Do I have to make business-sensitive data about my clothing and textiles public?
Not everything is made public: the passport has different access levels
Business-sensitive data should not automatically be visible to everyone. The digital product passport is intended to make certain information about a garment or textile product accessible, but that does not mean that all underlying data becomes public knowledge. Article 10 of the ESPR (Regulation (EU) 2024/1781) describes that the passport can operate with differentiated access: some data is available to everyone via the QR code, and another part is only accessible to specific parties, such as market surveillance authorities, customs or other actors in the supply chain. Which data falls into which category is determined per product group in the delegated act that applies to that group. For clothing and textiles, that act is not yet available, so the precise classification for this sector does not yet exist.
Which data this applies to, and which it does not
This distinction concerns data that is relevant to the product, but whose disclosure is not necessary to achieve the objectives of the regulation — think of detailed formulation of a treatment, the identity of a specific sub-supplier, or technical specifications that go beyond what a consumer or market surveillance authority needs. It applies to the actors who must submit data for the passport under Article 38 of the ESPR: manufacturers, importers and other actors in the supply chain.
It is not about business data that falls outside the scope of the passport anyway, such as purchase prices, profit margins or internal business processes that are not part of the product information that the regulation aims for. Those do not belong in the passport, period. It is also not about an exemption from data that market surveillance authorities need for their task: information that is relevant to market surveillance may well need to be accessible to those authorities, even if that same information is not shown to the general public. Limited access is therefore different from confidentiality for everyone.
No fixed date yet for the precise classification
When it is established for clothing and textiles which data are public and which have limited access is not yet fixed. According to the European Commission's work plan for 2025-2030, the delegated act for this product group is expected in 2027, with clothing consisting eighty per cent or more of textile fibres as the first category. This is not yet a legally fixed date, but it is the planning as it currently stands. Until the delegated act is available, only the general frameworks from Article 10 and Article 38 of the ESPR apply: these describe that a system of differentiated access can exist, but not which specific data for clothing will fall into which category. Once the act is published, this will be supplemented here.
What a brand or importer can do with this now
The order in which this is usually tackled looks roughly like this:
First, create an overview of the data already being collected for existing labels, certifications or supply chain communication — composition, origin, treatments, supplier information. Next, make a rough distinction between data that are public in nature (such as fibre composition or washing instructions) and data that are more sensitive (such as the identity of a specific production location or a recipe). After that, it is a matter of waiting to see how the delegated act for textiles makes that distinction concrete, and arranging your own data structure so that data can later be easily labelled by access level without having to reset everything. Finally, it is worthwhile to align with suppliers and other parties in the chain about who needs which data and at what point, since Article 38 specifically regulates that mutual data exchange — this is a different matter than what will then be visible to the end user or supervisory authority.
Where this is stated: Article 10 and Article 38 ESPR
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes the requirements that the digital product passport must meet, including the possibility of differentiated access to the data contained in it. Article 38 of the same regulation describes the requirements for actors in the supply chain, including which data they must make available to each other and to competent authorities — an obligation that is separate from disclosure to the general public. The precise elaboration for clothing and textiles, including which data fall under which access level, follows from the delegated act for this product group still to be published.
What to do now
Those now collecting data for the future passport would do well to structure that data in such a way that a distinction by access level can be made later, and to involve their own suppliers in the question of which information they are willing and required to share. For the definitive classification of data into public and restricted access, the publication of the delegated act for textiles remains the moment to follow; this page will be updated as soon as it is available.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 38 (requirements for actors in the supply chain)
The regulation itself is available on EUR-Lex. We provide references for each statement; you do not need to take our word for it.
What you must do concretely
What is expected of you
The digital product passport makes information about clothing and textiles accessible to parties outside the company: consumers, supervisory authorities, recyclers, market participants further down the chain. This immediately raises a question for many companies: what does this mean for data they prefer not to share, such as supplier names, treatment formulations or procurement prices. The ESPR (Regulation (EU) 2024/1781) does not regulate this with a simple yes-or-no rule, but with a distinction between what must be included in the passport and who is allowed to access it.
Only the prescribed data go into the passport
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes which categories of information a digital product passport must contain. This is a defined set, focused on matters such as composition, origin of materials and use information — not an open invitation to disclose everything a company knows about a product. For a company with 10 to 100 employees, this means in practice that the passport is a selection, not a complete file export. Which fields are exactly mandatory for clothing and textiles is described on the page about which data appears in the product passport for clothing and textiles. Whoever compiles the passport therefore determines in advance which data do and do not fall under the prescribed categories — and this distinction is the starting point of any discussion about business-sensitive information.
Not every user of the passport sees the same data
A second layer is the question of who sees which data. The passport is not by definition a single publicly accessible file with all information for everyone. A distinction is made between data that are visible to consumers and data that are only accessible to supervisory authorities, market participants in the supply chain or other designated parties. For a company concerned about competitively sensitive details, this distinction is often more relevant than the question of whether something is "in the passport". The access rights and the role distribution involved are worked out on the page about who may access which data from the digital product passport. In practical terms, this means that when setting up the passport, a company must also consider which level of access is appropriate for which piece of data, rather than lumping everything together.
Actors in the chain supply data, not on a voluntary basis
Article 38 of the ESPR (Regulation (EU) 2024/1781) describes what is expected of actors in the supply chain when it comes to providing information for the passport. For brands and importers working with multiple suppliers, this means that agreements about what is passed on and in what form are not merely an internal matter but are linked to a legal framework in which supply chain partners must be able to provide data to each other. A company of this size typically does not have the capacity to conduct a unique process for each supplier; it is then more practical to use a single fixed format for what is requested and what is returned.
Where things go wrong in practice
A number of situations come up regularly with companies setting up the passport for the first time.
First: supplier data are put into free text fields without thinking, while those fields may be visible more broadly than expected. Without a clear distinction between what is mandatory and what is optional, information slips in that should not have.
Second: a company assumes that "digital passport" means "publicly accessible to everyone", and therefore refrains from filling in fields that are mandatory. This results in an incomplete passport, not in less risk.
Third: formulations of chemical treatments are copied literally from internal quality documents, including supplier name and concentrations, when only the type of treatment applied needs to be stated. See also the page about this which chemical treatments must be reported.
Fourthly: when working with a private label partner, it is not documented who is responsible for which part of the data, which may result in commercially sensitive information from one party ending up in the passport of the other by mistake.
Fifthly: data on recycled material is shared including the name of the recycling partner and the procurement route, whereas the share of recycled fibre in itself is sufficient as data. More on this can be found on the page on how the share of recycled fibre is demonstrated.
What you can record
- An overview of which data is mandatory in the passport and which falls outside it, so that no more is shared than necessary.
- Agreements with suppliers on which data they provide for the passport and in what form, including who bears which part of the responsibility.
- An internal assignment of access levels: which data is visible to consumers, which data only to supervisory authorities or supply chain partners.
- A fixed format for submitting technical information (for example on fibre composition or treatments), so that suppliers do not determine for themselves which details are sent.
- A reference to the company's own documentation on material origin and composition, kept separate from what is ultimately published in the passport — for example to be organized according to the approach on the page on recording the fibre composition.
This is not legal advice. This page provides general information about the regulations that this platform covers. We are not familiar with your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something wrong? Let us know — corrections are given priority.