Digital Product Passport: What It Is, When It Applies, and What to Prepare Now

What a Digital Product Passport Actually Is

Strip away the policy language and a DPP is a set of structured data about one product, reachable from a code on that product, kept current for as long as the product exists. ESPR defines the common building blocks; each delegated act fills in the attributes for its product group:

• A unique product identifier: the GTIN, extended with a batch or serial number where the product group requires item-level passports.
• A data carrier on the product or its packaging, in practice a QR code or GS1 DataMatrix, readable by consumers and authorities.
• A structured data set whose exact attributes are defined per product group in the delegated act.
• A registration in the EU's central passport registry, which stores identifiers, not the data itself.
• Access rights per audience: consumers, repairers, recyclers, market surveillance and customs each see what they are entitled to.
• Material composition and substances of concern, down to component level.
• Durability, repairability, spare parts and end-of-life instructions where relevant to the product group.
• Sustainability metrics such as recycled content and carbon footprint, with the evidence behind them.
• Availability for the product's lifetime, with updates when the product changes and a backup if the issuer disappears.

The result? A passport is not a document you produce once. It is a published view of your product master data, and it is only as good as the record behind it.

If your product information already lives in one governed, GS1-structured record with version history, most of the passport is a publishing question. If it lives in spreadsheets and PDFs, the passport is a data project first.

The DPP Timeline: Fixed Dates and Moving Ones

There is no single DPP deadline. Two dates are fixed in law; everything else is a product-group timeline that shifts as the Commission drafts each act. As of September 2026:

• 18 July 2024: ESPR enters into force. It is a framework; no product has a passport obligation yet.
• 19 to 20 July 2026: the EU central DPP registry goes live, and the ban on destroying unsold textiles and footwear applies to large companies.
• 18 February 2027: the battery passport becomes mandatory for EV, industrial and light-transport batteries under the Battery Regulation. This is the first fixed passport date in EU law.
• 2027 to 2029, expected: delegated acts for iron and steel, textiles and apparel, tyres and aluminium, with compliance roughly 18 months after each act. None has been adopted yet, so treat these as ranges.
• 2029 to 2030: digital labelling for detergents under the Detergents Regulation (September 2029), toys under the Toy Safety Regulation (August 2030), and further ESPR groups such as furniture and electronics.

What It Means for Food, Beverage and Consumer Goods

Here is the honest answer for most of our customers: food, feed and beverages are excluded from ESPR, so there is no food product passport on the horizon. But the same mechanics are arriving through other doors, and the packaging on every one of your products is already in scope:

• Packaging: the PPWR's harmonised labelling from August 2028 includes a digital data carrier for material and sorting information. Every food and beverage pack gets one.
• Detergents and cleaning products: the revised Detergents Regulation introduces a digital label from September 2029, without needing an ESPR delegated act.
• Cosmetics: the ongoing revision of the Cosmetics Regulation includes proposals for digital labelling. Not adopted yet, but the direction is clear.
• Retailers: sustainability, origin and recyclability attributes are already appearing in supplier requirements and GDSN, passport or not.
• Consumers: once one QR code on the shelf opens a passport, every QR code is expected to.

So while your yoghurt will not need a passport, its pack needs a PPWR data carrier by 2028, your cleaning range needs a digital label by 2029, and the QR code that does both is the GS1 Digital Link code retailers will scan at the till from 2027. Three regulations, one code, one record behind it.

What Changes for Brand Owners

Whether your first passport is a battery in 2027, a detergent in 2029 or a packaging label in 2028, the work is the same five steps, and none of them is about the QR code itself:

• Map your assortment to the timelines: which products fall under ESPR groups, the Battery, Detergents or Toy regulations, and which only need PPWR labelling.
• Settle identification: GTIN per product, batch or serial where required, and a GS1 Digital Link resolver so one QR code serves checkout and passport.
• Collect the attributes each product group demands from suppliers and internal systems, and store the evidence with them.
• Publish a passport page per product that updates automatically when the record changes, and keep it available for the product's lifetime.
• Register identifiers in the EU registry when your product group's act applies, and be ready to grant role-based access to authorities and recyclers.

