TL;DR
- There is no single list of Digital Product Passport data requirements yet. Annex III of the ESPR is a menu of twelve elements, and the delegated act for each product group picks which ones apply.
- Some data is already fixed for every ESPR passport: a unique product identifier, substances of concern where the delegated act requires tracking them, the manufacturer's and importer's contact details on the public part, the digital instructions, and the reference to the back-up copy.
- The battery passport, required from 18 February 2027, is the only fully specified list today, and it is the best preview of what the ESPR groups will look like.
Every "how to create a Digital Product Passport" search ends at the same question: what do we actually have to put in it? The honest answer is that Digital Product Passport data requirements depend on the product group. But the ESPR, Regulation (EU) 2024/1781, already fixes far more of the answer than its reputation suggests, and the parts it fixes are the ones that take longest to collect.
This guide sets out what the Regulation lists, what is already settled, how access is split between the public and everyone else, and what the battery passport shows in practice. Everything below is stated as of October 2026.
How the data list is built
The ESPR works in two layers. The Regulation sets the framework, and a delegated act for each product group sets the detail. Article 9(2) lists what each delegated act must specify for its passport:
- the data to include, chosen from Annex III
- the data carrier or carriers, and where they go
- whether the passport is at model, batch or item level
- how customers see it before buying, including online
- who can access which data
- who creates the passport and who can update it
- how long it stays available, which must be at least the product's expected lifetime
As of October 2026, no delegated act setting passport requirements for a product group has been adopted. The only delegated act published under the ESPR so far, Delegated Regulation (EU) 2026/296, deals with the destruction of unsold consumer products. The first product-group acts are expected from the 2025–2030 working plan: iron and steel, aluminium, textiles, furniture, tyres and mattresses.
The twelve elements in Annex III
Annex III is the full menu a delegated act chooses from.
| Annex III point | Data element | What it means in practice |
|---|---|---|
| (a) | Product information required by Article 7 or other EU law | Performance, repair and end-of-life information, and substances of concern |
| (b) | Unique product identifier | At model, batch or item level, as the delegated act sets |
| (c) | GTIN under ISO/IEC 15459-6, or equivalent | The product's trade item number, or its parts' |
| (d) | Commodity codes, such as TARIC | The customs classification |
| (e) | Compliance documentation | Declaration of conformity, technical documentation, certificates |
| (f) | User manuals, instructions, warnings, safety information | As required by other EU law for the product |
| (g) | Manufacturer information | Its unique operator identifier and contact details |
| (h) | Other unique operator identifiers | Suppliers, repairers and other actors in the chain |
| (i) | Unique facility identifiers | Factories and sites involved in the value chain |
| (j) | Importer information | Contact details and EORI number |
| (k) | The EU responsible economic operator | Name, contact details and operator identifier, under Article 4 of Regulation (EU) 2019/1020 or Article 15 of the GPSR |
| (l) | The passport service provider | Reference to the provider hosting the back-up copy |
Annex III also lets a delegated act identify voluntary information a manufacturer may add, including voluntary labels and whether the product holds an EU Ecolabel. That is the one part of the passport where marketing and compliance meet, and voluntary environmental information shown to consumers is still subject to the EU rules on green claims.
What is already fixed for every ESPR passport
Several items do not wait for a delegated act, because the Regulation itself requires them.
A persistent identifier and a data carrier
Article 10(1) requires every passport to be connected through a data carrier to a persistent unique product identifier, with the carrier physically present on the product, its packaging or accompanying documentation. Annex III names the standards for the carrier and identifiers: the ISO/IEC 15459 series. That is the family GS1 identifiers, including the GTIN, are built on.
Substances of concern
Article 7(2)(a) makes the passport and substances of concern the minimum content of the information requirements. Where tracking applies, Article 7(5) sets out what to record:
- the substance's name: IUPAC name, other names, EC number and CAS number where available
- its location within the product
- its concentration, maximum concentration or concentration range, at product, component or spare-part level
- instructions for safe use
- information for disassembly, reuse and recycling at end of life
The definition of a substance of concern in Article 2(27) is wider than REACH's candidate list. It includes classified carcinogens, mutagens and reproductive toxicants, endocrine disruptors, persistent and bioaccumulative substances, sensitisers, substances regulated under the POPs Regulation, and any substance that negatively affects reuse or recycling of the materials in the product. Delegated acts can grant exemptions, but not for candidate-list substances present above 0.1% weight by weight.
For most manufacturers this is the slowest data to gather, because it sits several tiers down the supply chain.
Contact details on the public part
Article 27(6) requires the manufacturer's name, trade name or trade mark, postal address and electronic contact on the public part of the passport. Article 29(3) requires the same from the importer.
Digital instructions
Article 27(7) requires covered products to come with digital instructions, and where a passport exists the manufacturer includes them in the passport. They must be downloadable and stay online for the product's expected lifetime, and in any case for at least ten years. Safety information still has to be supplied on paper.
Technical documentation
Where the Commission requires parts of the technical documentation to be made digitally available, Article 36(3) states that it is made available through the passport.
The back-up copy
Article 10(4) requires a back-up copy of the passport with a digital product passport service provider, and Annex III point (l) adds the reference to that provider to the data.
Model, batch or item
Article 10(1)(f) requires the data to refer to the product model, batch or item, as the delegated act specifies. The choice changes the data model entirely.
- Model level: one passport per product model. The data is the same for every unit, and the identifier can be the GTIN. The toy passport under Regulation (EU) 2025/2509 works this way.
- Batch level: one passport per production batch, which suits data that varies between runs, such as recycled content or origin.
- Item level: one passport per individual unit, needing a serial number and data that can change over the unit's life. The battery passport combines model data with item-level data.
