My Suppliers Are in Asia and Are Not Subject to EU Regulations: How Can I Obtain the Data Required for the DPP?
This is the question asked by anyone operating with a global supply chain — which is most companies. The short answer is: your non-EU suppliers are not required to comply with the ESPR Regulation or Digital Product Passport requirements, but you are. And this completely changes the nature of the problem.
Who Is Responsible for the DPP — and Where
The ESPR Regulation applies to anyone placing a product on the European market, regardless of where it was manufactured. If you import a finished product from China, Bangladesh, or Mexico and sell it in Europe, you — as the importer — are the party legally responsible for ensuring that the product has a valid, compliant, and verifiable Digital Product Passport (DPP).
The same principle applies to companies importing semi-finished goods or components from outside the EU that are used in products assembled in Europe: the sustainability data of those components must be included in the DPP of the final product, and the responsibility for collecting that supply chain data lies with the European manufacturer.
In both cases, the Regulation is clear: the economic operator placing the product on the EU market assumes full responsibility for Digital Product Passport compliance, ESG data quality, and product traceability obligations.
This means the issue is not regulatory, but contractual and operational. Your non-EU supplier is not legally obliged by European law to provide sustainability data. But you are obliged to have it in order to sell products in Europe under future DPP requirements. The logical consequence is that this becomes a condition of the commercial relationship: those who do not provide the data cannot remain in the supply chain.
This dynamic is neither new nor theoretical. It is already shaping global supply chains in the most advanced sectors. Large textile brands, through standards such as ZDHC; automotive manufacturers, through ecosystems like Catena-X; and major retailers, through their own qualification requirements, are already rewriting supplier contracts by making data disclosure a condition for remaining a qualified supplier. The ESPR global supply chains will simply extend this logic — with regulatory force — to many more sectors.
The Multiplier Effect: You Are Not the Only One Asking
There is a second mechanism that partially mitigates the issue, and it is worth understanding within the broader European sustainability regulation landscape. The Corporate Sustainability Due Diligence Directive (CSDDD) requires large European companies to ensure the sustainability of not only their own operations, but also their entire supply chain — including non-EU suppliers.
This creates a cascading effect across global manufacturing ecosystems: large European companies request data from their direct suppliers, who in turn request it from their sub-suppliers, and so on down to raw material producers and processors.
In this context, a supplier in Vietnam or Turkey serving multiple European clients has a very concrete incentive to organize itself to respond systematically to these Digital Product Passport data requests — not because of legal obligation, but to avoid losing contracts. Those who adapt early become preferred suppliers; those who do not are gradually replaced. In many cases, commercial pressure will arrive before regulatory pressure.
The Real Complexity — and What to Do While Waiting for Delegated Acts
That said, it would be misleading to present the situation as already resolved or straightforward. For many mid-sized companies, obtaining structured data from non-EU sub-suppliers is far from simple: suppliers may be reluctant, technologically unprepared, or themselves unable to obtain the required ESG information from their own supply chains. The data chain often breaks much earlier than the regulation would expect.
However, there is an important contextual element: we still do not know precisely how much and which data will be mandatory in the initial phase, because sector-specific Delegated Acts have not yet been published. The emerging trend — and this remains informed speculation — appears to point toward a gradual implementation model: an initial, manageable set of data, which will expand over time as supply chains adapt and tools mature.
This is not an ideological concession, but a pragmatic recognition by regulators and industry stakeholders that making the DPP system unworkable from day one serves no one.
What is already clear and actionable today — regardless of when Delegated Acts are released — is the need to map the real supply chain: not the one described in contracts, but the actual one, including second- and third-tier suppliers where known. This is a practice that reduces future surprises and will be valuable regardless of regulatory specifics.
Finally, verification mechanisms are becoming increasingly important: data provided by a non-EU supplier that cannot be verified has limited value within the DPP ecosystem, because the regulation requires declarations to be reliable. Third-party certifications, supply chain audits, blockchain-supported traceability systems, interoperable digital traceability platforms, and secure data-sharing platforms with digital signatures are becoming increasingly important — not optional.
Your non-EU suppliers are not subject to European regulation. But you are, for everything you sell in the European market — and this makes their data your responsibility to manage methodically, before it becomes an emergency.
