Digital product passports collect detailed information about products, materials, and supply chains. Most of that information describes physical objects, not people. But some of it does describe people, and when it does, Regulation (EU) 2016/679 (the GDPR) applies. Understanding where the GDPR digital product passport overlap sits, and what it requires of you, is a practical compliance task, not a theoretical one.
What the GDPR Covers: The Basic Test
Article 4(1) of the GDPR defines personal data as “any information relating to an identified or identifiable natural person.” The GDPR has applied since 25 May 2018. The test is simple: does the information relate to a natural person, directly or indirectly? If yes, the GDPR applies. If the information relates only to a legal person, such as a company with its own legal personality, it falls outside the GDPR. Recital 14 of the GDPR, which is not binding, confirms this distinction.
This matters for passports because the manufacturer and the authorised representative can each be a natural or a legal person. Article 3(1), points (33) and (63), of Regulation (EU) 2023/1542 make this explicit for batteries. When the manufacturer is a sole trader or a named individual, their name in the passport is personal data. When the manufacturer is a limited company, the company name is not. The same logic applies to any named compliance officer: a professional role does not change the fact that the name belongs to a natural person, so it is personal data.
Readiness Assessment
Find out if your operation is ready for EU DPP compliance.
Five questions, about two minutes. You get a score for each area and a numbered action plan for the gaps.
Score Your ReadinessWhere Personal Data Appears in a Passport
Three categories of passport content are most likely to trigger the GDPR.
Named individuals in company or compliance roles. If a passport records the name of a compliance officer, a quality manager, or any other named employee, that is personal data under Article 4(1). The controller must identify a lawful basis under Article 6(1) of the GDPR before processing it.
Contact details of supplier employees. Supply chain data often includes the names and contact details of individual employees at component suppliers. These are personal data. The controller needs a lawful basis under Article 6(1) and must be able to demonstrate compliance under Article 5(2). The data must be limited to what is necessary for the purpose under Article 5(1)(c), and kept no longer than necessary under Article 5(1)(e).
Access logs and online identifiers. When a user scans a QR code linked to a passport, the system may record an IP address or another online identifier. Article 4(1) of the GDPR lists online identifiers as one of the factors that can make a person identifiable. Recital 30, which is not binding, illustrates this with IP addresses. If your passport platform logs scan events and those logs can be linked to an identifiable person, those logs are personal data.
Individual battery data. Annex XIII, point 4, of Regulation (EU) 2023/1542 requires information and data on the individual battery, accessible only to persons with a legitimate interest. Point 4(d) specifically covers charging and discharging cycles and negative events such as accidents. Where that data can be linked to an identifiable owner or user, it is personal data under Article 4(1) of the GDPR.
The GDPR Digital Product Passport Rules Set by Each Regulation
Different product passport regimes handle personal data through different legal instruments. You need to know which regime covers your product.
ESPR passports. Article 10(1)(e) of Regulation (EU) 2024/1781 sets a direct storage rule: personal data of customers must not be stored in a digital product passport without their explicit consent, and that consent must comply with Article 6 of the GDPR. Article 10(1)(e) does not itself create public and restricted access tiers. Access tiers are set by the delegated act for each product group, under Articles 9(2)(f), 10(1)(g), and 11(b) of Regulation (EU) 2024/1781. Article 11(h) of the same regulation requires a high level of security and privacy. Article 11 also allows the Commission to adopt implementing acts on digital credentials for actors with access rights.
Battery passports. Access to battery passport data follows Article 77(2) and Annex XIII of Regulation (EU) 2023/1542. Article 78(h) of that regulation requires a high level of security and privacy. Article 10(1)(e) of Regulation (EU) 2024/1781 is an essential requirement for passports set up under ESPR delegated acts adopted pursuant to Article 4 (Article 9(1)). Regulation (EU) 2023/1542 has no equivalent customer-consent provision, so personal data in a battery passport is governed by the GDPR directly.
Toy passports. Article 20(10) of Regulation (EU) 2025/2509 sets its own consent rule for personal data of customers in toy passports. That regulation applies from 1 August 2030.