A GS1 Digital Link URI can express all three, by carrying the GTIN alone, the GTIN with a batch or lot, or the GTIN with a serial number.
Who sees what
A passport is not one public page. Article 11(b) gives customers, economic operators, repairers, refurbishers, recyclers, authorities, civil society organisations, trade unions and other relevant actors free and easy access based on their respective access rights, and Article 9(2)(f) leaves the delegated act to decide which actor sees which data.
Three further rules shape the design:
- No customer personal data without explicit consent (Article 10(1)(e)).
- Write access is restricted according to the access rights in the delegated act (Article 11(f)).
- Data must be authenticated, reliable and secure, and the passport designed to prevent fraud (Article 11(g) and (h)).
This is how confidential data stays confidential. Detailed composition, supplier identities and test reports can sit in the passport without being public, visible only to the actors the delegated act names.
What the battery passport shows
The Battery Regulation, Regulation (EU) 2023/1542, is the first passport with a complete data list and a hard date: from 18 February 2027 for every LMT battery, every EV battery and every industrial battery over 2 kWh. Annex XIII splits the data into four access tiers.
| Tier | Who can see it | Examples of the data |
|---|---|---|
| 1. Public, battery model | Everyone | Material composition, chemistry, hazardous substances, critical raw materials, carbon footprint, due diligence, recycled and renewable content, capacity, voltage, expected lifetime, warranty, declaration of conformity |
| 2. Legitimate interest, battery model | Repairers, remanufacturers, second-life operators, recyclers, the Commission | Detailed composition of cathode, anode and electrolyte, part numbers, dismantling information, safety measures |
| 3. Authorities, battery model | Notified bodies, market surveillance authorities, the Commission | Test reports proving compliance |
| 4. Legitimate interest, individual battery | As tier 2 | Performance and durability values, state of health, status (original, repurposed, re-used, remanufactured, waste), usage data such as charging cycles and negative events |
Three things in that list are worth carrying into any ESPR project. Most of the effort sits in supply chain data, not in the page itself. The access split is fundamental to the design, not a later addition. And item-level data changes over the product's life, so the passport has to be updatable without reprinting anything.
What also goes to the EU registry
Separate from the passport, Article 13 requires the Commission to run a registry that stores at least the unique identifiers, plus the commodity code for products released for free circulation. The economic operator placing the product on the market uploads that data and receives a unique registration identifier in return.
The registry is not the passport. It holds the identifiers that let customs and market surveillance authorities find and check passports, while the passport itself stays with the economic operator or its service provider. Who that operator is depends on your role, which we cover in who is responsible for the Digital Product Passport.
How the data has to be structured
Article 10(1)(d) sets the format rules. All passport data must be:
- based on open standards
- in an interoperable format
- as appropriate, machine-readable, structured and searchable
- transferable through an open interoperable data exchange network without vendor lock-in
A PDF behind a QR code does not meet that description. The data has to be usable by software as well as by people, which is also why the CEN and CENELEC DPP standards focus on identifiers, data exchange and interoperability.
What to collect now
The delegated acts will set the final list, but most of the data they can ask for is already known. The useful work is collecting it.
- Identifiers first. A GTIN or equivalent for every product, a unique operator identifier for your company, and facility identifiers for your sites. These appear in every passport and never change.
- Compliance documents in one place. Declarations of conformity, technical documentation and certificates, digitised and linked to the product they cover.
- Substances of concern. Ask suppliers now for names, CAS numbers, locations and concentrations. This is the data that takes longest to obtain.
- Digital instructions. Use, maintenance, repair and end-of-life instructions in a downloadable format, in the languages of your markets.
- Decide the level. If your products may need batch or item passports, check that your packaging lines can print a serialised or batch-level code.
- Plan the access tiers. Sort your data into what can be public, what only repairers and recyclers should see, and what only authorities should see.
Digital Link is a GS1 solution partner, and our platform builds standards-based product passports across industries: a persistent identifier per product, a GS1 Digital Link QR code as the data carrier, and a page behind it that can be updated without reprinting anything, with public and restricted data kept separate. If you want to map your product data against Annex III before your delegated act lands, get in touch and our legal team will review your case.
Frequently asked questions
What data must a Digital Product Passport contain?
It depends on the product group. Annex III of the ESPR lists twelve elements, including a unique product identifier, a GTIN, commodity codes, compliance documentation, instructions, manufacturer and importer information and operator and facility identifiers, and the delegated act for each group selects which apply. Some items, such as the manufacturer's contact details and the digital instructions, are already required by the ESPR itself.
Is there an official DPP data template?
Not for ESPR product groups yet. As of October 2026, no delegated act setting passport requirements for a product group has been adopted. The battery passport in Annex XIII of the Battery Regulation is the only complete official list today.
Does the DPP have to include the GTIN?
The GTIN is one of the elements Annex III lists, under ISO/IEC 15459-6 or an equivalent, and the data carrier and identifiers must follow the ISO/IEC 15459 series. Whether it is mandatory for a product group depends on the delegated act.
Is all DPP data public?
No. Access is set by actor in each delegated act. The battery passport shows the pattern: public model data, more detailed data for repairers and recyclers with a legitimate interest, test reports for authorities only, and individual battery data restricted.
Does the DPP include personal data?
Personal data relating to customers cannot be stored in the passport without their explicit consent, under Article 10(1)(e) of the ESPR.
What is the difference between the DPP and the EU registry?
The registry, run by the Commission, stores at least the unique identifiers and, for imports, the commodity code. The passport, with the full data, is stored by the economic operator or its passport service provider.
Are substances of concern part of the passport?
Yes, where the delegated act requires them to be tracked. Article 7(5) sets out the data: name and identifiers, location in the product, concentration, safe use instructions, and end-of-life information.
