DPP Technical Glossary: Standards and Protocols

Dan l-artiklu għadu mhux disponibbli bil-lingwa tiegħek, għalhekk qed jintwera bl-Ingliż.

Introduction to DPP Technical Standards

The successful implementation of digital product passports at scale depends on a robust ecosystem of technical standards and protocols that ensure interoperability, data integrity, and accessibility. Understanding these standards is essential for technical teams responsible for building and integrating DPP systems, as well as for decision-makers evaluating technology solutions.

The digital product passport infrastructure draws on standards from multiple domains, including product identification (GS1), data representation (W3C), supply chain visibility (EPCIS), and web architecture (HTTP, REST). This glossary provides clear definitions and context for each of these technical building blocks, explaining how they fit together to create a functioning DPP ecosystem.

This resource is intended as a companion to our broader DPP glossary, focusing specifically on the technical standards and protocols that underpin implementation. Whether you are building a DPP platform, integrating DPP functionality into existing systems, or evaluating technology partners, this reference will help you navigate the technical landscape.

Identification Standards

GS1 Digital Link: A standard developed by GS1 that transforms traditional product barcodes into web-enabled data carriers. A GS1 Digital Link URI encodes a product's GTIN (and optionally a serial number) into a standard web URL format, such as https://id.example.com/01/09506000134376/21/ABC123. This URI can be encoded in a QR code that is both scannable at point of sale and resolvable to a digital product passport on the web. The GS1 Digital Link is the primary identification standard recommended for ESPR DPP implementation.

GTIN (Global Trade Item Number): An internationally recognised identifier for products, managed by GS1. GTINs come in various lengths (GTIN-8, GTIN-12, GTIN-13, GTIN-14) and are the foundation of product identification in retail and supply chain management. In the DPP context, the GTIN identifies the product model or SKU, while additional elements such as batch numbers or serial numbers provide finer granularity.

SGTIN (Serialised Global Trade Item Number): A combination of a GTIN with an individual serial number, creating a unique identifier for each product unit. SGTINs enable item-level DPPs and are essential for products requiring individual tracking throughout their lifecycle.

GLN (Global Location Number): A GS1 identifier for physical locations and legal entities. GLNs are used in DPPs to identify manufacturing facilities, company headquarters, and other relevant locations in the supply chain. They support the unique operator identifier and unique facility identifier requirements of the ESPR.

SSCC (Serial Shipping Container Code): A GS1 identifier for logistics units such as pallets and containers. While not directly part of the DPP data carrier, SSCCs may be used in the supply chain data that feeds into digital product passports, particularly for tracking product movements during distribution.

Data Representation Standards

JSON-LD (JavaScript Object Notation for Linked Data): A method of encoding Linked Data using JSON syntax, defined by the W3C. JSON-LD is a key format for representing DPP data in a structured, machine-readable way. It enables semantic interoperability by linking data to shared vocabularies and ontologies, allowing different systems to understand and process DPP data consistently.

Schema.org: A collaborative vocabulary for structured data on the internet, originally created by Google, Microsoft, Yahoo, and Yandex. Schema.org provides a widely adopted set of types and properties that can be used to describe products, organisations, and other entities within DPP data. Using Schema.org vocabularies enhances the discoverability and interoperability of DPP data.

RDF (Resource Description Framework): A W3C standard for representing information as a graph of linked data. RDF provides the conceptual foundation for Linked Data approaches to DPP implementation, enabling data from different sources to be combined and queried. JSON-LD is one serialisation format for RDF data.

Ontology: A formal specification of the concepts, relationships, and rules within a domain. DPP ontologies define the vocabulary and structure for representing product data, sustainability metrics, and supply chain information in a standardised way. Developing shared ontologies for DPP data is an active area of standardisation work.

Vocabulary: A collection of terms with defined meanings used to describe data within a specific domain. DPP vocabularies specify the data attributes that can be included in a passport, such as "materialComposition," "carbonFootprint," or "reparabilityScore." Standardised vocabularies ensure that different DPP systems use consistent terminology.

Supply Chain Visibility Standards

EPCIS (Electronic Product Code Information Services): A GS1 standard for capturing and sharing supply chain event data. EPCIS enables the recording of "what, when, where, and why" information about product movements and transformations throughout the supply chain. EPCIS data can feed into digital product passports to provide supply chain transparency and traceability.

CBV (Core Business Vocabulary): A companion standard to EPCIS that defines a set of standard vocabulary elements for describing supply chain events. The CBV provides standardised terms for business steps (e.g., "commissioning," "shipping," "receiving"), dispositions (e.g., "in_transit," "in_progress"), and business contexts.

EDI (Electronic Data Interchange): A family of standards for exchanging business documents electronically between trading partners. While EDI predates the DPP concept, existing EDI infrastructure may be leveraged to collect and transmit some of the supply chain data needed for digital product passports.

Traceability: The ability to track and trace a product and its components through all stages of the supply chain, from raw material extraction to end-of-life. Technical traceability requires unique identification of products and components, standardised event recording (such as EPCIS), and systems capable of aggregating and presenting this data through the digital product passport.

Web Architecture and API Standards

REST (Representational State Transfer): An architectural style for web services that uses standard HTTP methods (GET, POST, PUT, DELETE) to interact with resources identified by URLs. RESTful APIs are the standard approach for DPP data access, enabling authorised systems to retrieve, create, and update passport data programmatically.

Content Negotiation: An HTTP mechanism that allows a server to return different representations of a resource based on the client's preferences. In the DPP context, content negotiation enables a single DPP URL to serve HTML for human users, JSON-LD for machine consumers, and potentially other formats as needed. When a consumer scans a QR code, they receive a user-friendly web page; when an API client requests the same URL with an appropriate Accept header, it receives structured data.

