Short answer: usually not, sometimes yes
The regulation for digital product passports and the GDPR are two separate rules that exist alongside each other. A product passport is fundamentally about the product: materials, origin, repair information, conformity. These are not personal data, so the GDPR does not apply to them in principle. The GDPR becomes relevant as soon as data of a natural person ends up in or around the passport, for example a name, a contact address of an installer, or data about who has carried out maintenance.
For most SMEs, the detail is therefore not in the question of whether the GDPR applies to the product passport itself, but in the question of which separate data are included when assembling it. Those who want to have this in order per product group will find an overview in the knowledge base with explanation per subject.
What typically appears in a product passport
The product passport regulation prescribes which product properties must be visible to the next link in the chain: recyclers, supervisory authorities, sometimes the consumer. This concerns matters such as composition, sustainability characteristics, repair options and documentation that belongs to the product. This is information about the object, not about a person, and thus falls outside the scope of the GDPR.
Where personal data does come into view
In a company's practice, overlap sometimes occurs. Think of a passport for an installation in which the email address of the contact person at the installer is included, or of a maintenance logbook in which the name of a technician appears. As soon as such data can be linked to a person, the rules that already applied before there was a product passport apply to them: a legal basis for processing, a retention period, and clarity about who may access the data. The product passport regulation does not add new rules for this; it simply runs alongside the GDPR.
This is also why it is wise when assembling a passport to determine in advance which fields are purely product-technical and which affect a person. Companies that work this out themselves most often come up against this question with passports in which a contact person or guarantor is named instead of just the company.
How supervisory authorities view this
Supervision of the product passport and supervision of the GDPR fall under different bodies in the Netherlands. The supervisory authority for the product passport looks at the content and timeliness of the passport itself; the Authority for Personal Data looks at the processing of personal data, regardless of whether it is in a product passport or elsewhere. Both supervisory authorities can in theory look at the same file, but from a different perspective. For the precise demarcation and for questions about a specific situation, the competent supervisory authority or a lawyer is the appropriate contact; this article only describes how the regulations relate to each other.
What this means for the choice of platform
Because a product passport is hosted for ten years and remains accessible via a QR code, it is important that a platform clearly explains how data are stored and who has access to it, especially if a name or contact detail does end up in a passport. How prodpas.eu handles this is described on the page about security and data handling.
When drawing up a passport, it is practical to first determine which product group is applicable and which data belong to it, before the question of personal data is addressed. You can get an initial impression of this by seeing in a few questions where your company stands. If you still have doubts about a specific case after reading this article, you may find an answer on the page with frequently asked questions or this is the moment to ask the supervisory authority or your legal adviser.
Do you first want to get an overview of what exactly needs to be arranged for your products before you delve into the interaction with other rules? Then take the free quick-scan or read further at your leisure in the knowledge base; both require no account and no obligation.