# Who Can See What in a Digital Product Passport, and Who Decides Access

Source: https://activatedigital.ai/knowledge/passport/who-sees-what
Last verified: 28 August 2026
Summary: The framework is built for differentiated access. It names a long list of actors who are to reach a passport according to their respective access rights, it bounds what a passport may contain to a closed list of twelve elements, and it hands the question of who gets which of them, and who may write to the record, to the [delegated act](https://activatedigital.ai/knowledge/regulation/what-a-delegated-act-decides) covering each product group. No such act has been adopted for textiles. The European standard written to answer that question is one of two, out of eight, whose reference the Commission has not published. So the answer today is that whatever a business publishes is an access decision it has taken, whether or not it noticed taking one.

## In 60 seconds

The framework is built for differentiated access, and it hands the question of who gets which data, and who may write to the record, to the delegated act covering each product group. No such act has been adopted for textiles.

- Annex III bounds passport content to twelve listed elements. Unique facility identifiers and other operators' identifiers are among them.
- Article 14 requires a publicly accessible Commission portal where stakeholders search and compare passport data within their access rights.
- Commercially sensitive and trade secret appear nowhere in the instrument. The protective language people quote comes from the recitals.
- Battery Article 77(9) required its access implementing act by **18 August 2026**. It was not identified as adopted as at 1 September 2026. The roadmap places it in Q4 2026, indicative.
- EN 18239 on access rights was at stage 50.60 from 16 July 2026 and is not treated as OJEU-cited.
What the framework itself says is spread across five provisions, and the protective language people quote about confidential business information comes from the recitals rather than from the enacting terms.

## What the framework establishes, provision by provision

Five provisions do the work.

**Article 9, on what a delegated act must specify.** Two of its points carry this whole subject: the actors that are to have access to data in the passport and to what data they are to have access, and the actors that are to create a passport or update the data in one and what data they may introduce or update.

**Article 10, on the essential requirements for the passport.** It requires that access be regulated in accordance with the specific access rights at product group level as specified in the applicable delegated act. It separately provides that personal data relating to customers is not to be stored in the passport without their explicit consent.

**Article 11, on technical design and operation.** This one names the audience: customers, manufacturers, importers, distributors, dealers, professional repairers, independent operators, refurbishers, remanufacturers, recyclers, market surveillance authorities and customs authorities, civil society organisations, trade unions and other relevant actors are all to have free of charge and easy access, based on their respective access rights set out in the applicable act. The same article restricts the rights to introduce, modify or update data on the same basis.

**The restriction on [service providers](https://activatedigital.ai/knowledge/passport/from-question-to-published-passport),** in the same article. Where a passport is stored or otherwise processed by a passport service provider, that provider is not to sell, reuse or process the data beyond what is necessary to provide the service, unless specifically agreed with the [economic operator](https://activatedigital.ai/knowledge/regulation/who-carries-the-obligation) placing the product on the market. That last clause makes it a default contract term rather than a prohibition, and the party who can agree it away is the party being asked to sign the contract.

**Article 14, on the web portal.** The Commission is to set up and manage a publicly accessible portal allowing stakeholders to search for and compare data included in passports, designed to guarantee that they can search and compare in a manner consistent with their respective access rights specified in the delegated acts.

**Annex III, on what a passport may contain.** The delegated act specifies what data are to or can be included in a passport from among twelve listed elements. The list is the outer edge of the whole subject: information required under the framework's information requirements or by other Union law applying to the product group; the [unique product identifier](https://activatedigital.ai/knowledge/fields/the-three-identifiers) at the level the act indicates; the Global Trade Identification Number or equivalent; relevant commodity codes such as a TARIC code; compliance documentation such as the [declaration of conformity](https://activatedigital.ai/knowledge/evidence/documents), technical documentation or conformity certificates; user manuals, instructions, warnings or safety information required by other Union law; information related to the manufacturer including its unique operator identifier; unique operator identifiers other than the manufacturer's; unique facility identifiers; importer information including its EORI number; the responsible economic operator established in the Union; and the reference of the service provider hosting the back-up copy.

That list has a shape. Eleven of the twelve are identity, documentation or instruction. The one that carries substantive product claims is the first, and it is a pointer to requirements set elsewhere rather than a list of its own.

