how is it prevented that someone hacks or forges my product passport data

Security is built in by design, not added on afterwards

The digital product passport is constructed in such a way that data cannot be altered without notice and it is clear who has supplied which information. The ESPR stipulates that the digital product passport is technically set up so that the origin of data is established, that modifications are traceable to the party that made them, and that access to amend data is limited to those entitled to do so. This is not a separate security layer that a platform adds on top, but a requirement that is anchored in the core of the passport itself: each passport has a fixed, unique link to the product, and that link — including the history of what has been entered in it — must be verifiable.

For whom this applies, and what falls outside

This requirement applies to the passport as a whole: the way data is stored, who may modify it, and how traceable it is what was entered when. So it is not about the question of whether a passport is "hack-proof" in the sense that every form of misuse is made technically impossible — no system provides that guarantee, and the ESPR does not promise that either. It is about safeguards against unauthorised access and against manipulation without it being traceable. Also important to distinguish: the security of the data in the passport is different from the question of how someone gains access to the passport. The latter is via the QR code on the product and, where applicable, via GS1 Digital Link as the technical standard for that link. The security that this article is about is therefore not in the QR code itself, but in the system behind it where the data is stored.

Furthermore, this does not include the question of who is substantively responsible for the accuracy of the data. A secure system prevents an unauthorised third party from altering something; it does not prevent the party supplying the data from making a mistake. For that subject — a mistake once entered — there is a separate answer about amending a mistake in a published passport.

No fixed date yet, but a fixed direction

When these requirements are concretely implemented for clothing and textiles depends on the delegated act that the European Commission draws up for this product group. According to the current work plan, this is expected in 2027, with clothing that is eighty per cent or more composed of textile fibres as the first category. An exact date on which the digital product passport — and with it the security requirements in practice — becomes mandatory for clothing has not yet been set. What is already established is the framework from the ESPR itself: the articles on requirements and technical design of the passport serve as the basis, and the delegated act further elaborates these for each product group. As soon as that act is published, this page will be updated with the date that then applies.

What this means in practice for setting up a passport

The first step is to know that the origin of data has a fixed place in the system: for each piece of information in the passport it is established who has supplied it and when. This means that a clothing brand or importer that passes data to the party that compiles the passport does not need to be separately concerned about the technical protection against manipulation — that is built into the design of the passport itself, not into what the supplying party adds to it. Where attention is paid is on your own side of the process: how data is supplied and whether that process itself is verifiable. Anyone considering having data pass directly from their own business system, for example by linking the passport to an ERP or inventory systemwould be well-advised to look at how that link itself is secured — because a leak on that side of the line undermines the reliability of the passport just as much as a weakness in the passport itself.

A second point to keep in mind: the question of protection against counterfeiting is closely linked to the question of how long data must remain available and reliable. For that subject there is a separate answer about how long a passport must remain available — security is not something that is in order once at publication, but something that must be maintained throughout the entire lifespan of the passport.

The legal basis: articles 10 and 11 of the ESPR

These requirements follow from article 10 of the ESPR (Regulation (EU) 2024/1781), which sets out the general requirements for the digital product passport, and from article 11 of the same regulation, which specifically addresses the technical design and operation of the passport. Together, these articles form the framework within which the origin of data, access control and traceability of changes are regulated. The precise technical implementation — which standards, which protocols — is further detailed in the delegated and implementing acts that the Commission establishes per product category.

Anyone preparing a product passport now would do best to start with the basics: ensuring that each product receives a unique product identification code and checking which data will end up in the European product passport register — the security of the passport is built on that underlying structure.

What this is based on

The regulation itself is available on EUR-Lex. We provide references for each statement; you do not need to take our word for it.

