Do I have to make business-sensitive data about my products public?
Not everything in the digital product passport needs to be public
No, not every piece of data about a product needs to be visible to everyone. The ESPR (Regulation (EU) 2024/1781) is based on a digital product passport with different access layers: some information is accessible to everyone via the QR code, while other information is only available to specific parties such as competent authorities, other economic operators further down the supply chain, or repairers. This approach is precisely designed to accommodate situations where a manufacturer or importer has data that is commercially sensitive or protected by intellectual property rights. The Regulation requires transparency about the product, not disclosure of every underlying business secret.
Who this applies to, and what it does not
This distinction is particularly relevant for manufacturers and importers who provide data that goes beyond what a consumer needs to understand a product: recipe, composition details, supplier information or production processes. For that type of data, the digital product passport structure provides the possibility to keep them outside the publicly accessible part. This is not a free pass to withhold core information: data that the Regulation and the product-specific implementing rules designate as mandatory and public — such as data on sustainability, repair or recyclability that the consumer needs — do not fall under this. The distinction therefore is not based on 'I want to share this' but on 'which stakeholder group is this data intended for and what role does it play in the supply chain'. Actors in the supply chain may furthermore be obliged to provide certain information to other economic operators or to competent authorities, even if that information is not visible to the general public.
What is already established and what still needs to be determined
A fixed date for implementation in a specific product group is not the focus here — that will be regulated separately for each product group via delegated acts. What is established is the principle from the ESPR itself: the digital product passport is designed in such a way that access can be differentiated, with attention paid to the protection of confidential business information. The specific rules — which data becomes public and which data remains restricted — will be laid down for each product group in the implementing rules that are still to come or have already been adopted. Until such rules exist for a specific product group, there is no obligation to have a digital product passport and therefore no concrete choice to make about what becomes public.
How to approach this in practice
It is advisable to start by making a distinction between two types of data: data that the product-specific rules will designate as mandatory and public, and data that you only provide because it is relevant for supervision, repair or the rest of the supply chain. For the first category there is little choice — that information goes into the publicly accessible part of the digital product passport, regardless of whether that information feels commercially sensitive. For the second category it is worthwhile to check which access levels the implementing rules for the relevant product group allow, and to tailor the submission of data accordingly: what goes into the publicly visible part, and what can remain limited to, for example, competent authorities or professional parties in the supply chain. If you are in doubt about a specific data item, it is advisable to consult the implementing act of your own product group, as it will state which fields are mandatory public and which are not. If you are submitting data for a digital product passport and notice that part of it is intended to be confidential, it is good practice to mark this explicitly when compiling the digital product passport, so that this distinction is not accidentally lost during hosting and display of the data.
Based on: Article 10 and Article 38 of the ESPR
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes the requirements that the digital product passport must meet, including scope for differentiated access to data for different user groups — an approach necessary to enable both transparency and protection of confidential business information. Article 38 regulates the requirements for actors in the supply chain, including the way information is shared between market participants and towards supervisory authorities, without this being equivalent to disclosure to the general public. Both articles leave the concrete implementation per product group to subsequent, product-specific legislation.
What to do with this information
Anyone preparing a passport now is best advised to record per data point whether it is intended for the public, for the supply chain, or for supervision — and to include that classification when submitting the data. Once the implementing rules for the relevant product group are known, it can be checked whether that classification matches what is marked as mandatory public disclosure there. For cases where doubt remains about the status of a specific data point, the official text of the implementing act in question is the appropriate place to verify this.
Where this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 38 (requirements for actors in the supply chain)
The regulation itself is on EUR-Lex. We provide references for each claim; you do not have to take our word for it.
What you must do concretely
What is expected of you
Distinguishing between what must be in the product passport and what must not
The ESPR determines in Article 10 which categories of data a product passport can in principle contain, but not every piece of information known about a product automatically belongs in it. The precise list of mandatory data fields is established per product group in a delegated act — see what is a delegated act and why does it determine what I must do. For a company with 10 to 100 employees, this mainly means: checking which fields are mandatory for their own product group, and not sharing more data out of caution than is requested. What specifically is expected in the passport is described on which data goes into the product passport of products.
Taking into account differentiated access
Article 10 of the ESPR provides for the possibility that not everyone receives the same data from the passport: consumers, market actors and supervisory authorities may each have a different access level. For a company, this means that the classification of data is not "everything public" or "everything confidential", but that intermediate forms exist in which certain information is available, for example, to a market authority, without being publicly visible. Which party receives which level is set out on who may view which data from the product passport. That distinction is relevant when setting up the passport: it is not automatic that data sent to a supervisory authority also goes to the end user.
Making data available to actors in the supply chain
Article 38 of the ESPR addresses the obligations of actors in the supply chain, and regulates, among other things, that certain information must be exchanged between parties in that chain in order to compile and maintain the passport. For an importer who sources components or raw materials from a supplier, this means that agreements are needed on which data that supplier provides, and in what form. This is a different flow than the data that ultimately appears publicly in the passport — this concerns data that is needed between companies to fulfil the obligation.
Assessing what "commercially sensitive" precisely means for a piece of data
Not every piece of data that a company prefers not to share is automatically a trade secret within the meaning of the regulations. A recipe, a specific supplier, or a production method may be sensitive, but whether that data is actually requested in the passport depends on the data fields established for the product group. For a company it is practical to assess for each requested field: is this technical data needed for repair, recycling or compliance, or is this business information that does not fall under the mandatory fields.
Where things go wrong in practice
A manufacturer fills in the passport too extensively, for fear of forgetting something, and also includes internal specifications in a field that is visible to the public — although that data was never requested.
An importer refuses to provide a supplier with data needed to compile the passport, because that data is considered confidential internally, without investigating whether a form of exchange is possible that respects confidentiality.
A company assumes that all data in the passport is visible to everyone, and therefore restricts the amount of data out of caution — with the result that mandatory fields, such as information about repair or components, remain incomplete. What is specifically expected there is on do I need to include information about repair and parts in the product passport.
Two companies in the same chain have no agreement on who provides and maintains which data, so when there is a change in the composition of a component, no one knows who should update the passport. How often and by whom this must be done depends on the question on how often must I update the data in the digital product passport.
A company assumes that data on recycling is automatically business-sensitive because it says something about material use, whereas this is precisely a category often expected in the passport — see what information about recycling must I include in the product passport.
What you can document
- An overview per product group of which data fields are mandatory, and which of these may be sensitive for the company.
- An internal decision rule: who within the company assesses whether requested data can qualify as a trade secret, and on what basis.
- Agreements with suppliers on which data they provide, in what form, and with what level of confidentiality — this can be documented in a supplier agreement or data clause.
- A record of which access level to the passport each party in the chain receives, aligned with the classification resulting from Article 10 of the ESPR.
- A log of changes to the data in the passport, including who made the change and why — also practical for a later correction, as described on I have discovered an error in a product passport that is already online what now.
- An internal template for assessing whether a product is subject to the obligation at all, as a basis for the rest of the process — see does the digital product passport apply to my products.
This is not legal advice. This page provides general information about the regulations that this platform concerns. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI on the basis of the sources above, checked by a human on 2026-08-22. Is something incorrect? Let us know — corrections are given priority.