OAuth 2.0: An authorisation framework that enables third-party applications to access resources on behalf of a user without sharing credentials. OAuth 2.0 is relevant to DPP implementation for managing access to restricted data within passports, ensuring that only authorised parties (such as market surveillance authorities or accredited recyclers) can access sensitive information.

OpenAPI (Swagger): A specification for describing RESTful APIs in a machine-readable format. DPP platforms may publish OpenAPI specifications to document their APIs, making it easier for developers to integrate with the platform. Standardised API descriptions facilitate interoperability between different DPP systems.

Webhook: A mechanism for one system to notify another about events in real time by sending an HTTP request to a pre-configured URL. In DPP systems, webhooks can be used to trigger notifications when passport data is updated, when products pass through specific supply chain stages, or when compliance issues are detected.

Data Carrier Technologies

QR Code (Quick Response Code): A two-dimensional barcode that can encode text, URLs, and other data types. QR codes are the primary data carrier for ESPR digital product passports due to their widespread scanning support via smartphone cameras, high data capacity, error correction capability, and low production cost. When combined with the GS1 Digital Link standard, QR codes provide a versatile data carrier that supports both DPP access and point-of-sale scanning.

RFID (Radio Frequency Identification): A technology that uses radio waves to identify and track objects via attached tags. RFID tags can store unique identifiers and are readable without line-of-sight contact, making them suitable for supply chain tracking and potentially for DPP access in industrial settings. However, RFID readers are less ubiquitous than QR code scanners, limiting their utility as a consumer-facing data carrier.

NFC (Near Field Communication): A short-range wireless communication technology that enables data exchange between devices within approximately four centimetres. NFC tags can be embedded in products and read by NFC-enabled smartphones, providing an alternative or complement to QR codes for DPP access. NFC is particularly relevant for products where a visible QR code is undesirable or impractical.

Data Matrix: A two-dimensional barcode format commonly used in industrial and healthcare applications. Data Matrix codes can encode GS1 identifiers and may be used as DPP data carriers in contexts where they are already established, such as medical devices and electronic components. However, QR codes generally offer better consumer accessibility.

Digital Watermark: An imperceptible pattern embedded in product packaging or printing that can be detected by cameras. Digital watermarks are being explored as DPP data carriers for products where visible codes are commercially unacceptable, though the technology is less mature than QR codes or NFC for this application.

Security and Integrity Standards

TLS (Transport Layer Security): A cryptographic protocol that provides secure communication over the internet. DPP data must be transmitted over TLS-encrypted connections (HTTPS) to protect data integrity and prevent interception. All DPP URLs should use HTTPS to ensure that data accessed via QR codes or APIs is transmitted securely.

Digital Signature: A cryptographic mechanism that verifies the authenticity and integrity of data. Digital signatures can be applied to DPP data to prove that it was created by the declared economic operator and has not been tampered with. This is particularly important for regulated data such as conformity declarations and environmental performance claims.

Hash Function: A mathematical function that converts input data into a fixed-size output (hash). Hash functions are used in DPP systems to verify data integrity, ensuring that passport data has not been modified since it was created or last verified. Any change to the data produces a different hash value, immediately signalling potential tampering.

Verifiable Credentials: A W3C standard for issuing and verifying digital credentials in a decentralised manner. Verifiable credentials are being explored in the DPP context to enable trusted attestations about product attributes, such as certifications, test results, or supply chain claims, without requiring a centralised authority to vouch for every data point.

Understanding these technical standards enables businesses to make informed decisions about DPP implementation architecture and to evaluate whether technology solutions and platforms meet the interoperability requirements of the ESPR. As the DPP ecosystem matures, adherence to these standards will become increasingly important for seamless cross-border compliance. For practical implementation guidance, see our article on how to create your first digital product passport.

Emerging Standards and Future Directions

CIRPASS: The Collaborative Initiative for Digital Product Passports, an EU-funded project that is developing standards and guidelines for DPP implementation across multiple sectors. CIRPASS brings together industry stakeholders, standards organisations, and technology providers to create harmonised approaches to DPP data models, interoperability, and governance.

Asset Administration Shell (AAS): A concept from the Industry 4.0 initiative that provides a standardised digital representation of an asset (product, component, or system). The AAS framework is being explored as a potential basis for DPP implementation in industrial and manufacturing contexts, offering detailed technical interoperability for complex products.

Catena-X: An open data ecosystem for the automotive industry that enables secure data exchange across the supply chain. Catena-X includes digital product passport functionality and serves as a sector-specific implementation model that may influence DPP approaches in other industries.

Battery Passport: A digital product passport specifically for batteries, mandated by the EU Battery Regulation (EU) 2023/1542. The battery passport is one of the first DPP implementations to be fully specified in EU law and serves as a reference model for subsequent ESPR delegated acts. It requires detailed data on battery chemistry, performance, state of health, and recycled content.

ESPR Digital Product Passport Registry: The EU-level registry, open since 20 July 2026 under Implementing Regulation (EU) 2026/1778, that indexes and provides access to digital product passports across all product categories. The registry is designed to support market surveillance, customs enforcement, and cross-border data access. Its rules on registration, verification and access are set by Implementing Regulation (EU) 2026/1778 and significantly influence how DPP platforms integrate with EU infrastructure.

The technical standards landscape for digital product passports continues to evolve rapidly. Businesses should engage with relevant standards bodies and industry initiatives to stay current with developments and to influence the direction of emerging standards. For the latest on GS1 standards, visit the GS1 Digital Link specification page.