OpenDPP
Sign in Book a demo
How it works

How Does the EU Digital Product Passport Work?

· 6 min read

Last reviewed

Line drawings of a t-shirt, a phone, a steel beam and a car battery arranged around a glowing blue gemstone, each joined to it by circuit-board tracks, on a pale blue background.

Knowing what the Digital Product Passport is doesn't tell you much about how it actually functions day to day — how the data is stored, who can see what, and what happens when someone scans that QR code on a product. This post walks through the mechanics, based on the European Commission's official DPP FAQ. If you haven't read our overview of what the DPP is yet, that's a good starting point before this one.

The core mechanism: scan a data carrier, reach the data

Every product with a DPP has a data carrier — most commonly a QR code, though other technologies (NFC chips, for example) are being assessed — attached to the product, its packaging, or its accompanying documentation. Scanning it links you to that specific item's passport.

There are also two alternative access routes:

  • The EU DPP Web Portal, a planned public interface where consumers and businesses can search and compare product information without needing the physical item in hand.
  • Online marketplaces, which will be required to surface DPP information directly on the product listing page.

For consumers without a smartphone, the Commission expects a mix of fallback options: in-store kiosks or tablets, staff assistance at customer service desks, or a printed copy on request.

Centralised registry, decentralised data — how that split works

This is the part that trips people up: the DPP is neither fully centralised nor fully decentralised — it's a hybrid.

  • The EU DPP Registry is centralised. It doesn't store the actual product data — it stores each product's unique identifier and a pointer to where the real data lives.
  • The detailed product data itself is decentralised — hosted by the economic operator directly, or by a specialist DPP service provider on their behalf.

This structure means individual businesses keep control of and responsibility for their own data, while the registry gives customs authorities, market surveillance bodies, and eventually the public a single, reliable place to check that a valid DPP exists for a given product.

Independent of who hosts the primary data, the regulation also requires a back-up copy through a separate, independent DPP service provider, so the passport remains accessible even if the original operator goes out of business.

As of 20 July 2026, the European Commission has launched the DPP Registry along with a testing environment, giving businesses a real system to start registering against — Commission Implementing Regulation (EU) 2026/1778 sets out the technical rules for access management, user verification, and data registration in the Registry.

How it works for each type of user

Economic operators (manufacturers, importers, distributors, authorised representatives, fulfilment providers) are responsible for compiling the product data, registering the unique identifier in the Registry, attaching the physical data carrier, and keeping the data accurate for as long as the product is expected to be in use.

Consumers scan the data carrier — or search the web portal — to see product information before buying, and can return to the same passport later for manuals, maintenance guidance, or end-of-life instructions.

Customs and market surveillance authorities query the Registry to confirm a valid DPP exists before releasing an imported product for free circulation, and can scan a product's data carrier directly during compliance checks. The automated customs interconnection is required to be operational within four years of the relevant implementing act entering into force.

Repairers, refurbishers, and recyclers can pull disassembly instructions, compatible spare parts lists, and diagnostic information (where those fields are required for the product) to make repairs faster and cheaper — and recyclers can identify material composition, including recoverable critical raw materials and substances that need special handling.

Interoperability: why every DPP "speaks the same language"

None of this works if every manufacturer's DPP is structured differently. To prevent that, the Commission issued a standardisation request to the European Standardisation Organisations (CEN, CENELEC, and ETSI), whose joint technical committee (JTC 24) is developing eight harmonised standards covering:

  • Unique identifiers for products, operators, and facilities
  • Data carriers and the product-to-data link
  • Access rights, information security, and data protection
  • Technical, semantic, and organisational interoperability
  • Data exchange protocols and formats
  • Long-term data storage and archiving
  • Data authentication and integrity
  • APIs for managing a DPP across its lifecycle

Six of these have been published by the European standardisation bodies and cited in the Official Journal; the remaining two are still final drafts at formal vote.

Privacy: what the DPP does and doesn't collect

The DPP is built around product data, not personal data. "Privacy by design and by default" is a core principle: general access to a product's passport is anonymous, no personal identification is needed, and personal customer data isn't stored in a DPP by default. The only exception is if someone explicitly, and in full compliance with GDPR, consents to linking their personal data to a passport for a specific purpose.

Sources

This article reflects publicly available EU guidance current as of August 2026 and is not legal advice.

Questions people ask

Can extra, non-mandatory data be added to a DPP?
Yes — voluntary data points are allowed as long as they don't compromise data accuracy, interoperability, or the passport's core functionality, and as long as they're clearly separated from the mandatory fields.
Who actually verifies that the data in a DPP is accurate?
Verification is layered: Market Surveillance Authorities in each Member State check data accuracy as part of standard enforcement, customs performs an automated check at the border that a valid, unique registration exists, and manufacturers are required to provide a channel for consumer complaints — with consumers able to claim compensation for damages caused by non-compliant products.
Does the DPP create a barrier to trade for non-EU sellers?
The Commission's position is that it doesn't, since the requirements apply in a non-discriminatory, proportionate way under WTO rules. Products imported into the EU need a DPP if the product category requires one, and online marketplaces selling into the EU are expected to make that information accessible.

Read next

A tablet lying flat on a white desk beside a window, its screen showing a large blue and teal QR code with the OpenDPP wordmark beneath it.
Regulation

What Is the EU Digital Product Passport? The Complete Guide

6 min read

A translucent battery icon marked with the EU flag's ring of stars sits at the center, with blue and teal circuit-board style lines flowing into it from both sides against a light blue background, symbolizing data flowing into the EU digital battery passport.
Batteries

What Data Goes Into the EU Digital Battery Passport?

6 min read

An isometric illustration of a winding path running between office buildings, past gears, a processor and a stack of servers, ending at a raised platform where an arrow curves upward out of a glowing block.
Implementation

Digital Product Passport Implementation: Step-by-Step Guide

6 min read