Lawful Basis: Which Article 6 Ground Applies?
Every processing activity involving personal data needs a lawful basis under Article 6(1) of the GDPR. Manufacturers sometimes assume that a legal obligation to produce a passport automatically covers all personal data in that passport. That assumption is wrong.
Article 6(1)(c) allows processing where it is necessary for compliance with a legal obligation to which the controller is subject. But Article 6(3) limits this: the legal obligation must be laid down by Union or Member State law. The obligation must also make the specific processing necessary. If a regulation requires you to name a contact point but does not specify that the contact must be a named individual, processing a named individual’s details may not be covered by Article 6(1)(c) for that record.
Where Article 6(1)(c) does not cover a given record, you need another basis. Article 6(1)(f), legitimate interests, is often relevant for supplier contact details held for operational reasons. But you must carry out a balancing test and document it. Article 5(2) requires you to be able to demonstrate that you have done so.
For customer personal data stored in a passport, Article 10(1)(e) of Regulation (EU) 2024/1781 (for ESPR passports) and Article 20(10) of Regulation (EU) 2025/2509 (for toy passports) require explicit consent. Explicit consent maps to Article 6(1)(a) of the GDPR, read with the conditions in Article 7. You must be able to show that consent was freely given, specific, informed, and unambiguous.
Data Minimisation and Retention
Article 5(1)(c) of the GDPR requires that personal data be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” This is the data minimisation principle. For passport purposes, it means you should not include a named individual’s details simply because it is convenient. Ask whether the purpose requires a named person or whether a role title and a generic contact address would serve equally well.
Article 5(1)(e) requires that personal data be “kept in a form which permits identification of data subjects for no longer than is necessary.” Passports are designed to persist for the product’s lifetime and beyond. If personal data sits in a passport indefinitely, you need a documented justification. Where the purpose that justified collection no longer applies, the data should be removed or anonymised.
Data Processing Agreements with Your Platform Provider
If your passport platform provider processes personal data on your behalf, Article 28 of the GDPR requires a data processing agreement (DPA) to be in place. The DPA must set out the subject matter, duration, nature, and purpose of the processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. Without a DPA, you are in breach of Article 28 regardless of how little personal data is actually processed.
Check your contracts with every platform provider, cloud host, and data processor in your passport supply chain. If any of them process personal data on your behalf and you do not have a compliant DPA, put one in place before you go live. For a more detailed breakdown of the compliance steps involved, see the GDPR and Digital Product Passports: detailed guide.
Security Requirements
Article 32 of the GDPR requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This overlaps with the sector-specific requirements: Article 78(h) of Regulation (EU) 2023/1542 and Article 11(h) of Regulation (EU) 2024/1781 both require a high level of security and privacy. Meeting the sector-specific requirement does not automatically satisfy Article 32, because Article 32 is risk-based and requires you to assess the specific risks to the personal data you hold.
Practical steps include encrypting personal data at rest and in transit, restricting access to personal data within the passport system to those who need it, logging access to personal data fields, and testing your security measures regularly.
What to Do Now
- Map every field in your passport against the Article 4(1) test: does it relate to a natural person? If yes, record it as personal data.
- For each personal data field, identify the lawful basis under Article 6(1) and document it. Do not assume Article 6(1)(c) covers everything.
- Apply Article 5(1)(c) data minimisation: replace named individuals with role titles and generic contact addresses where the purpose allows.
- Set retention periods for personal data fields and build a process to remove or anonymise data when the retention period expires.
- Check that a compliant DPA under Article 28 is in place with every platform provider that processes personal data on your behalf.
- Review your security measures against Article 32 and document the risk assessment.
- If your passport stores customer personal data, confirm you have explicit consent that meets Article 6(1)(a) and Article 7 of the GDPR, and the specific consent rule in the applicable product regulation.
If you are building or upgrading your passport system now, Traceable’s platform is designed to help you manage these requirements from the start. Register for a free trial and see how the platform works in practice.
