TracePass
Regulatory

Holding the data is not compliance where a DPP duty is actually discharged

A field can be genuinely required by EU law and still not be satisfied by recording it in a passport. The obligation may live on a physical label, in a Commission database, or in a technical file you hold and produce on request. Here is how to tell which.

Recording a datum in a Digital Product Passport often does not satisfy the law that mandates that datum. The two acts look identical from inside a compliance tool — the field is there, it has a value, the value is correct — and they are legally distinct. One is holding information. The other is discharging an obligation.

The confusion is easy to fall into because most passport field specifications answer only the first half of the question. They tell you which EU instrument requires the data. They do not tell you which article says where that data has to go. A regulation that mandates fibre composition and a regulation that mandates fibre composition on a durable label attached to the product are not the same instruction, and only one of them is satisfied by a database entry.

Four patterns account for almost every case where the duty lands somewhere other than the passport: a physical label or marking on the product itself, an on-request communication duty triggered by a threshold, an entry in a specific database, and documentation that must be drawn up, held, and produced to authorities when they ask. Each has its own legal form, and a passport entry does not take that form.

None of this argues against putting the data in a passport. A passport is a good place to keep it — structured, versioned, shareable with a customer or an auditor without a document hunt, and already the working copy your team edits. The point is narrower and more useful than “don't bother”: know which act you have performed when you fill the field in, because for most of these duties you still owe a second one.

Four ways an obligation lands somewhere other than the passport

Each of these is a real, in-force EU obligation, and in each case the data is worth holding in a passport. In none of them does the passport entry discharge the duty.

A physical label or marking on the productRegulation (EU) 1007/2011 requires textile fibre composition on a durable, easily legible label physically attached to the product, in the language of the Member State where it is made available — Articles 9(1), 14(1) and 16 together. Recording the same composition in a passport does not discharge it; the garment still needs the label. The Battery Regulation works the same way for its markings: the separate-collection symbol under Article 13(4), in force since 18 August 2025 and covering at least 3% of the largest side; the general information and capacity labels under Article 13(1) to (3); and the chemical symbols for hazardous substances under Article 13(5) — “Cd” above 0.002% cadmium, “Pb” above 0.004% lead. Those go on the battery, not in a record about it.
A communication duty owed on requestUnder Article 33(1) of REACH, Regulation (EC) 1907/2006, a supplier of an article containing a Candidate List substance above 0.1% weight by weight must provide the recipient with sufficient information for safe use — as a minimum, the name of the substance. Read the shape of that duty carefully: it is triggered by a threshold and by a request, it is owed to a specific recipient, and its minimum content is a name. It is not a duty to publish proactively, and it is not a duty to publish CAS numbers or concentration ranges. A passport can be an excellent way to answer the request quickly. Answering is still the obligation.
An entry in a specific databaseFor some obligations the database record is the duty. EPREL registration for energy labelling, SCIP notification to ECHA under Article 9(1)(i) of the Waste Framework Directive 2008/98/EC — in force since 5 January 2021 — poison-centre notifications under Annex VIII to CLP, and the EUDR due-diligence statement lodged in the EU Information System are all discharged by lodging the record with the named system. Publishing the same values in a passport does not create the entry and does not replace it. Nothing you do in your own system is visible to a register you have not submitted to.
Documentation drawn up, held, and produced on requestTechnical files, EU Declarations of Conformity and test reports carry a duty to draw up the document, keep it for the required period, and produce it to a market surveillance authority when asked. The Battery Regulation's Annex VIII technical documentation is a clear case: it belongs to Module A internal production control, a precondition for placing the product on the market and affixing the CE marking. It is not passport data. Publishing a URL where an inspector could find the document is a delivery choice, and often a good one — it is not the legal form of the duty, and it does not remove the obligation to hold the file.

The exception: batteries, where the law does name passport content

Batteries are the one category where the general rule inverts. Annex XIII of Regulation (EU) 2023/1542 enumerates the data points as passport content — not as label text, not as technical documentation, but as what the battery passport must contain — and Article 77 makes that passport mandatory from 18 February 2027 for LMT batteries, industrial batteries above 2 kWh, and electric vehicle batteries. For those fields, filling the passport is the act the law asks for.

That is also why the Battery Regulation is where the three obligations get conflated most often. It imposes three legally distinct things at once: the Article 13 markings that go on the battery itself, the Annex VIII technical documentation that supports conformity assessment, and the Article 77 passport described in Annex XIII. Only the third is passport data. The conflation is almost structural, because Article 77(3) makes the passport reachable through the QR code required by Article 13(6) from 18 February 2027 — the marking is the doorway to the passport, which makes them feel like one obligation. They are not. A compliant passport behind a missing or undersized label is still a labelling failure.

So the honest general rule is: a passport entry rarely discharges the duty behind the data, with one important exception — and that exception is the only product category with an adopted DPP mandate today. As more delegated acts arrive, more categories may join it. Until one does for your product, assume the duty lives elsewhere and go find the article that says where.

What to do about it

None of this requires new software or a different way of working. It requires knowing, for each field you hold, which act discharges the obligation behind it — and keeping the passport honest about being the working copy rather than the legal one.

  1. 1

    Record where each duty is discharged, not just what the data is

    For every field you treat as mandatory, note the article that says where the information has to go: on the product, to a named database, to a recipient on request, or in a file you hold. That one line turns a field list into a compliance map, and it is the note that survives staff turnover. It is also the answer an auditor is actually asking for when they ask why you collect something.

  2. 2

    Keep the label and the passport in sync deliberately

    Where a duty is discharged by a physical label — fibre composition, battery markings, an approval mark — the label and the passport hold the same values from two different processes, and they drift. A composition change reaches the passport in an afternoon and the printed label at the next production run. Decide which one leads, and check the other against it before a batch ships, rather than discovering the gap at inspection.

  3. 3

    Treat the passport as the working copy, not the legal act

    The passport is where the data is assembled, versioned and shared. The database submission, the label artwork, the technical file and the answer to a REACH Article 33 request are separate acts that draw on it. Holding the two apart in your own head is what stops a green dashboard from reading as a discharged obligation — and stops “the passport is complete” from being mistaken for “we are compliant”.

  4. 4

    Ask your vendor which article puts the data in the passport

    Any tool that marks a field mandatory should be able to name the instrument requiring the data and the provision putting it in a passport. If the answer covers only the first half, the field is worth collecting and the mandatory label is doing something else — telling you an obligation exists, without telling you where to satisfy it. Ask this about our templates too; the answer should be specific enough to check on EUR-Lex.

Hold the data here — discharge the duty where the law says

A passport is a good home for this data: structured, versioned, and shareable with a customer or an inspector without a document hunt. What it does not do is stand in for a label on the product, an entry in EPREL or SCIP, an answer to a REACH request, or a technical file you must hold and produce. Build the passport, and keep a note beside each field of where its obligation is actually discharged. For batteries, from 18 February 2027, that note points back at the passport itself.

Start a free passport