### The carrier, the data and the access right are three separate questions

The most common error in this territory is to collapse them into one.

The **carrier** is public by design. Article 10 requires a passport to be connected through a [data carrier](https://activatedigital.ai/knowledge/passport/choosing-a-carrier-that-still-works) to a persistent unique product identifier, and requires the carrier to be physically present on the product, its packaging or accompanying documentation. Anybody holding the garment can read it.

The **data it resolves to** is a separate object, and nothing in the framework says all of it is public. Article 10 requires that access to the data be regulated in accordance with the access rights specified at product group level.

The **access right** is a third thing again, and it is the one nobody has set for textiles. Article 11 requires the named actors to have free and easy access based on their respective access rights, and empowers the Commission to adopt implementing acts setting out procedures to issue and verify the digital credentials of operators and other actors that have access rights. A credentialling scheme is not the architecture of an open document.

So a scannable code does not mean an open record. It means an open front door to a building whose rooms have not been allocated yet.

The article numbers are cited here because the consolidated text of the framework was read directly at the Official Journal on 28 August 2026, with the article headings visible, and the numbering was then checked against a Commission implementing decision which states that passports conforming to cited harmonised standards are presumed to conform with the requirements set out in Articles 10 and 11. A direct read of the enacting terms plus an adopted Union act agreeing with it is as good a warrant as this subject offers.

## The confidentiality provisions that are not there

Across the whole of the enacting terms, read in full, the phrase confidential business information appears twice. Once in Article 5, in the list of things the Commission is to do when it prepares ecodesign requirements, where it is to take into consideration the protection of confidential business information. Once in Article 7, as one ground among several on which the Commission may exempt a substance of concern from an information requirement, with an express carve-out preventing that exemption reaching substances present above a stated threshold. The phrase commercially sensitive returns no occurrences anywhere in the instrument. Trade secret returns none. Confidentiality otherwise appears only in the provisions on notified bodies and on Commission investigations, which are different subjects. Intellectual property appears twice, in Annex I and in a provision about the destruction of unsold goods, and neither is about the passport.

The protective language people quote comes from the recitals. One recital says the passport is expected to let value chain actors and authorities do their work without endangering the protection of confidential business information. Another says that, to optimise access to the data while also protecting intellectual property rights, the passport needs to be designed and implemented in a manner that allows differentiated access depending on the type of data and the typology of stakeholders.

Both sentences are genuine and neither is an operative provision. A recital explains why an instrument was drafted as it was. It is read to interpret the articles, and it does not create a right the articles do not.

The registry is the other place people look, and it is not there either. The implementing regulation establishing the digital product passport registry was searched for confidential, confidentiality, commercially sensitive, business confidentiality, trade secret, sensitive information and a reference to the trade secrets directive. Trade secret returns none. Commercially sensitive returns none. Business confidentiality returns none. The trade secrets directive is not referenced. Confidentiality appears twice and both are information security rather than commercial protection: a requirement that delegated access be carried out in a way that ensures the security, integrity and confidentiality of registry data, and a requirement that log measures ensure the immutability and confidentiality of the logs. What registration does commit an operator to is on [registering a passport](https://activatedigital.ai/knowledge/regulation/enrolling-in-the-registry).

For a business worried about publishing something commercially sensitive, the framework gives you no right you can exercise over the contents of a passport. It gives you a Commission that must take confidentiality into consideration when it writes the act, a ground on which the Commission may exempt a substance from disclosure, and a recital saying the design should allow differentiated access. What protects a value is that the act covering your products does not require it to be published, and for textiles no act exists to require or not require anything.

Two things narrow the worry, and both come from Annex III. The first is that the passport's possible content is a closed list rather than an open field, so the question is never whether a delegated act could demand anything at all. The second is that the commercially sensitive things businesses name when asked, which are formulations, unit costs, supplier terms and process detail, are not on that list. What is on it, at points (h) and (i), is the identity of operators other than the manufacturer and the identity of facilities. That is the pressure point, and it is dealt with below.

## The standard controls the mechanism, not the final audience list

The emerging access-rights standard does not turn the horizontal DPP framework into a finished textile access matrix.

