DPP Access Control: Who Can See What Information

Tätä artikkelia ei ole vielä saatavilla kielelläsi, joten se näytetään englanniksi.

Why Access Control Matters for Digital Product Passports

Digital Product Passports (DPPs) represent a fundamental shift in how product information is stored, shared, and governed across the European Union. Under the Ecodesign for Sustainable Products Regulation (ESPR), EU Regulation 2024/1781, manufacturers must provide detailed information about their products' environmental impact, material composition, repairability, and end-of-life handling. However, not all of this information is intended for public consumption. Some data points involve proprietary manufacturing processes, confidential supply chain relationships, or commercially sensitive cost structures that businesses rightfully wish to protect.

Access control within DPPs is therefore not merely a technical consideration but a strategic imperative. The regulation acknowledges that different stakeholders require different levels of information to fulfil their respective roles. A consumer browsing a product in a shop needs to understand its environmental footprint and repairability score, whilst a market surveillance authority requires far more granular data to verify compliance. Similarly, recyclers and waste management operators need specific material composition data that would be irrelevant or confusing to the average buyer.

Getting access control right ensures that the DPP system achieves its transparency objectives without exposing businesses to unnecessary competitive risks. It also builds trust among all participants in the value chain, encouraging genuine data sharing rather than the minimum possible disclosure. As the first delegated acts begin to specify sector-specific requirements, understanding the access control framework becomes essential for every manufacturer preparing for compliance. For a broader overview of DPP fundamentals, see our complete guide to Digital Product Passports.

The Three-Tier Access Model Under ESPR

The ESPR establishes a tiered access model that categorises information based on its intended audience. This structure ensures that sensitive data is only available to those who genuinely need it, whilst maintaining the regulation's overarching goal of transparency and sustainability. The three primary tiers are public access, restricted access for authorised stakeholders, and confidential access for regulatory authorities.

Public access information is available to anyone who scans the DPP's data carrier, typically a QR code or NFC tag on the product or its packaging. This tier includes consumer-relevant data such as the product's energy efficiency class, durability ratings, repairability scores, recycled content percentages, and basic care or maintenance instructions. The intention is to empower consumers to make informed purchasing decisions based on genuine sustainability credentials rather than marketing claims.

The restricted access tier covers information that is relevant to specific professional stakeholders but not the general public. This includes detailed material composition data for recyclers, disassembly instructions for repair professionals, and supply chain traceability information for business partners. Access to this tier typically requires authentication, ensuring that only verified entities with a legitimate need can retrieve the data.

The confidential tier is reserved for market surveillance authorities and customs officials who need comprehensive data to verify regulatory compliance. This may include detailed test reports, manufacturing process parameters, supplier identities, and cost breakdowns. Access at this level is governed by strict protocols and is subject to data protection requirements under both the ESPR and the General Data Protection Regulation (GDPR).

What Consumers Can See

Consumers represent the broadest access group, and the information available to them is carefully curated to be meaningful and actionable. When a consumer scans a product's QR code, they should be able to immediately understand the product's environmental credentials without needing specialist knowledge. The ESPR mandates that this information be presented in a clear, accessible format that supports genuine comparison between competing products.

Typical consumer-facing data points include:

• Energy efficiency class and estimated annual energy consumption
• Durability rating and expected product lifespan
• Repairability score and availability of spare parts
• Percentage of recycled content used in manufacturing
• Carbon footprint data expressed in CO2 equivalent
• Substances of concern present in the product
• Proper disposal and recycling instructions

This consumer-facing layer must be designed with usability in mind. The regulation emphasises that information should be understandable to non-experts, which means avoiding excessive technical jargon and using standardised labels where possible. Manufacturers who invest in clear, well-designed consumer interfaces will likely see competitive advantages as sustainability-conscious consumers increasingly rely on DPP data when making purchasing decisions. Our technical overview of how DPPs work explains the data carrier mechanisms in greater detail.

Access for Supply Chain Partners and Repair Professionals

The restricted access tier serves a diverse group of professional stakeholders, each with distinct information needs. Supply chain partners, including downstream manufacturers, distributors, and retailers, may need access to material provenance data, chemical composition details, and compliance documentation to fulfil their own regulatory obligations. A furniture retailer, for instance, needs to verify that the textiles used in upholstered products comply with chemical safety standards.

Repair professionals and independent service providers represent another critical audience within this tier. The ESPR explicitly supports the right to repair by mandating that manufacturers provide disassembly instructions, spare parts catalogues, and diagnostic information to authorised repair operators. This requirement is designed to break down the barriers that have historically forced consumers to rely solely on manufacturer-authorised service centres, often at premium prices.

Recyclers and waste management operators need detailed material composition data to process products efficiently at end of life. Knowing precisely which plastics, metals, and hazardous substances are present in a product allows recyclers to optimise sorting processes and maximise material recovery rates. Without this information, recyclers must rely on costly and imprecise manual identification methods that often result in valuable materials being lost to landfill or incineration.

