3 min read
Digital Product Passport: Who Sees What? A Guide to Managing Differentiated Access
The Digital Product Passport (DPP) will transform industrial transparency, but not all data will be public. Through differentiated access levels, European regulations ensure the protection of trade secrets, providing each stakeholder only with the information that is relevant to them.
by Corrado Facchini, CTO & Innovation Manager
In this article
Introduction: The Dilemma of Industrial Transparency
The transition toward a circular economy requires an unprecedented level of data sharing across the entire value chain. The Digital Product Passport (DPP)—introduced by the European Ecodesign for Sustainable Products Regulation (ESPR)—was created specifically to track the origin, composition, environmental impact, and repairability of products placed on the EU market.
However, a critical question arises for manufacturers and businesses: does transparency mean making everything public?
The answer is no. The European regulation clearly states that transparency must not come at the expense of industrial confidentiality, know-how, or data privacy. For this reason, access management within the DPP is based on a granular and differentiated model.
One Passport, Multiple Perspectives
The DPP is neither a simple static PDF file nor a QR code that redirects everyone to the same webpage. Instead, it is a data platform structured according to the principle of authorization granularity.
Not all information contained in the passport is visible to everyone who scans the product’s tag or code. The system employs visibility levels tailored to the identity and role of the person accessing the data.
Who Accesses What? Authorization Levels
The governance of the DPP categorizes stakeholders into distinct groups, each granted a specific "view" of the data:
1. Consumers and End-Users (Public Access)
Citizens and buyers require clear, immediate information to make sustainable purchasing decisions and to use the product as effectively as possible.
- What they see:
- Carbon footprint and energy efficiency class. * Presence of substances of concern or allergens.
- Instructions for use, maintenance, and proper disposal.
- Availability of spare parts.
2. Recyclers, Repairers, and Waste Management Operators
To encourage reuse and efficient recycling, operators within the post-consumer value chain require more in-depth technical data.
- What they see:
- Disassembly diagrams and critical components.
- Detailed material composition and the presence of critical raw materials (CRMs).
- Technical repair manuals not intended for the general public.
3. Market Surveillance Authorities and Customs
National and European regulatory bodies must verify the compliance of products.
- What they see:
- Complete compliance documentation (CE declarations, laboratory certifications).
- Safety test results.
- Supply chain reports and sustainability audits.
4. Supply Chain Stakeholders and Business Partners
Suppliers and sub-suppliers exchange essential data for B2B traceability.
- What they see:
- Data on raw materials, batch traceability, and processing stages—protected by strict digital non-disclosure agreements (NDAs).
Protecting Intellectual Property and Security
Differentiating access levels is not merely a functional choice; it is a strategic necessity for protection:
- Protection of Trade Secrets: Prevents competitors or malicious actors from reverse-engineering chemical formulas, production recipes, or the exact list of confidential suppliers. 2. Cybersecurity and Product Security: Prevents the spread of hardware or software vulnerabilities that could be exploited for cyberattacks (especially in IoT-connected products).
- GDPR Compliance: Ensures that the personal data of owners or technicians is not made publicly available.
How Does Access Control Work Technically?
The technical management of access within the Digital Product Passport (DPP) is based on European data infrastructure standards:
- Secure Digital Identities (SSI and Verifiable Credentials): The user or entity requesting access authenticates themselves using verified digital credentials.
- Decentralization and Interoperability: Data resides within corporate systems or secure repositories and is displayed "on-demand," based on the requester's authorizations.
- Role-Based Access Control (RBAC) Architecture: Permissions are assigned dynamically according to the user's role, ensuring both scalability and security.
Conclusion
Differentiated access management is the true enabler of the Digital Product Passport. By balancing the consumer's right to be informed with the need for businesses to protect their competitive advantage, the EU has paved a path where transparency and industrial security can finally coexist.
Sources
Related articles
- October 20, 2026Digital Passport, who sees what: a date has finally been set for differentiated access.Who sees what in the Digital Product Passport? Differentiated access levels are becoming a reality: the EN 18239 standard has been published, an implementing act regarding batteries is expected by the end of 2026, and the first mandatory requirement will take effect on February 18, 2027. Here is wha
- October 16, 2026Model, batch, or unique item? The choice that defines your Digital Product PassportWhether applied to a model, a batch, or an individual product, the granularity of the Digital Product Passport (DPP) has significant implications for costs, data, and processes.
- September 17, 2026Product Category Schedule for the DPPThe article sets out a chronological timeline for the product categories subject to the Digital Passport. It begins in 2027 with a requirement for batteries, followed between 2028 and 2030 by textiles, electronics, furniture, mattresses, tires, and metals, outlining the key requirements for each sec