Under ESPR, the product-specific rules still decide which actors can access which data for a product group. EN 18239 sits one layer below that decision. Its published scope covers access-rights management, information-system security, data protection, business confidentiality and the transfer of responsibility between actors. It also recognises that public DPP data may be available without access restriction.

That makes EN 18239 the machinery for enforcing a policy, not the source of every future policy. A product act can say that a field is public, regulator-only or available to a defined economic actor. The horizontal standard can then support how that decision is implemented consistently.

The official project record reviewed for this page placed EN 18239 at **stage 50.60 from 16 July 2026**. It is not treated here as OJEU-cited. An EN project status is therefore not used as evidence that a particular access model already carries a presumption of conformity under ESPR.

For the changing standards position, use the [DPP standards status owner](https://activatedigital.ai/knowledge/status/standards). For who may change data as distinct from who may read it, see [who can update a DPP](https://activatedigital.ai/knowledge/guides/who-can-update-a-dpp).

## What implementation evidence looks like today

Pilot systems are already testing plausible access-control patterns. CIRPASS-2's mock Registry uses OpenID Connect and role-based access control in its implementation, but the project explicitly describes those choices as exploratory and non-normative.

BatteryPass-Ready is also continuing to adapt its test environment and data model around the developing standards and the still-moving battery access-right rules.

Both are useful signals for implementers. Neither is a licence to turn today's pilot role names or technology choices into tomorrow's legal requirement. In particular, it would be unsafe to infer future textile roles from battery-sector implementation assumptions.

Keep the access layer configurable. Do not bury one pilot's roles or one technology stack so deeply in the data model that a later product act becomes expensive to implement.

## The portal is built for comparison, not for scanning

Article 14 changes the commercial calculation and it is almost never mentioned.

The picture most people hold of a passport is one shopper, one garment, one scan. The framework also requires the Commission to set up and manage a publicly accessible portal through which stakeholders search for and compare data included in passports. Comparison across producers is the stated purpose, not a side effect.

Two limits before the consequence. The portal is a framework provision rather than a running service, and no textile data can reach it until a textile act exists. And the same provision requires the portal to be designed so that stakeholders search and compare consistently with their respective access rights, which means it is not a bulk download of everything to everybody. What a party can compare is what that party could see anyway.

The consequence still holds. A field a textile act eventually marks public will not be published once per garment to whoever happens to be holding it. It will be published into a searchable, comparable set alongside the same field from every other brand in scope. A value that is unremarkable on a swing tag can be a different object entirely in a column next to four hundred competitors.

That is not an argument against publishing. It is an argument for knowing, before a field is designed, whether the value is one you would be comfortable seeing sorted. And it is why the access question is a commercial question rather than a technical one.

## Personal data, and the answer the same legislature gave next door

The framework's position on personal data is a consent gate rather than a prohibition. Article 10 provides that personal data relating to customers is not to be stored in a passport without their explicit consent, referring across to the data protection regulation. A recital puts it more flatly and says personal data of customers should not be stored in a passport. The recital is the policy and the article is the rule, and the article leaves a door open that the recital does not.

Our own view is that the door should not be used, and the reason is the object rather than the law. A passport is reached from a printed code on something that is sold, resold, lent, altered and eventually sorted by somebody who has never met the first owner. The code cannot be withdrawn, the consent was given by a person who is no longer in the picture, and the record is designed to outlive the product. Access control can protect the data behind the carrier. It cannot make a consent given at first sale mean anything to the fourth owner. So the operational rule this estate applies is to keep personal data out of the record entirely rather than to design a consent flow for it.

There is a second question underneath the first and it is about the scan rather than the record. Whether measuring the people who use a compliance carrier is permitted at all is not a question the framework answers, and one European regime that already places mandatory product information behind a code answered it in the opposite direction and refused consent as a cure. That comparison, its limits and the reasons it does not simply transfer to clothing are set out on [what a scan actually tells you](https://activatedigital.ai/knowledge/evidence/what-a-scan-tells-you).

## Restricted access and personal data are different questions

A separate confusion shows up in data models rather than in policy: **restricted is not a synonym for personal**.

A field can be commercially restricted without relating to any identifiable person - a supplier price, a process parameter, a formulation. And a field can be personal data even though exactly one authorised role can see it. The two properties are set by different instruments and answer different questions, so `restricted = true` is not a usable proxy for `personal_data = true`.

