footprint data must typically be expressed in kilograms of CO2 equivalent (kg CO2e) and may be required at different lifecycle stages: raw material extraction, manufacturing, transport, use phase, and end-of-life treatment. The methodology for calculation must follow recognised standards such as the Product Environmental Footprint (PEF) method or ISO 14067.

Energy consumption data is critical for energy-using products and must be expressed in standardised units (kilowatt-hours per year, for example) under defined test conditions. Water consumption, where relevant, follows similar principles.

The challenge for many businesses is that environmental impact data requires lifecycle assessment (LCA) capabilities or access to verified environmental data from suppliers. Building these capabilities takes time, which is why the ESPR provides for phased implementation, but businesses should begin developing their data collection processes now to avoid last-minute compliance scrambles.

Sector-Specific Data Requirements

While the ESPR establishes a common framework, the specific data fields required in a DPP are defined through delegated acts for each product category. This means that a DPP for a textile product will require different data points from a DPP for an electronic device or a battery.

For textiles, expect requirements around fibre composition, dyeing processes, microfibre release rates, durability test results (such as pilling resistance, colour fastness, and tensile strength), and care instructions that extend product lifespan.

For electronics, delegated acts are likely to require data on energy efficiency ratings, hazardous substance declarations (aligned with RoHS), software update availability, spare part availability and pricing, and battery specifications including capacity degradation curves.

For batteries, which are ahead of other sectors due to the EU Battery Regulation (2023/1542), DPPs must already include state of health data, capacity information, charging cycle history, material composition (including cobalt, lithium, nickel, and lead content), carbon footprint per kWh of capacity, and responsible sourcing documentation.

For construction products, requirements will likely cover thermal performance, fire resistance, acoustic properties, volatile organic compound (VOC) emissions, recycled content, and deconstruction potential.

Businesses operating across multiple sectors should plan for a flexible data model that can accommodate varying requirements without requiring a complete system redesign for each product category. Creating your first passport is simpler than you might expect, our step-by-step guide walks through the process.

Data Quality Standards

The ESPR does not just require data, it requires accurate, verifiable, and up-to-date data. Data quality is a fundamental compliance requirement, and businesses can face enforcement action for providing misleading or inaccurate passport information.

Several dimensions of data quality are relevant to DPPs:

• Accuracy: data must faithfully represent the actual attributes of the product. Material composition percentages must be based on actual formulations, not estimates. Environmental impact figures must be calculated using recognised methodologies.
• Completeness: all mandatory fields defined by the applicable delegated act must be populated. Missing data points constitute a compliance failure.
• Timeliness: data must be current. If a product's formulation changes, or if a certification expires, the passport must be updated to reflect the new reality.
• Consistency: data must be expressed in the units, formats, and vocabularies specified by the relevant standards and delegated acts. Inconsistent data undermines interoperability.
• Verifiability: businesses must be able to demonstrate the provenance and accuracy of their data if challenged by market surveillance authorities. This means maintaining records of data sources, calculation methodologies, and supplier declarations.

Investing in data quality processes up front, including supplier data collection workflows, automated validation rules, and regular data audits, pays significant dividends in reduced compliance risk and improved passport value.

Data Sourcing from the Supply Chain

For most manufacturers, a significant portion of the data required for DPPs originates from their supply chain. Material composition data comes from raw material suppliers. Component specifications come from component manufacturers. Environmental impact data may require aggregation across multiple tiers of the supply chain.

This creates a practical challenge: how do you collect, validate, and integrate data from dozens or hundreds of suppliers, many of whom may not yet be familiar with DPP requirements?

The most effective approach is to start early and be systematic. Begin by mapping your supply chain to identify which suppliers hold data that you need for DPP compliance. Categorise the data by type, material composition, environmental impact, compliance declarations, and by availability. Some data may already exist in supplier product data sheets or safety data sheets. Other data may need to be specifically requested or generated.

Standardised data exchange formats are emerging to simplify supplier data collection. The ESPR framework encourages the use of machine-readable data formats and standardised templates. Industry associations in sectors such as textiles, electronics, and automotive are developing sector-specific data exchange templates that businesses can adopt.

Building supplier engagement into your procurement processes is also important. Including DPP data requirements in supplier contracts and purchase specifications ensures that data collection becomes a routine part of the supply relationship rather than an afterthought.

