When a company creates a Digital Product Passport, who actually owns the data behind it?
A DPP can contain information coming from the brand, suppliers, manufacturers and other actors across the value chain. The passport itself may be stored by the economic operator or managed through a DPP service provider, while different actors may have different rights to access or update its information.
This means that DPP data ownership cannot be reduced to a single question of who stores the passport. The ESPR and the European DPP standards address different dimensions of control: who stores the data, who can use it, who can access or modify it, and how it must remain available over time.
And one requirement makes the implications particularly clear: the passport must remain available even if the economic operator that created it ceases to exist.
Under the ESPR, Digital Product Passport data must remain available for the period defined by the applicable product-specific delegated act, including after the insolvency, liquidation or cessation of activity of the economic operator responsible for creating the passport.
This requirement is translated into technical rules by EN 18221:2026, the European standard for DPP data storage, archiving and persistence.
The standard establishes a decentralised approach to DPP data storage and addresses how passport information is archived and kept available over time. This includes mechanisms for data replication and back-up designed to preserve access when the original economic operator can no longer maintain the passport.
For companies, this makes persistence an infrastructure requirement, rather than simply a question of where the passport is hosted. They need to understand how long their DPP data must remain available, how it is preserved and what continuity mechanisms are in place if the organisation responsible for it ceases to operate.
Storing Digital Product Passport data does not give a service provider unrestricted control over it.
Under the ESPR, a DPP can be stored by the economic operator responsible for its creation or by a Digital Product Passport service provider. When a service provider stores or otherwise processes DPP data, however, it cannot sell, reuse or process that information beyond what is necessary to provide the relevant service, unless this has been specifically agreed with the economic operator placing the product on the market.
This distinction is important when discussing DPP data ownership. The company hosting the passport is not automatically free to use the information contained in it for other purposes. For brands, choosing a DPP provider therefore also means understanding what happens to their product and supply-chain data once it enters the provider’s infrastructure.
Here, another distinction becomes necessary: control over data does not mean that all DPP information is private.
The ESPR establishes that different actors can access Digital Product Passport information according to their respective access rights. These can include customers, manufacturers, importers, distributors, repairers, refurbishers, recyclers, market surveillance authorities and customs authorities. The applicable product-specific delegated act will determine which actors can access which information.
The same principle applies to changes made to the passport. The ESPR also provides for differentiated rights to introduce, modify or update information in the passport.
This means that a Digital Product Passport should not be understood as a single public webpage containing the same information for everyone. Different information can be made available to different actors, while the ability to add or modify data can also be controlled.
There is no single answer to DPP data ownership in the ESPR. The regulation does not assign all information contained in a Digital Product Passport to one actor under a single concept of ownership. Instead, it establishes responsibilities and rights around who creates the passport, who stores it, who can access or modify particular information, and what a DPP service provider can do with the data it processes.
For companies implementing DPPs, the practical question is therefore not only “Who owns our data?”, but how control over that data is maintained throughout the passport’s lifetime.
An even more useful set of questions is:
As Digital Product Passports become part of product compliance, data continuity needs to be considered from the beginning of implementation.
The ESPR requires DPP data to be transferable through an open, interoperable network without vendor lock-in. Together with requirements around storage, back-up and persistence, this means that companies should not build passports whose continued availability depends entirely on a single technology provider.
For brands, data continuity therefore becomes a criterion for choosing DPP infrastructure: where the data is stored, how it can be transferred, how long it remains available and what happens if the provider changes or ceases to operate.
Renoon supports brands in building DPP infrastructure around these requirements, from structuring and managing product data to ensuring its accessibility and continuity over time.
Get in touch with our team to assess how your DPP setup addresses data storage, access and persistence.
.avif)