Brands that do this once, for the whole assortment, are ready for every delegated act that follows. Brands that do it per regulation do the same work three times.

What Changes for Retailers

Retailers are both consumers of passports (for the products they list) and issuers (for their own brands). Either way, passport data has to move through the same supplier onboarding and product data systems as everything else:

• Due diligence: confirm that products in regulated groups carry a valid passport before listing, and keep a record that you checked.
• Own brands: you are the manufacturer, with the full obligation to issue and maintain the passport.
• Goods receipt and logistics: scanners and systems need to read 2D codes and use the passport identifier, not only the GTIN.
• Online and shelf-edge: passport data becomes product-page content, so it has to flow into your PIM and e-commerce systems structurally.
• Returns and recycling: the passport is what tells a returns centre or recycler what the item is made of.

The retailer that can ingest passport data structurally, rather than clicking through supplier links, turns a compliance obligation into better product pages and cleaner category data.

Where Companies Get Stuck

The DPP is often approached as a website project: build a page, put a QR code on the pack. The pattern we see fail is the one where the page has no governed data behind it:

• Product content lives in marketing tools, compliance data in regulatory files, and packaging data in procurement, with no shared identifier
• The QR code on the pack links to a campaign page that will be gone in a year
• Sustainability claims exist as PDFs, not as fields that can be validated, versioned or shared
• No process for updating published information when a recipe, supplier or material changes

Why this matters now:

• A passport that is wrong or out of date is a compliance failure, not a marketing slip
• Every delegated act adds attributes; a structured record grows, a PDF archive starts over
• The same QR code will carry checkout, PPWR labelling and the passport; it must resolve reliably for years
• Retailers will ask for the data before regulators do

Start from the record, and the passport, the label and the barcode become three outputs of the same truth.

How xyxle Helps You Get Passport-Ready

xyxle is a PIM and data exchange platform built on the GS1 GDSN data model, and it has been generating live product pages from that model since long before the DPP had a name:

• Article passports: xyxle already publishes a live, multilingual product page per GTIN that updates automatically when the master data changes. Technically, that is a digital product passport; the delegated acts only define which fields it must show.
• GS1 Digital Link ready: the identifiers, hierarchies and batch data for a 2D barcode live in the same record, so one QR code can serve checkout, PPWR label and passport.
• GDSN data model plus flex fields: the full set of GS1 attributes out of the box, extended with recycled content, carbon footprint, substances of concern or whatever a delegated act adds.
• Digital asset management for the evidence: certificates, test reports and safety data sheets attached to the item, versioned alongside the fields they support.
• Field-level version history: every change to a published value, including hazardous substance data, is logged with who, when and the previous value, which is exactly what an auditor asks for.

When a delegated act for your product group lands, the work is adding its attributes to the record and switching on the fields in the passport template, not building a new system.

And because the same record feeds GDSN and your retailer channels, the passport never says something different from the data pool.

A Practical DPP Roadmap

You do not need to wait for your product group's delegated act to make progress. The first three steps are useful regardless, and they are the ones that take longest:

• Scope: sort your assortment by which regulation reaches it first, and note the earliest realistic date for each group.
• Identify: confirm GTINs and hierarchies in xyxle, decide where batch or serial level is needed, and set up a Digital Link resolver.
• Collect: add the sustainability and composition attributes to the record, with supplier evidence attached, starting with packaging data for the PPWR.
• Publish: switch on article passports for a pilot range, print a Digital Link QR code on the next packaging run, and test it with your retailers.
• Maintain: route every change through approval and version history, so the published passport is always the approved truth.

For most consumer goods brands, the PPWR packaging data and the 2D barcode are the concrete first deliverables. The passport rides on the same rails.

We can walk your assortment with you and tell you, group by group, what applies and when.

One Record. One Code. Every Regulation.

The DPP, the PPWR label and the GS1 2D barcode are converging on the same idea: a code on the product that resolves to trustworthy, structured, current data. Companies that build that capability once will meet each regulation as a configuration change.

xyxle gives you the GS1-native record, the article passports, the Digital Link identifiers and the version history to prove it, in the platform you already use for GDSN and retailer syndication.

The passport is the easy part. The record is the work. Start there.