Track both, separately:

| Property | Question it answers | Where the answer comes from |
|---|---|---|
| `access_class` | Public, restricted, or limited to a named role? | The applicable product rule's access provisions |
| `eligible_actor` | Which actor class may reach it? | The same product rule |
| `access_condition` | What has to be true for that actor to reach it? | The same product rule |
| `personal_data` | Does this relate to an identified or identifiable natural person? | Data-protection law, read against the actual context |

Recording an access class as a property of the whole passport - a "public passport" or a "private passport" - loses the distinction before it can be used, because the product rule works at field and role level.

For where data-protection duties can arise around a passport, and for the boundary between Registry account data and passport content, see [where GDPR may apply to DPP-related data](https://activatedigital.ai/knowledge/passport/personal-data-and-gdpr).

## What the industry has asked for, and where it meets the enacted text

The sector's trade association published a position on the apparel passport in March 2026, and it is the clearest available statement of what businesses in this industry want protected. It asks for access differentiated by user category, for access limited to what is strictly necessary for each user, for a clear separation between public, restricted and confidential data, and for protection against automated data extraction and misuse. It asks that disclosure of factory names, locations and operator identifiers remain optional, on the ground of business confidentiality and competitiveness. And it names what it means by confidential business information: supplier and customer networks, specific materials, formulations and production processes.

An industry position is evidence of what part of an industry is asking for. It is never evidence of what an act will require.

Two of those asks are already in tension with the framework as enacted.

**Facility identifiers.** Annex III lists unique operator identifiers other than the manufacturer's at point (h) and unique facility identifiers at point (i), so both are already inside the set a textile act may draw on. Article 12 goes further. Where either identifier is not yet available, the operator that creates or updates the passport is to request one on behalf of the relevant actor, after first seeking confirmation from that actor that none exists, and is to pass the issued identifier back to them. That is an obligation to obtain identity, pointed at exactly the layer the position paper wants kept optional. Whether an obtained identifier is then published is a different question and the delegated act will answer it. But the obligation to obtain sits in the enacting terms and the discretion to withhold does not.

**Automated extraction.** Article 14's portal exists so that stakeholders can search and compare. A field a delegated act marks public is a field designed to be compared in bulk, by anybody the access rights admit. Protection against automated extraction of public fields and a comparison portal are not obviously compatible objectives, and only one of them is in the enacted text. The ask is coherent for restricted fields, which is where it should be pointed.

None of that makes the asks unreasonable. It makes them asks about the delegated act, which is the only instrument that can grant them, and it means a business planning on the assumption that they will be granted is planning on a hope.

## The one sector far enough ahead to have faced this has not finished either

Batteries are years ahead of textiles and are routinely offered as the worked example of how access tiering will look.

The battery regulation does contain a tiered structure, with different parts of the passport available to different audiences. We could not reach those provisions or the annex behind them at their own text on any route, so this page states that the structure exists and reproduces none of it. A secondary account of the tier mapping was obtained and is not published here, because a Commission document appears to cut against it and publishing a mapping that a Commission document contradicts would be the worst outcome available.

What we did reach, at the Commission's own presentation for that sector of May 2026, is the shape of what is still missing. An implementing act is to specify which persons are to be considered persons with a legitimate interest, to which of the listed information they are to have access, and to what extent they can download, share, publish and re-use that information. As at the date of that presentation the act had not been adopted: a working document had been circulated to the battery expert group in April 2026, a draft was to be published for consultation in the following months, and the Commission's own scheduling placed the act in the last quarter of 2026.

Whether a party who may see a value may also republish it is a different question from whether they may see it, and in the one sector far enough ahead to have faced it, it is being answered by a further instrument rather than by the regulation.

So the lesson from batteries is not a template to copy. It is that a tiered structure in a regulation leaves the operationally decisive questions to an instrument that comes later, and those questions are the ones a business needs answered.

The same shape is visible in the textile preparatory work. The study on passport content contains a section on access rights, including an assessment of access rights levels, and a section on data governance covering roles and responsibilities, acquisition and update, storage, integrity and verification. This estate established that both sections exist and where they sit, and could not read either. So even the proposal stage of the textile answer is written down somewhere and is not available to read.