Maintaining Data Accuracy Over the Product Lifecycle

A DPP is not a static document. It must remain accurate and accessible throughout the product's lifecycle, from manufacture through sale, use, repair, resale, and eventual end-of-life processing.

Several events during a product's lifecycle may trigger the need to update its passport:

• Product recalls or safety notices require the addition of recall information and instructions.
• Certification renewals or expirations require updates to compliance status fields.
• Regulatory changes may require new data fields to be added or existing fields to be recalculated.
• Repair or refurbishment events may change the product's material composition or performance characteristics.
• Ownership transfers may need to be recorded for high-value or regulated products.

Automated monitoring and update workflows help manage this complexity. For example, a DPP platform can be configured to alert the product owner when a certification is approaching its expiry date, or to automatically update passport status when a recall notice is issued.

The ESPR specifies minimum data retention periods that vary by product category. Businesses must ensure that their DPP platform provides data hosting for at least the required period, and ideally longer to support secondary market and end-of-life use cases.

Privacy and Confidentiality Considerations

While transparency is a core objective of the ESPR, the regulation also recognises that certain product data may be commercially sensitive. Businesses are not required to disclose trade secrets or proprietary formulations in their DPPs, but they must provide enough information to satisfy the mandatory data requirements.

The tiered access model envisaged by the ESPR helps manage this tension. Consumer-facing data includes sustainability metrics, material categories, repairability information, and general environmental impact data, all presented at a level that informs without revealing proprietary details. Regulatory authorities, on the other hand, can access more detailed data under legal frameworks that protect commercial confidentiality.

Personal data protection under GDPR must also be considered. If DPPs capture any data linked to individuals, for example, warranty registration details or ownership records for high-value items, this data must be handled in accordance with GDPR requirements, including data minimisation, purpose limitation, and the provision of data subject rights.

Businesses should work with their legal and data protection teams to define clear data classification policies for their DPPs, ensuring that the right data is shared with the right audiences at the right level of detail.

Preparing Your Data for DPP Compliance

Given the breadth and depth of data required, preparing for DPP compliance is fundamentally a data management challenge. Businesses that invest in structured, systematic data preparation will find compliance significantly easier, and will unlock more value from their passports in terms of consumer engagement, supply chain efficiency, and brand differentiation.

Start with a data gap analysis: map the data fields required for your product category against the data you currently hold. Identify gaps and prioritise filling them based on regulatory timelines and business impact. Focus first on data that is hardest to obtain, typically supply chain data and environmental impact calculations, as these have the longest lead times.

Invest in data management infrastructure. A centralised product information management (PIM) system or DPP platform that integrates with your existing ERP and supply chain systems will dramatically reduce the effort required to create and maintain accurate passports. Our platform at MyProductPassport is designed specifically for this purpose, providing structured data models, validation rules, and integration APIs that simplify the entire data management process.

Finally, build data quality into your processes rather than treating it as a one-off exercise. Ongoing supplier engagement, automated validation, and regular audits ensure that your DPP data remains accurate and compliant as products and regulations evolve. For a structured approach to getting started, see our guide to creating your first Digital Product Passport.

10-Step Action Plan for DPP Data Readiness

1. Identify your applicable delegated act. The sector delegated act defines which fields apply to your products. Read it once it is published, and track drafts in the interim.
2. Inventory existing data sources. ERP, PLM, PIM, CE technical files, EPDs, REACH declarations, energy labels, supplier portals. Most DPP fields already exist somewhere in the business.
3. Map data sources to DPP fields. Build a field-by-field map showing which internal system or external party holds each piece of data.
4. Identify data gaps. Fields not yet held internally or by suppliers are the work-list. Prioritise gaps that will require multi-tier supplier engagement, which has the longest lead times.
5. Engage suppliers on gap-filling. Most data quality issues trace back to suppliers. Formal data requests, contract clauses, and supplier scorecards are the levers.
6. Build a unified product data model. One internal data model should feed every regulatory regime: DPP, CSRD, CBAM, EPRs, energy labels, REACH, WEEE.
7. Plan data verification. High-impact fields such as carbon intensity and recycled content require third-party verification. Identify which verifier, which methodology, which audit cadence.
8. Choose a DPP hosting model. Internal hosting, third-party platform, or hybrid. Each affects how data flows in and how registry integration works.