The textile passport is essentially product information: fibre composition, origin, washing instructions, data on recyclability. This is not personal data, and therefore the passport itself is in principle outside the scope of the GDPR. Yet the question is justified, because as soon as you start compiling and hosting the passport, there are almost always data that can be traced back to a person.
Think of the contact details of a supplier who is not a legal entity, of the name of a contact person at a manufacturer, or of technical data such as IP addresses that are recorded when someone scans the QR code. These matters do not fall under the textile regulation, but they do fall under the GDPR. The two regulations thus run alongside each other, each with their own angle on the same process.
What the textile passport does and does not contain
The delegated act that will substantively fill in the passport focuses on product properties: material, sustainability characteristics, repair and recycling information. There is no indication that personal data of consumers will be a mandatory part of the passport. What exactly has to be included is not yet fully determined; the first delegated act is currently expected in 2027, for clothing with a high proportion of textile fibres.
The uncertainty thus does not lie in the question of whether the passport contains personal data, but in the rest of the process by which you create the passport: who supplies the data, who manages access, and who can access the underlying files. Personal data almost automatically arise there, even if nobody intended it that way.
Where personal data do play a role
In the practice of a business, personal data mainly arise in three places. First, in the submission: a supplier sends data from a business email address with a name in it, or a sole trader supplies data under the name of the owner. Second, in management: who within your company and with your software provider has access to the passport is often recorded with name and role. Third, in use: if a customer or supervisor scans the QR code, a technical trace may be left behind, depending on how the data carrier and hosting are set up.
None of these points makes the textile passport a GDPR project. It does mean that the party hosting the passport for you also has a role when it comes to that data, and that agreements should exist about it. how we handle data and privacy gives an image of the way in which texpas.eu hosted the passport.
What this means for your agreements with your hosting provider
When you have the passport compiled and hosted by a third party, that party is usually a processor within the meaning of the GDPR for the data associated with the passport, while your company remains the controller. This calls for a processor agreement, just as with other IT service providers that work with business data. This is not a special feature of the textile passport; it is the same agreement you presumably already have with other software suppliers.
It is therefore wise to include this question in the discussion about the technology, alongside the questions you are already asking about couplings and data field overviews. Whoever outsources hosting and processing should ask where the data is stored, how long it is retained, and who can practically access it.
What you can check yourself
Whether and to what extent the GDPR is relevant to your specific submission, management or use of the textile passport depends on how your company collects and processes the data. This is something you should best align with your own data protection officer or a lawyer, and if in doubt with the Data Protection Authority as the supervisory authority for the GDPR. The textile regulation itself says nothing specific about this; the two frameworks are separate and are also enforced separately.
Would you first like to get a broader picture of what changes for your company, apart from the privacy issue? in a few questions see where your company stands gives an initial indication of that, and the knowledge base with topics per situation goes deeper into the concepts and obligations that belong to the textile passport. For the questions that come up most often, there is also an overview with answers to the most frequently asked questions. If you want to know right away where the information on texpas.eu comes from and how it remains traceable, check out how it works.
The free quick-scan gives you an initial direction within a few minutes, without having to sign up anywhere.