## What to keep out, and how to decide the rest

Five rules survive with no act at all. They are not compliance requirements, because there is nothing to comply with. They are the decisions a business is taking whether or not it takes them deliberately.

**Keep personal data out of the record entirely.** Not behind consent, not behind a tier. The record outlives the arrangement that authorised it, and no tier you set today follows the garment through four owners.

**Decide, for each field, which of the two questions it belongs to.** Is this a value you would print on the swing ticket, or a value you would show only to a named audience. The first goes in the public view. The second goes in the record with the access question written down beside it, and waits. What must not happen is a field entering the public view because nobody asked which of the two it was. Treating an unrestricted view as a semi-private channel is the most common design error in this category, and it is made once and discovered later.

**Hold the evidence separately from the value.** A value can be published without publishing the working, and the working is where supplier names, prices, formulations and internal method usually live. A system that stores the two in one object has decided a confidentiality question by accident. Who stays responsible for a value once it is out, and what a sign-off consists of, is on [who has to own this](https://activatedigital.ai/knowledge/evidence/owning-a-published-field).

**Ask what each audience can act on rather than what is easy to expose.** A recycler asking for end-of-life handling and receiving a marketing page has been given something worse than nothing. What a request reaches, and what a conformant resolver is and is not required to do when it holds nothing, is on [what happens when you scan](https://activatedigital.ai/knowledge/passport/what-happens-when-you-scan).

**Write down the access decision you took and why.** Where the law supplies no procedure, the record is the procedure. When an act arrives and names actors and tiers, a business that can say what it published to whom, and on what reasoning, is doing an afternoon's mapping. A business that cannot is doing an audit.

One thing this page will not do is give you a tiering model. There is no authority behind one, the standard that would supply the vocabulary is behind a purchase and is unread here, and a model invented for the purpose would be exactly the thing this estate exists to correct in other people. What can be said is which questions a tiering will have to answer, and those are the five above.

## Role-based variants are not cryptographic selective disclosure

UNTP describes **variant-based disclosure**, where different complete credential variants can be routed to different roles or audiences.

That is not the same as cryptographic selective disclosure, where a holder can reveal selected claims from one credential while withholding the rest using specialised cryptographic techniques such as SD-JWT or BBS+-style approaches.

UNTP explicitly treats those as different patterns. Its variant approach is an emerging interoperability design, not a statement of EU statutory access rights and not a mandate to use cryptographic selective disclosure.

“Only this role can see this data” can be achieved at several layers: by choosing a different document variant, by authorising access to a service, by encrypting data or by using selective-disclosure cryptography. The law defines the access right. The implementation decides how to enforce it within the permitted technical framework.

For the wider protocol, see [what UNTP is and how it works](https://activatedigital.ai/knowledge/product-data/untp).

## What would change this page

A textile act naming actors and access levels, at which point most of this page is replaced rather than revised.

The reference of the access rights standard being published in the Official Journal, which would give the subject its first document carrying a presumption of conformity.

The implementing acts on digital credentials, which Article 11 empowers the Commission to adopt and which would be the first description anybody has of how an access right is actually asserted at a resolver.

An implementing act in any sector defining who counts as a person with a legitimate interest and what they may do with what they see, which would be the first worked answer anybody has to the question this page is about.

## Who Can See What in a Digital Product Passport?

**Not all Digital Product Passport information is universally public.** DPP access depends on the applicable law, the product category, the information involved, the actor asking for it and implementation rules that may still be pending. The Battery Passport, the strongest adopted example, already separates public, authority-only and legitimate-interest information. That is useful evidence that DPPs can support controlled access, **not** a template to copy into every category before the relevant law says so. All categories: [Digital Product Passport Requirements by Product Category](https://activatedigital.ai/knowledge/digital-product-passport).

## The core access rule

ESPR establishes a role-based DPP architecture and requires product-specific measures to determine access to the relevant data.

So there are three different questions:

- **Can someone scan or reach the passport?**
- **What information are they authorised to see?**
- **What may they download, share, update or reuse?**
A visible QR code does not imply that every underlying field is public.

