Who is allowed to view which data from the product passport?
Access varies by user, not everyone sees everything
The digital product passport is not a single set of data that is the same for everyone: the ESPR is based on layered access, where the type of user determines which part of the information is visible. A consumer who scans the QR code typically sees different data than a market surveillance authority, a customs authority, a recycler, or a next actor in the supply chain. Article 11 of the ESPR (Regulation (EU) 2024/1781) stipulates that access to information in the passport is tailored to the user category, and that a distinction can be made between generally accessible data and data intended only for specific parties, for example due to their confidential or commercially sensitive nature.
What this does and does not regulate
Article 10 and Article 11 of the ESPR describe the general framework: what kind of information a passport should in principle contain, how it works technically, and that access can be differentiated. What these articles do not do is specify exactly per product group which data are public and which are accessible only to market surveillance, customs or professional actors in the chain. That specification follows from the delegated act established per product group — for textiles and clothing it does not yet exist. The ESPR articles thus provide the framework (layered access, protection of confidential business information, distinction between user groups), but the concrete list of exactly who gets to see which data field in the clothing passport is not yet fixed. This distinction is relevant for those who want to set up their data management now: the framework is known, the exact access matrix for textiles is not yet.
No fixed date yet, but a fixed framework
There is no final date yet on which the access rules for the textile passport will become concrete. According to the ESPR work programme 2025-2030, the delegated act for textiles is expected in 2027, with clothing and textile products composed of eighty per cent or more textile fibres as the first category. That act must, among other things, determine which data are visible to the general public and which remain reserved for specific parties such as supervisory authorities or recyclers. Until that act is published, only the general provisions of Article 10 and Article 11 of the ESPR apply — so there is already a legal framework for layered access, but no product-specific elaboration for clothing and textiles yet. As soon as that act is published, this page will be updated with the concrete access rules.
How to handle this in practice
For anyone preparing a product passport now, it is useful to arrange their own data by sensitivity: data that can be public without objection (such as material composition or washing instructions) versus data that are more commercially confidential (such as supplier details, purchase prices or internal production codes). This classification aligns with the layered approach prescribed by the ESPR and makes it easier to quickly switch to the then-applicable classification once the delegated act for textiles is known. Next, it is advisable to check which data already have to be public under existing obligations (for example labelling of fibre composition), so that no duplication of work is needed there. Finally, it is worthwhile to set up your own data storage in such a way that data can be released or masked per user role, rather than putting everything in one undifferentiated file — this makes the transition to the final access rules easier, whatever form that takes.
The legal basis: Article 10 and Article 11 of the ESPR
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes the requirements that the digital product passport must meet, including the types of information that can be included in it. Article 11 of the same regulation specifically addresses the technical design and operation of the passport, and determines that access to the information contained in it is shaped on the basis of the access rights of the different categories of users, with room to shield confidential or commercially sensitive data from the general public. The precise implementation of this for clothing and textiles — that is, who exactly may view which data field — follows from the delegated act for this product group that is yet to be published.
What to do now
Anyone who wants to prepare in advance can best start by inventorying and categorising their own product data according to the degree of sensitivity, and arrange data storage in such a way that access per user role is adjustable. Once the delegated act for textiles has been published, the concrete access structure for the clothing passport will appear on this page.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 11 (technical design and operation of the digital product passport)
The regulation itself is available on EUR-Lex. We provide references for each statement; you do not need to take our word for it.
What you must do concretely
What is expected of you
The digital product passport is not a single accessible file from which everyone can read everything. Article 10 of the ESPR (Regulation (EU) 2024/1781) distinguishes between data that is visible to everyone and data that only certain parties may access, such as supervisory authorities, market actors in the supply chain or the product owner. Article 11 of the ESPR (Regulation (EU) 2024/1781) further describes how the technical design must support that distinction: through access rights that are linked to the data carrier and the underlying dataset.
For a company that places clothing or textiles on the market, this means that the structure of the passport must be thought through in advance: which part of the data is for the consumer who scans the QR code, which part is for the supervisory authority that performs an inspection, and which part is only intended for parties further down the supply chain.
Distinction between public and restricted access data
Part of the information in the passport is intended for everyone who scans the QR code: a consumer in the shop, a second-hand buyer, a recycler. Think of which data appears in the product passport for clothing and textiles, such as fibre composition or care instructions. Other data is not intended for open access, but for specific roles: a market actor performing a conformity check, a customs authority, or a recycling company that needs detailed material data. For a company with 10 to 100 employees, this means that when compiling the passport, a choice is made about which data becomes visible in which layer, and that choice is applied consistently across the entire collection.
Access for supervisory authorities
Article 10 of the ESPR (Regulation (EU) 2024/1781) provides for access for market surveillance authorities and customs, including data that is not publicly visible. This can include underlying test reports, supplier declarations or data on chemical treatments. In practice, this means that a company must not only have the visible layer of the passport in order, but also the underlying documentation that a supervisory authority can request if necessary. This relates, among other things, to which chemical treatments must be reported: that information does not necessarily have to be visible to the consumer, but must be traceable for a supervisory authority.
Access for parties in the supply chain
Manufacturers, importers and market actors further down the chain may need different data than the end consumer. For example, a recycler needs more detailed information about material composition than at the level that is relevant to a consumer. Article 11 of the ESPR (Regulation (EU) 2024/1781) describes that the technical system is set up for this via differentiated access. For a clothing brand, this means that the question "who will see this" is answered when the passport is compiled, not afterwards. This is particularly relevant for data relating to the share of recycled fibre , because there can be both a public figure and an underlying substantiation.
Protection of commercially sensitive information
Not all data underlying a passport is intended to become public. The question of which information is and is not visible to the public is linked to the question whether commercially sensitive data on clothing and textiles must be made publicly available. For a company, this means that when drawing up the passport, a balance is struck between what must mandatorily be visible and what can be designated as confidential substantiation, without this undermining the required public data.
Where things go wrong in practice
A frequently encountered problem is that a company compiles one dataset and couples it undifferentiated to the QR code, whereby sensitive supplier data become visible to a consumer just as much as to a supervisory authority. Another situation: the technical supplier of the passport receives no instruction on which fields must be public and which limited, whereby the arrangement turns out arbitrary per collection or per season. It also happens that an importer assumes that supervisory authorities automatically have access to all underlying documentation, whereas that documentation has in fact never been linked to the passport and is therefore not retrievable at the moment it is requested. Furthermore, confusion arises when multiple parties in the chain (manufacturer, importer, brand) all supply data without it being established who manages which part of the dataset and who may view or modify which part. A last recurring problem: a company confuses the question "who may see it" with the question how current the data must beand treats access rights and updating as the same process, whereas they are two separate obligations.
What you can record
- An overview of which data in the passport are publicly visible and which data have limited accessibility, per product category.
- A role overview: which party (supervisory authority, market participant, recycler, consumer) may view which part of the dataset.
- An allocation of responsibility between manufacturer, importer and brand over who supplies, manages and may modify which data.
- A procedure for supplying underlying documentation (test reports, supplier declarations) to a supervisory authority on request.
- Instructions to the technical supplier of the passport on which fields are set up in which access layer.
- An overview of business-sensitive data that do underlie the passport but do not end up in the public layer.
This is not legal advice. This page provides general information about the regulations that this platform covers. We are not familiar with your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something wrong? Let us know — corrections are given priority.