What's in a Digital Product Passport? The System Below the Surface Explained

This article is an appendix to the latest updates of the Unlocking DPP Playbook, released 20 October 2025.

At a glance, the Digital Product Passport (DPP) might look like a simple QR code linked to consumer information. But that’s only the tip of the iceberg.

What sits below the surface of the consumer interface is far more complex: a secure, standards-aligned system that supports compliance with the EU’s Ecodesign for Sustainable Products Regulation (ESPR). As the deadline for implementation draws closer each year, brands must begin building this system now for sustainable compliance.

This article outlines the four essential layers of a DPP system and provides the latest regulatory updates including the draft standards (prEN) on data access, governance, and standards. It’s intended to help Sustainability and Compliance Managers align with their IT partners and teams.

The Four Layers of a DPP System

A legally compliant Digital Product Passport is made up of four interconnected components:

1. Product Data
2. Data System
3. Unique Product Identifiers
4. Persistent Data Carriers

Each of these layers is governed by evolving EU regulations and technical standards. These layers work together to create a functional, secure, and scalable DPP — one that can hold up to regulation, market expectations, and technological change.

Product Data: The Compliance Foundation

At the center of every DPP is the product-level data required by the ESPR. Without data you will have no label. This includes:

• Material composition
• Recycled content
• Durability and reparability
• Energy use
• Substances of concern
• End-of-life guidance

For compliance managers, the challenge is twofold: ensuring the right data is captured from suppliers, and confirming that it can be traced to the correct individual item.

For textiles, the exact list of required data will be set in the Delegated Act, expected by end of 2027. Brands using TrusTrace today are already capturing many of these fields in preparation for that milestone. TrusTrace was previously part of the Trace4Value pilot which determined 125 likely data points in the data protocol.

Data System: Secure, Interoperable, and Built to Scale

Capturing product data is not enough. It must also be structured, secured, and exchanged using systems that meet European technical standards.

A compliant data system must support:

• Role-based access (public vs. restricted)
• Secure data exchange using OAuth 2.0, HTTPS, and DIDs
• System interoperability with ERP, PLM, and traceability platforms
• Lifecycle data management, including archiving and auditability

How this data should be "formatted, transmitted, secured, or made interoperable" are defined in draft prEN 1821X series. Further explained in the Access and Governance section to follow:

• Unique identifiers (prEN 18219)
• Data carriers (prEN 18220)
• Access rights and confidentiality rules (prEN 18239)
• System interoperability (prEN 18223)
• Data exchange protocols (prEN 18216)
• Data storage, archiving and persistence (prEN 18221)
• Data storage authentication, reliability, and integrity (prEN TBD)
• Lifecycle APIs for lifecycle management and searchability (prEN 18222)

For IT leaders, this means preparing infrastructure that can adapt to regulatory complexity — not just to display data, but to manage it over time with precision and control.

TrusTrace is built with these requirements in mind, supporting automated data exchange, strong access controls, and traceability.

Unique Product Identifiers: Linking Product and Evidence

Each DPP must be assigned to a unique identifier which means it can distinguish between a specific item – yes, item – and its associated data throughout the supply chain and lifecycle.

Standard prEN 18219 guides how these identifiers are assigned across products, facilities, and economic operators. Having an identifier enables:

• End-to-end traceability
• Product claim validation
• Regulatory reporting
• Transparency across stakeholders

Identifiers form the invisible thread that ties together physical product, digital record, and compliance trail. TrusTrace enables traceability by connecting transaction certificates, production steps, and purchase orders.

Persistent Data Carriers: The Access Point

The DPP must be attached to the product using a durable, interoperable identifier such as an NFC chip, RFID tag or QR Code. But the carrier is just an interface. For it to be meaningful, it must link to the correct data set and remain durable across a product’s lifecycle.

Draft standard prEN 18220 outlines technical requirements for these carriers, including encoding, durability, and compatibility across digital systems. TrusTrace enables generation and assignment of such carriers, and is proven to scale – one of our clients generated over 6000 IDs in the preliminary pilot together with The Swedish School of Textiles.