What you must do concretely

What is expected of you

Setting access to data correctly

Article 10 of the ESPR (Regulation (EU) 2024/1781) distinguishes between data that is accessible to everyone and data that is intended only for specific parties, such as supervisory authorities or market players further along the chain. For a company with 10 to 100 employees, this means in practice that not all information that exists about a product should be visible to the consumer who scans the QR code. Whoever has the passport compiled indicates which data are public and which remain of limited access — this classification is not fixed in a technical system, but follows from the data that is provided.

Ensuring that data cannot be changed unnoticed

Article 11 of the ESPR describes requirements for the technical design and operation of the digital product passport, including the reliability of the data contained in it. This directly raises the question of whether someone can tamper with a passport afterwards. For a brand or importer, this means that the data that has been submitted and published must remain traceable to the source and the time of submission. A subsequent change is therefore not a matter of 'adjusting the file', but of a new, traceable version.

Keeping a record of who submitted which data

A third practical expectation that follows from the same articles is that it must be demonstrable who submitted which data and when. For companies with multiple brands, private labels or multiple manufacturers supplying under one legal entity, this means that the administration surrounding submission — who sent which certificate, which composition, which care instruction — must be in order. This is not only a matter of security against hackers, but also of accountability: if a passport proves to be incorrect, it must be possible to trace where that information came from.

Preventing the passport from becoming an easy target for copying

The question 'can someone counterfeit my passport' is often not about the passport itself, but about the data carrier: the QR code on the garment. A QR code that simply links to a URL can be copied onto a counterfeit product. How that data carrier is applied and what link it creates with the unique identity of the product partly determines how difficult that is. More about the way in which that code ends up on the garment is described on the page about how the QR code for the product passport comes onto clothing and textiles.

Where things go wrong in practice

A first common situation: a company has a supplier or external agency fill in the passport, but does not itself retain a copy of what was exactly delivered. If a question later arises about the accuracy of a data point, it is no longer possible to reconstruct who entered that data and on the basis of which document.

A second situation arises when a production line is adjusted — a different fibre composition, a different washing instruction — but the existing passport is not updated accordingly. The passport then remains online with outdated information, which may look like a forgery while it is actually a management error. This raises the question of how to correct an error in an already published passport, which is described in more detail on the page on discovering an error in a published product passport.

A third situation: a QR code is printed separately from the product on a label that is easy to remove and transfer to another garment. Without a strong link between the code and a unique identification of the specific product, falsification by simply replacing a label is straightforward. How a product receives a unique, non-transferable identification is described on the page on giving each product a unique identification code.

A fourth situation occurs at companies that themselves build a link between their ERP system and the passport, without making it clear who within the organization has access to modify data. If multiple employees can write to the underlying system without control, a risk emerges that does not come from outside, but from within. Anyone considering linking their own system will find more on the points to watch on the page on linking the product passport to your own ERP or inventory system.

A fifth situation: a company discontinues a collection or switches to a different partner, and no one thinks about what happens to the already published passports. A passport that is no longer maintained but remains online is a more attractive target for misuse than a passport that is actively managed.

What you can record

An overview of who within the organization (or at an external party) is authorized to supply or modify data, including the date on which that authorization was granted.
A copy of all documents supplied for the passport — certificates, composition declarations, washing instructions — linked to the date of supply and the name of the supplying party.
A documented procedure in case an error is discovered in a published passport: who may request the modification, and how is that modification documented.
Agreements with suppliers or manufacturers about who is responsible for the accuracy of which part of the data, especially relevant when a product falls under multiple product passports at the same time together.
An overview per product variant — size, colour, composition — of which unique identification has been assigned to it, so that it can later be verified whether a code belongs to the correct product; see also the page on whether each size and colour receives its own product passport.
A documented decision about what happens to the passports when a business activity or brand is discontinued, so that this is not decided ad hoc at the moment it occurs.

This is not legal advice. This page provides general information about the regulations that this platform covers. We are not familiar with your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.

Written with AI based on the sources above, checked by a human on 2026-09-05. Is something not right? Let us know — corrections are given priority.