What are the key GDPR principles to apply to a DPP program?

Brands should apply data minimisation, collecting only necessary personal data, and purpose limitation, ensuring data isn't repurposed without a legal basis. Storage limitation requires defining retention periods, and transparency mandates clear privacy information for consumers if their data is processed.

What is the tension between DPP data retention and GDPR right to erasure?

The tension arises because DPPs often require long-term data retention for product records, while GDPR grants individuals the right to erasure of personal data. The solution is architectural: designing DPPs to store personal data separately from product data, allowing individual data erasure without compromising product records.

What are best practices for GDPR-compliant DPP implementation?

Best practices include conducting a Data Protection Impact Assessment (DPIA), mapping all data flows, implementing privacy by design (defaulting to company-level data), reviewing supplier contracts for GDPR data processing agreements, and appointing a clear data controller for the DPP system.

GDPR and Digital Product Passport: What Brands Need to Know

Q: Does the Digital Product Passport contain personal data under GDPR?

In most cases, a DPP is designed for product data like materials and carbon footprint, which is not personal data under GDPR. However, if it includes details of individual artisans, small suppliers, repair technicians, or tracks consumer scans linked to user profiles, it can involve personal data and trigger GDPR obligations.

Q: When does GDPR apply to DPP data?

GDPR applies to DPP data when it includes personal information such as the names or contact details of individual suppliers or technicians, if consumer scan tracking correlates with user profiles, or if authentication systems link to individual identities. Brands must identify these scenarios to ensure compliance.

Does the Digital Product Passport contain personal data under GDPR?

In most cases, a Digital Product Passport (DPP) is designed to contain product data rather than personal data — material composition, carbon footprint, repair instructions and regulatory certifications do not constitute personal data under GDPR. However, certain DPP implementations may indirectly involve personal data, particularly in supply chain traceability contexts where individual artisans, small suppliers or repair technicians are identified.

When does GDPR apply to DPP data?

GDPR applies to DPP implementations in these scenarios:

Supplier identification — if your DPP includes the name or contact details of individual craftspeople or small sole-trader suppliers, this constitutes personal data under GDPR.
Consumer scan tracking — if your DPP platform tracks who scans the QR code and correlates this with user profiles or purchase history, you are processing personal data.
Repair and maintenance records — if repair logs include the name of the technician who performed work, this is personal data.
Authentication and provenance — some DPP systems use digital signatures linked to individual identities for anti-counterfeiting purposes.

Key GDPR principles to apply to your DPP programme

Data minimisation — only collect personal data that is strictly necessary. For most DPP use cases, company-level data (not individual employee data) is sufficient.
Purpose limitation — personal data collected for DPP purposes must not be repurposed for marketing or other uses without a separate legal basis.
Storage limitation — define retention periods for any personal data within your DPP system and implement automated deletion.
Transparency — if consumers scan a DPP QR code and their data is processed, you must provide clear privacy information at the point of scan.

DPP data storage and the GDPR right to erasure

A potential tension exists between the DPP requirement for permanent product records (some regulations require data retention for the product lifetime plus several years) and the GDPR right to erasure. The solution is architectural — design your DPP to store personal data separately from product data, so that personal data can be erased without breaking the product record itself.

Best practices for GDPR-compliant DPP implementation

Conduct a Data Protection Impact Assessment (DPIA) before launching your DPP programme
Map all data flows to identify where personal data enters the DPP system
Implement privacy by design — default to company-level rather than individual-level data
Review supplier contracts to ensure GDPR data processing agreements are in place
Appoint a clear data controller for the DPP system

Frequently Asked Questions

Is a Digital Product Passport subject to GDPR?

A DPP is only subject to GDPR if it contains or processes personal data. Pure product data — materials, emissions, certifications — is not personal data. However, supply chain data that identifies individuals, or consumer interaction tracking, may trigger GDPR obligations.

Who is the data controller for a Digital Product Passport?

Typically the brand or manufacturer placing the product on the EU market is the data controller for the DPP. If a third-party DPP platform processes data on your behalf, they are a data processor and require a GDPR data processing agreement.

Can consumers request deletion of DPP data under GDPR?

Consumers can request erasure of their personal data such as scan history linked to their identity. They cannot require deletion of product-level data, which serves regulatory and safety purposes and is subject to legal retention obligations under ESPR.