Do I have to make business-sensitive data about my electronics public?

Not everything is made public: the passport has different access levels

No, not all data in the digital product passport is automatically visible to everyone. The ESPR is based on a passport with layered access: some information is available to the general public, other information only to supervisory authorities, customs or specific market participants such as repairers or recyclers. This approach exists precisely because the legislator recognises that not all product information is equally relevant or desirable for everyone to share. Business-sensitive data, such as precise formulation, supplier relationships or production details, do not therefore need to be disclosed as soon as a passport goes live.

Which data this applies to, and which it does not

This protection applies to data that represents a genuine commercial interest and whose disclosure could harm competitive position — think of specific supplier information, internal production processes or technical details that go beyond what is necessary for repair, recycling or market supervision. It does not apply to the core information that the passport is actually intended to contain: data on sustainability, origin of materials, repair and recycling information and compliance with product requirements. That information is the whole raison d'être of the passport and is not subject to a confidentiality claim, even if a manufacturer would prefer not to have shared that information. The distinction is therefore not "do I want to share this" but what the regulation deems necessary for the passport versus what goes beyond that.

Also important: layered access does not mean that sensitive data does not need to be shared at all. Actors in the supply chain may be required to provide certain information to other parties in that chain or to supervisory authorities, even if that information is not intended for the general public. Confidentiality towards the consumer is therefore something different from confidentiality towards the entire chain or towards a supervisory authority.

No fixed date yet, but an established principle

For electronics and ICT equipment, the date when the product passport becomes mandatory is not yet fixed: this follows per subcategory from delegated acts expected from 2027 onwards within the ESPR work plan 2025-2030. As long as that act for a specific product category does not exist, there is no obligation to maintain a passport, and therefore no concrete question about which data may remain confidential. What is established, however, is the principle from the ESPR itself: layered access to passport data is part of the basic regulation and will therefore also apply as soon as a delegated act for electronics comes into force. The concrete implementation — which data fields are precisely public and which are restricted access — will be further developed per product category in those delegated acts. Until then, there is nothing to fill in; this page will be updated as soon as the act for electronics is published.

How this works in practice

Anyone thinking ahead about the product passport would be well advised to first map out which data should be included in the passport based on the core information requirements, regardless of whether that is sensitive. Next, it makes sense to consider which additional data a supplier, manufacturer or importer would want to add themselves or must provide, and whether that information goes beyond the mandatory minimum. For that additional layer, it is relevant to know who exactly gets access: the general public via the QR code, or a more limited group such as supervisory authorities or supply chain partners. Because the exact allocation of data fields per product category has yet to be determined, it is not yet possible to determine for each field whether something becomes public or remains restricted. What can be done now: put existing internal data inventories in order, so that it will quickly become clear which data falls under which category once the delegated act is in place. Those who have a passport compiled via Elektropas will have that allocation processed according to the rules in force at that time; the data provided does not need to go beyond what the regulations require for the relevant category.

Where this follows from: Article 10 and Article 38 of the ESPR

The basis for the tiered access to passport data is laid down in Article 10 of Regulation (EU) 2024/1781 (ESPR), which sets out the requirements for the digital product passport, including the manner in which information is made accessible to different types of users. Article 38 of the same regulation sets out the requirements for actors in the supply chain, and is relevant to the question of which information must be shared between parties in the chain, even if it is not intended for the public. The precise delimitation between public and restricted-access data for electronics follows from the delegated act that still needs to be adopted for this product category.

What to do now

Map your own product data and already separate what is likely to be part of the mandatory core information from what counts as additional or sensitive information; consult the ESPR work programme of the European Commission for the current status of the delegated acts, and return to this page once the act for electronics has been published — it will be processed here immediately.