What Data Should I Include in My Product’s DPP?
Persona: Quality and Compliance Manager, manufacturing company, Europe
The short answer is: it depends on the delegated act applicable to your sector. But this is not the answer that really matters.
The more useful question is not which data should be included, but rather: what type of data can legitimately be part of a Digital Product Passport?
A Digital Product Passport is not a document. It is not a digital certificate in PDF format accompanying a product. It is an interoperable and decentralized data record associated with a specific product or batch, progressively updated throughout the product’s lifecycle. The regulatory framework ensures its long-term accessibility, including if the manufacturer ceases operations, using a third-party service provider.
Every data element entered into the DPP is digitally signed by the party that provides or updates it. All changes are tracked and attributable: updates are managed through role-based access rights. Anyone accessing the DPP does not only see the current data, but also its history.
DPP Data Describes the Product — Not The Company
This architecture has a direct consequence: the DPP does not contain information describing how a company operates. It contains information describing that specific product, in that specific batch, with those materials, manufactured under those conditions.
A traditional process certification (whether category-specific, sector-specific, or related to a management system) confirms that a company follows certain procedures. It does not necessarily attest to the specific characteristics of the product being placed on the market today.
Likewise, a generic company statement, unsupported by technical documentation and verifiable measurement methodologies, does not constitute a valid data source for a DPP.
Third-party certifications issued by accredited bodies carry a different level of credibility and, depending on the requirements defined by the relevant sectoral delegated act, may be accepted as a basis for DPP data. In all cases, the guiding principle is chain of custody: every data point must be documented, attributable, and digitally signed by the party that generated it, according to recognized standards.
How the Data Chain Is Built
DPP data is not generated by the company alone. A significant part of it comes from across the supply chain.
The recycled content figure comes from supplier certification linked to a specific batch. The carbon footprint is derived from a calculation based on measured data, following the methodology established by the relevant delegated act. The presence of substances of concern comes from the analysis of the specific product.
Each contribution is digitally signed by the party entering the information, which must be verified and authorized to operate within the data ecosystem.
The chain of custody becomes the backbone of the DPP: traceable, verifiable, and governed by clearly defined access rights.
A specialized technical operator — the DPP Service Provider — structures this information, connects it to the European data infrastructure, and generates the data carrier displayed on the product or packaging, typically a QR code.
From that moment onwards, data can be accessed according to different levels of permission:
- public information for consumers;
- compliance-related information for downstream buyers;
- complete documentation for market surveillance authorities.
Companies that lack this upstream data chain and attempt to replace it with undocumented information or unsupported declarations do not have a compliant DPP. They have a document that resembles a DPP, but it is not one.
The DPP is not simply a more sophisticated bureaucratic requirement. It is a system of distributed responsibility, where every data point is attributable, digitally signed, and continuously updateable over time.
The difference between a compliant DPP and what can be described as “passwashing” — a passport that formally exists but is operationally empty — is not in its appearance.
It lies in the quality of the data infrastructure behind it.