## Access classes that can appear

These are useful actor concepts found across the current framework and adopted regimes. They should not be treated as one mandatory universal list.

| Actor / access concept | Why it can matter |
|---|---|
| **Consumers / public** | Product information intended for customer or general-public access. |
| **Market-surveillance authorities** | Enforcement and compliance verification. |
| **Customs authorities** | Border verification and Registry-linked processes where applicable. |
| **Notified bodies** | Conformity-assessment access in regimes where their role requires it. |
| **European Commission** | Regulatory/system access where provided by the law. |
| **Economic operators** | Manufacturers, importers or other actors involved in the regulated product. |
| **Repair, reuse, remanufacturing or recycling actors** | Can require restricted technical/lifecycle information for legitimate downstream activities. |
| **Legitimate-interest actors** | A legal access concept used explicitly in the Battery regime, with detailed qualification rules still requiring implementation. |
| **Restricted / confidential** | Information that should not be exposed as if it were consumer-facing merely because it belongs in the passport architecture. |

## Battery Passports: the clearest adopted role-based example

Battery law provides the most developed current access model.

### General public

Annex XIII Part 1 contains information accessible to the general public. The public set includes broad identity, technical, sustainability, performance and end-of-life information where applicable.

### Authorities, notified bodies and the Commission

Annex XIII Part 3 reserves test-report results proving compliance for notified bodies, market-surveillance authorities and the Commission.

### People with a legitimate interest

Annex XIII Parts 2 and 4 contain more sensitive information for legitimate-interest actors. Examples include:

- detailed cathode, anode and electrolyte composition
- component part numbers and spare-source information
- detailed dismantling information
- safety measures
- individual performance and durability values
- state of health
- battery status
- charging and discharging cycles
- negative events
- operating conditions and state-of-charge information.
The purposes linked to legitimate interest include repair, remanufacturing, second life and recycling, as well as defined purchaser and energy-market use cases.

### The access-rights implementation gap

Article 77(9) required an implementing act by **[18 August 2026](https://activatedigital.ai/knowledge/digital-product-passport/timeline)** specifying who qualifies as a person with a legitimate interest and the extent to which relevant data may be accessed, downloaded, shared, published or reused.

As at 1 September 2026, the current primary-source verification did not identify that act as adopted. The Commission's implementation roadmap still places the Battery access-rights implementing act in **Q4 2026** and labels its timeline indicative.

This does **not** make the Battery access architecture unknown. The Regulation already establishes the access classes and data territories. It means a layer of detailed legitimate-interest implementation is still pending.

## Detergents & surfactants: actor classes adopted, allocation pending

The 2026 Detergents and Surfactants Regulation identifies actor groups that must be able to access the DPP in accordance with access rights to be set through the technical implementing act.

The groups include:

- consumers or other end-users
- market-surveillance authorities
- customs authorities
- the Commission
- other economic operators.
The future Article 21(10) implementing act must determine, among other matters, **which actors can access which data** and who may create or update information.

**The regime is adopted and role-based, but the detailed actor-to-data matrix is implementation pending.**

It would be wrong to fill that gap by importing the Battery Annex XIII tiers.

## Toys: consumers are an explicit audience, detailed role mapping is pending

The Toy Safety Regulation identifies consumers/end users, authorities, customs, notified bodies, the Commission and other economic operators as relevant DPP audiences.

Detailed access allocation is to be set under the Commission's delegated technical rules.

So the adopted regime tells businesses that the DPP must support multiple actor classes. It does not yet justify publishing a definitive field-by-field access table for toys before those rules are adopted.

## Construction products: role-based framework, operational detail pending

The Construction Products Regulation contains an adopted DPP-system framework that provides for access appropriate to relevant market actors and authorities.

The [construction DPP system](https://activatedigital.ai/knowledge/category/construction-products) still requires delegated action to become operational. So access details should be described as part of an **adopted framework with implementation pending**, not as a finished universal access model.

## Vehicles: free access is established, the final DCVP access matrix is not

Regulation (EU) 2026/1738 states that access to the Digital Circularity Vehicle Passport is free of charge. That does **not** establish that every DCVP field is public to every actor.

The Commission still has to define the access conditions and rights, together with data-protection and intellectual-property treatment, through Article 13(6)(d) implementing rules by 14 August 2030.

For now, DCVP is another useful example of why “free access”, “public data” and “role-based access” should not be collapsed into one concept. A final role-by-field permissions matrix is not yet established.

