can I request a confidentiality agreement from my supplier regarding passport data

What you must do concretely

What is expected of you

You can request a confidentiality agreement from a supplier, and in practice this also happens regularly as soon as passport data leaves your premises to a platform like ours or to another party in the chain. The ESPR (Regulation (EU) 2024/1781) regulates which data must be included in the digital product passport and who must supply it, but the regulation contains no provision that requires or prohibits a confidentiality agreement. This is therefore a commercial arrangement between you and your supplier, separate from the passport obligation itself.

Supply of data by the supplier

Article 38 of the ESPR describes what actors in the supply chain are expected to do when it comes to making information available for the product passport. For a company of 10 to 100 employees, this means in practice that a supplier provides data on materials, composition, origin or other characteristics needed to complete the passport. That data can be commercially sensitive: a recipe, a specific alloy, a supplier of a critical component. Requesting a confidentiality agreement therefore does not affect the obligation to provide, but the manner in which it is done.

Compiling the digital product passport

Article 10 of the ESPR describes the requirements that the digital product passport must meet, including the accessibility of data for different parties such as supervisory authorities, consumers or recyclers. This means that some of the data a supplier provides will ultimately become visible to third parties via the passport. For a company that has the passport compiled, it is therefore relevant to discuss in advance with the supplier which data will be included in the passport and which data is only needed internally to correctly complete that passport. A confidentiality agreement typically concerns that second category: the underlying data that does not appear in the passport itself, but is necessary to ensure correct compilation.

Import obligations

Article 29 of the ESPR describes the obligations of importers, including verifying whether the passport is present and correct before a product is placed on the EU market. For companies that manufacture or assemble with components from outside the EU, this plays a role: the importer typically needs more data from a foreign supplier than just what appears in the passport, in order to carry out that verification. For more information on this, background information can be found at what the product passport means when importing from outside the European Union. In this relationship too, a confidentiality agreement is a common instrument to protect sensitive technical or commercial information without hindering the data supply itself.

Where things go wrong in practice

A supplier refuses to provide data, arguing that the information is confidential, while no confidentiality agreement has ever been requested. The conversation then becomes about "supply or no supply", whereas the actual question is "under what conditions". See also what to do if a supplier does not provide the data.

A confidentiality agreement is only brought up after the purchasing agreement has been concluded, when the supplier has already shared data. This has the opposite effect: the agreement then has no control over what has already been exchanged.

A company requests a general confidentiality agreement without specifying which data is involved. The supplier signs something vaguer than necessary, or conversely something that restricts their own ability to compile the product passport.

No distinction is made between data that appears in the product passport itself — and is therefore by definition accessible to third parties — and data that is used only internally. A confidentiality agreement stating that "all data" is confidential then contradicts what the product passport must publicly disclose according to Article 10 of the ESPR.

For a supplier providing components for multiple product groups simultaneously, one confidentiality agreement is used for all data flows, even though the sensitivity and applicable product passport requirements may differ per product group. Those working with such a supplier can read further at a supplier that provides components for different product groups.

What you can document

• A confidentiality agreement (NDA) that specifically names which categories of data fall under the confidentiality clause, and which data are intended to appear in the product passport and are therefore not confidential.
• A provision in the purchasing contract regarding the supply of product passport data, including a reference to the confidentiality agreement as a separate document. A worked-out example can be found at agreements on the supply of product passport data in the procurement contract.
• An overview of exactly which data are needed from the supplier, so that the confidentiality agreement is not broader than necessary. See which data are requested from the supplier.
• An agreement on what happens to the confidentiality agreement when changing suppliers, so that old agreements do not continue to apply in a way that no longer suits the new situation. Relevant at the change of supplier during use.
• A procedure to verify the accuracy of supplied data before they enter the product passport, so that a confidentiality agreement does not hinder a proper check. More information on this at verifying data for accuracy.
• When using multiple suppliers for the same component: an agreement per supplier, rather than one document applied in the same way for everyone. Background information on this can be found at multiple suppliers for the same component.