Sustainability teams may view this as a tool for transparency, or even marketing. For compliance and IT teams, it is a mechanism for data access, auditability, and assurance.

Data Access and Governance

Defined Tiers and Legal Controls

The ESPR outlines two levels of DPP data access:

• Public data: Freely available to consumers, without authentication
• Restricted data: Available only to designated authorities such as market surveillance, customs, or repair professionals

The governance model for this access is defined in prEN 18239, which supports two possible approaches:

• A central EU registry
• A decentralized model managed by Responsible Economic Operators (REOs) and certified backup providers

Additionally, secondary use of DPP data (i.e. for resale, analytics, or third-party services) will require explicit, informed consent to protect privacy and business confidentiality.

This means IT and compliance teams must account for access control, consent tracking, and data sharing protocols from the start.

What vs. How: The Role of Technical Standards

ESPR defines what data needs to be included in a DPP whilst CEN defines how this data should be formatted, transmitted, secured, or made interoperable. The standards are currently being developed by CEN and CENELEC under a European Commission mandate (M/604), due March 31st, 2026.

Once published in the Official Journal of the EU, the standards will carry legal weight as harmonized standards — offering a presumption of conformity under the ESPR.

Where Gaps Remain for Textiles

While many technical areas are well-defined, CIRPASS and other analyses have identified several missing or incomplete standards, particularly in the textile sector.

Current gaps include:

• Durability and repairability
• Recycled content verification
• Carbon and environmental footprint
• Substances of concern
• Reusability and recyclability

The EN 4555x standard series — originally developed for energy-related products — is expected to expand to cover these requirements. However, full alignment for textiles will depend on forthcoming Delegated Acts.

For brands, this uncertainty reinforces the need for systems that can adapt to evolving data models. TrusTrace supports configurable workflows to adapt to evolving standards.

CIRPASS & CIRPASS-2: Shaping the Real-World Framework

CIRPASS (2022–2024) laid the groundwork for DPP system architecture and stakeholder use cases. Its follow-up project, CIRPASS-2 (2024–2026), is now piloting DPP implementation across real-world environments.

Key focus areas include:

• Testing DPP registries
• Standardizing visual symbols for consumers
• Supporting SME readiness
• Mapping sector-specific data flows
• Exploring user experience and label design

These pilots are critical for shaping how DPPs will function at scale and offer valuable insights for brands currently in the planning or piloting phase.

TrusTrace incorporates learnings from working groups and our customer pilots into our DPP solution (LINK) and continuous development.

Recommendations: From Pilot to Scalable Platform

The year 2027 will come sooner than you think. To prepare for full-scale DPP implementation, cross-functional teams (sustainability, sourcing, compliance and IT) should take the following actions:

1. Download the Updated Unlocking DPP Playbook
   Understand what’s required, updated standards and timelines with the playbook (Updated October 2025)
   
   
2. Align Systems with Technical Standards
   Evaluate your digital architecture against the prEN 1821X series. Pay particular attention to data exchange, access control, and persistence.
   
   
3. Audit Your Product Data Landscape
   Identify which data points you already collect — and where gaps remain based on likely ESPR requirements. Check this against the DPP Data Protocol.
   
   
4. Map Roles and Responsibilities
   Ensure compliance, sustainability, and IT teams are working from a shared roadmap. DPP is not a single-team initiative. Together The Data Advantage and the TrusTrace Compliance Canvas resources form a solid foundation for data readiness.
   
   
5. Pilot With Purpose
   No matter how much or little of the DPP data you have, get started. Initiate pilots to test everything that leads up to the consumer-facing experiences including the supplier onboarding, data workflows, operational readiness and access governance.

Conclusion: What’s Below the Surface Matters Most

A DPP is a system, not a stamp. TrusTrace helps you build what sits beneath the proverbial iceberg. Prepare for DPP compliance with confidence by leveraging our proven framework and marketing leading end-to-end solutions. Check out TrusTrace for DPP Readiness today.