See the [EU Digital Circularity Vehicle Passport](https://activatedigital.ai/knowledge/vehicle-passports/digital-circularity-vehicle-passport) owner for the wider vehicle-passport position.

## Textiles: development evidence, not a final access matrix

Official textile preparatory work considers differentiated access to textile DPP information.

That is useful for readiness because it shows the Commission/JRC work is thinking about public and restricted information rather than assuming one fully public record.

It is still preparatory evidence.

Until the textile delegated act is adopted, statements such as:

- “consumers will see all factory details”
- “all suppliers will be public”
- “recyclers will get a fixed confidential dataset”
should not be presented as final textile DPP law.

## What can consumers see?

There is no one cross-category product-field answer.

What can safely be said is:

- DPP regimes are designed to provide appropriate product information to users, including consumers where the applicable law provides for it
- some adopted regimes expressly create consumer/public access
- the exact fields available to consumers are category-specific
- restricted technical, enforcement or commercially sensitive data can coexist with public information.
So the consumer interface should render **the user's permitted view**, not assume that the underlying data store is itself fully public.

## Can regulators see more than consumers?

Yes, in adopted examples. Battery test-report results and other information can sit in classes closed to the general public, and toy and detergent law recognise authorities as distinct access actors, with detailed technical allocation still to come.

**Design permissions as a first-class part of the DPP system. Do not build one undifferentiated public page and try to bolt confidentiality on later.**

## What can customs access?

Customs is part of the DPP enforcement architecture in ESPR and linked sector laws.

The DPP Registry supports regulatory and customs processes through registered identifiers and mandatory registration data. Product-specific legislation can then define the access and verification mechanisms relevant to that sector.

This is another reason to keep **Registry access**, **passport data access** and **public webpage access** conceptually separate.

See [EU DPP Registry: Where Passport Data Actually Lives](https://activatedigital.ai/knowledge/regulation/where-passport-data-lives).

## What does “legitimate interest” mean in the Battery Passport?

It is a legal access category for actors who need defined non-public information for recognised purposes.

The Battery Regulation connects it to activities including:

- repair
- maintenance
- remanufacturing
- second-life operations
- recycling
- defined purchaser/energy-market purposes.
Exactly who qualifies, which information they can access and what they may do with it were the subject of the Article 77(9) implementing act that remained pending at the 1 September 2026 verification point. So “legitimate interest” should not be turned into a self-declared universal permission group in software without following the final implementing rules.

## Can competitors see sensitive DPP data?

Do not assume so.

The legal architecture supports restricted access. Whether a competitor qualifies for any non-public information depends on the applicable regime and the access right being claimed.

A business should not expose commercially sensitive material merely because it has been gathered for DPP compliance.

Conversely, “confidential” should not be used as a reason to suppress information that the applicable law requires to be public.

The permission model needs to reflect legal access classes at field or information-territory level.

## Are supplier and factory details always public?

No.

First, factory/facility information is not a universal DPP field. Second, where a category does use facility information, the law must still determine whether it is public or restricted.

Battery law includes manufacturing-plant location in its adopted passport architecture. Textile production-site concepts remain in development. Toy factory/storage addresses belong in technical documentation rather than the mandatory DPP field list.

See [Factory, Manufacturing Location and Country of Origin in Digital Product Passports](https://activatedigital.ai/knowledge/digital-product-passport/factory-origin).

## Will access rules be the same across categories?

No evidence supports that assumption.

Battery, detergent, toy and construction legislation already show different stages and structures:

| Category | Current access position |
|---|---|
| **Batteries** | Adopted explicit public, authority and legitimate-interest data classes; detailed legitimate-interest implementation pending. |
| **Detergents & surfactants** | Actor classes adopted; detailed actor-by-data allocation pending implementing act. |
| **Toys** | Multiple actor classes recognised; detailed technical allocation pending delegated rules. |
| **Construction products** | Role-based framework adopted; operational detail pending. |
| **Textiles & apparel** | Access concepts appear in preparatory work; final law not adopted. |

## How should businesses design permissions now?

### PREPARE

**Classify information by audience.** At minimum, distinguish public candidate data, authority/compliance data, partner/restricted data and sensitive internal evidence.

**Keep access metadata separate from the value itself.** A product fact should be capable of changing audience without rebuilding the product-data model.

