The short answer
The digital product passport is basically intended for product data: materials, repair information, origin, energy consumption and the like. For most electronics and ICT equipment, you therefore do not need to include personal data in the passport. Personal data come into play once you link data about users, technicians or owners to a product, for example in warranty registration or maintenance history linked to a name. That then does not fall under the regulation for the product passport, but under the General Data Protection Regulation (GDPR), which continues to apply alongside the new rules.
For you as an entrepreneur, this mainly means keeping two things separate: what must be in the passport because the regulation requires it, and what you may add yourself and that may contain personal data. These two questions are answered by different rules and, in the Netherlands, are reviewed by different supervisory authorities.
What the passport basically contains
The regulation establishes the digital product passport around the product, not around the person using it. Think of data that the manufacturer or importer provides on composition, repair options, warranty information at product level and data relevant to recycling at the end of the product's life. Which data are exactly mandatory varies by sub-category and is set out in a delegated act that has not yet been published for every product group.
As long as such an act does not exist, it is also not yet clear how your specific product group must provide data. In the knowledge base, we keep track per subject of what is already established and what is still open, so you do not have to go through the official texts yourself. the knowledge base with the status per subject provides an overview there.
Where personal data can still play a role
In the practice of many companies, product data and personal data overlap in a few places. An installation company that records maintenance visits in the customer's name, an importer that links warranty claims to an email address, or an office manager who assigns equipment to employees: in all these cases a link is created between a product and a person.
This link does not automatically fall under the digital product passport. The passport itself is linked to the product via the QR data carrier, not to an individual user. But the systems in which you keep these additional data do fall under the GDPR if personal data are processed in them. This was already the case before the product passport came about and does not change because of it.
The two regulations alongside each other
The GDPR and the regulation for the digital product passport have a different purpose and a different supervisory authority. The GDPR is about the protection of personal data and is supervised in the Netherlands by the Dutch Data Protection Authority. The regulation for the product passport is about product information and the way it is made available and verifiable, and supervision of it is arranged per member state.
For you, this mainly means that a question about your product passport is not automatically a GDPR question, and vice versa. If, for example, you are unsure whether a customer database with serial numbers and names complies with the GDPR, you will not find the answer in the text on the product passport, but in the GDPR itself and with your own legal adviser or the Dutch Data Protection Authority.
What this means for the data you provide
When you as a manufacturer or importer provide data for the passport, it is practical to determine beforehand which data relates solely to the product and which contains a link to a person. Only product data belongs in the passport itself; data that makes a user identifiable should in principle not be included and require a separate assessment under the GDPR.
At elektropas.com we compile the passport from the product data you provide and host it for ten years. How we handle the data you entrust to us for this purpose is described on the page on how we handle your data. This is a different matter than the question of whether your own internal systems, such as a warranty or maintenance register, comply with the GDPR.
Mapping your situation
Whether your own data processing concerning a product contains personal data and what is required for it depends on how exactly you use and store that data. This is a question for your own lawyer or the Data Protection Authority, not something that can be answered in general terms.
Would you like to get an impression first of what is already established for your product group and what is not? Do the free product scan in a few questions or check the frequently asked questions about the product passport for a broader overview.