Authentication mechanisms for this tier may include API keys, digital certificates, or integration with industry-specific identity verification systems. The European Commission is expected to provide further guidance on standardised authentication protocols as the DPP infrastructure matures. For businesses preparing their systems, understanding these access requirements early is essential. Our ESPR compliance checklist provides a practical framework for preparation.

Regulatory Authority Access and Market Surveillance

Market surveillance authorities occupy the highest access tier, with the ability to retrieve comprehensive product data for compliance verification purposes. This includes all consumer-facing and restricted-access information, plus additional confidential data such as detailed test reports, manufacturing parameters, supplier audit results, and internal quality control documentation. The breadth of access reflects the authorities' mandate to protect consumers and ensure a level playing field across the single market.

Under the ESPR, customs authorities at EU borders will also have access to DPP data to verify that imported products meet ecodesign requirements before they enter the market. This represents a significant enhancement compared to the previous Ecodesign Directive, which relied primarily on post-market surveillance and often struggled to identify non-compliant imports until they had already been sold to consumers.

The regulation includes safeguards to prevent misuse of confidential data accessed by authorities. Information obtained through DPP access must be used solely for regulatory purposes and cannot be shared with competitors or other unauthorised parties. Authorities are also required to handle data in accordance with applicable data protection legislation, including secure storage and transmission protocols.

The full text of EU Regulation 2024/1781 sets out the legal basis for regulatory access in detail, including the obligations placed on economic operators to facilitate authority access upon request.

Technical Implementation of Access Control

Implementing tiered access control in a DPP system requires careful architectural planning. The most common approach involves a centralised or federated data registry that stores product information and manages access permissions through role-based access control (RBAC) mechanisms. When a user or system requests data, the registry verifies their identity and role before returning the appropriate subset of information.

Key technical considerations for DPP access control include:

• Authentication protocols such as OAuth 2.0 or OpenID Connect for verifying user identity
• Role-based access control (RBAC) mapping stakeholder categories to data visibility levels
• API gateway management to enforce rate limiting and access policies
• Data encryption at rest and in transit to protect confidential information
• Audit logging to track who accessed what data and when
• Interoperability standards to ensure cross-border and cross-system compatibility

The first harmonised DPP standards, developed by CEN and CENELEC under the Commission's standardisation request, were cited in Commission Implementing Decision (EU) 2026/1736 of 14 July 2026: EN 18216 (data exchange protocols), EN 18219 (unique identifiers), EN 18220 (data carriers), EN 18221 (data storage, archiving and persistence), EN 18222 (APIs for passport lifecycle management and searchability) and EN 18223 (system interoperability). Building to these standards now reduces the cost and complexity of future compliance adjustments.

Businesses should also consider how their existing enterprise resource planning (ERP) and product lifecycle management (PLM) systems will integrate with DPP access control infrastructure. Many organisations already maintain the underlying data required for DPPs but lack the access control and external sharing capabilities needed to comply with the regulation.

Protecting Trade Secrets Within the DPP Framework

One of the most common concerns raised by manufacturers is the potential exposure of trade secrets through DPP data sharing. The ESPR addresses this concern by explicitly recognising the need to protect commercially sensitive information whilst still achieving transparency objectives. The tiered access model is the primary mechanism for this protection, but manufacturers can also take additional steps to safeguard their intellectual property.

When preparing DPP data, manufacturers should carefully classify each data point according to its sensitivity level and the stakeholder groups that genuinely need access. Material composition data, for example, can often be presented at an aggregate level for consumers (e.g., "contains 30% recycled plastic") whilst providing more granular breakdowns only to recyclers and authorities who need the detail for operational or regulatory purposes.

Manufacturers should also engage with industry associations and standardisation bodies to influence how sector-specific delegated acts define data requirements. Early participation in these processes ensures that the final requirements reflect practical considerations around trade secret protection. The complete guide to ESPR regulation covers the legislative process and opportunities for industry input.

Preparing Your Organisation for DPP Access Control

Preparing for DPP access control is not a last-minute exercise. Organisations should begin by conducting a comprehensive data audit to identify what product information they currently hold, where it resides, and who has access to it. This audit will reveal gaps in data collection, inconsistencies in data quality, and areas where access controls need to be strengthened or restructured.

Key preparation steps include:

• Mapping all product data points against the three-tier access model
• Identifying data gaps that need to be filled before compliance deadlines
• Reviewing existing IT infrastructure for DPP integration readiness
• Training staff on data classification and access control procedures
• Engaging with supply chain partners to establish data sharing agreements
• Selecting or developing a DPP platform that supports tiered access control

The timeline for compliance varies by product category: the battery passport applies from 18 February 2027 and the first ESPR delegated acts take effect from 2028 onwards. However, building the organisational capabilities and technical infrastructure for effective access control takes time. Businesses that start early will be better positioned to comply smoothly and may even gain competitive advantages by demonstrating leadership in product transparency. Our ESPR timeline guide provides sector-specific deadline information to help you plan effectively.

Digital Product Passport access control is ultimately about balance, enabling the transparency that drives sustainability progress whilst protecting the commercial interests that incentivise innovation. Organisations that approach this challenge strategically, rather than reactively, will find that well-implemented access control becomes a source of trust and competitive differentiation rather than a compliance burden.