**Model roles, not named one-off users.** Consumer, authority, customs, notified body and legitimate-interest concepts can become permission policies.

**Retain provenance.** Know why a field is public or restricted and which legal source supports that decision.

**Separate read from update rights.** Being able to see information does not automatically mean being allowed to create, modify, download, republish or reuse it.

### WATCH

- Battery Article 77(9) implementing act
- detergent Article 21(10) technical implementing act
- toy Article 49 technical rules
- construction DPP-system delegated act
- future textile access rules
- horizontal service-provider and standards developments.

### DO NOT HARD-CODE

- all fields public
- Battery access classes as the template for every category
- factory details always consumer-visible
- one “logged in / logged out” switch as the entire access model.
To [apply permissioned access to one product identity](https://activatedigital.ai/product-protection) rather than to a whole catalogue, ActivateDigital resolves the identity and returns only what the authenticated role is permitted to receive.

## Direct answers

### Is all DPP information public?

No. Adopted DPP law already supports restricted and role-based information.

### Can regulators see more than consumers?

Yes in adopted examples, especially batteries.

### Can competitors see sensitive information?

Not automatically. Access depends on the applicable law, role and information class.

### Are supplier or factory details always public?

No. Those fields are not universal and their access treatment is category-specific.

### Will textile access work like Battery access?

Not established. Textile access rules are not final.

## Related

- [What Repair Information Can a Digital Product Passport Actually Provide?](https://activatedigital.ai/knowledge/evidence/repairers) — repairer and refurbisher access in practice

## Keep exploring

The question this one usually raises next.

- [Broader questionPassport technologyA passport, annotatedOne record row by row, including the rows that stayed empty and the reason written on each.→](https://activatedigital.ai/knowledge/passport)
Also worth reading

- [Evidence behind thisEvidence & suppliersHow we know, and what a blank meansThe vocabulary this estate uses for what is established, what is not and what nobody has looked for.→](https://activatedigital.ai/knowledge/evidence)
- [Related questionRules & scopeThe two that were left outThis page's most time-limited position is that the two standards outside the citation are the two about protecting the data. Which standards are cited, which are drafts and what a citation changes is tracked separately.→](https://activatedigital.ai/knowledge/status/standards)
- [Regulation (EU) 2024/1781 (ESPR), Articles 9–13 and Annex III](https://eur-lex.europa.eu/eli/reg/2024/1781/oj)
[View official source](https://eur-lex.europa.eu/eli/reg/2024/1781/oj)

- [Regulation (EU) 2023/1542 concerning batteries and waste batteries, Articles 77–78 and Annex XIII](https://eur-lex.europa.eu/eli/reg/2023/1542/oj)
[View official source](https://eur-lex.europa.eu/eli/reg/2023/1542/oj)

- [European Commission, Digital Product Passport implementation timeline](https://single-market-economy.ec.europa.eu/single-market/digital-product-passport_en)
[View official source](https://single-market-economy.ec.europa.eu/single-market/digital-product-passport_en)

- [Regulation (EU) 2026/405 on detergents and surfactants, especially Article 21 and Annex VI](https://eur-lex.europa.eu/eli/reg/2026/405/oj)
[View official source](https://eur-lex.europa.eu/eli/reg/2026/405/oj)

- [Regulation (EU) 2025/2509 on toy safety, Articles 19–23, 49 and Annexes V–VI](https://eur-lex.europa.eu/eli/reg/2025/2509/oj)
[View official source](https://eur-lex.europa.eu/eli/reg/2025/2509/oj)

- [Regulation (EU) 2024/3110 on construction products, Articles 75–80](https://eur-lex.europa.eu/eli/reg/2024/3110/oj)
[View official source](https://eur-lex.europa.eu/eli/reg/2024/3110/oj)

- [JRC/Product Bureau, Study in support of the Digital Product Passport for textiles: *This resource explains regulatory access architecture. It is not personalised legal advice.*](https://susproc.jrc.ec.europa.eu/product-bureau/sites/default/files/2026-05/Textiles_DPP_20260513.pdf)
[View official source](https://susproc.jrc.ec.europa.eu/product-bureau/sites/default/files/2026-05/Textiles_DPP_20260513.pdf)