Who hosts the data behind a product passport?
The economic operator responsible for creating it, or a digital product passport service provider. The regulation also requires a back up copy held by such a provider, and availability that continues after an insolvency, a liquidation or a cessation of activity.
Two possible holders
Article 11 of regulation (EU) 2024/1781 says the passport is stored by the economic operator responsible for its creation or by digital product passport service providers. The regulation defines such a provider as an independent third party, authorised by the operator placing the product on the market, that processes the passport data to make it available.
So hosting is a decision rather than a default. A manufacturer can keep the data in its own systems, or hand it to a provider, and the regulation treats both as compliant ways of holding it.
The back up copy is required
Article 10 adds an obligation that surprises people reading the text for the first time: the economic operator, when placing the product on the market, makes available a back up copy of the passport through a service provider. A manufacturer hosting its own passports is not exempt from that copy.
And the copy is part of the passport's own contents: Annex III lists, among the data an act may require, the reference of the service provider hosting the back up copy. The arrangement is meant to be visible, not private.
It has to outlive the company
Article 11 requires the passport to remain available for the period set in the applicable act, including after an insolvency, a liquidation or a cessation of activity in the Union of the operator responsible for creating it. The availability page takes that period and what it costs.
Read together with the back up copy, the intent is plain: the data survives the business that produced it. An address that stops resolving when a company folds is exactly what the text is written against, and the same reasoning applies to any tag that points at a domain, which the preparation page meets in a simpler form.
What a provider may not do
Article 11 restricts the provider: where it stores or otherwise processes the passport data, it may not sell, reuse or process those data, in whole or in part, beyond what is necessary for the service, unless specifically agreed with the operator placing the product on the market.
The same article empowers the Commission to set the requirements a provider has to meet, and where appropriate a certification scheme to verify them. A contract with a provider therefore has a moving floor under it, which is a reason to read the act and the provider's own terms at the same time.
Frequently asked questions
Can a manufacturer host its own passports?
Yes. The regulation allows storage by the economic operator responsible for creating the passport or by a service provider.
Is the back up copy optional?
No. The operator placing the product on the market makes available a back up copy through a digital product passport service provider.
What happens if the company disappears?
The passport has to remain available for the period set in the act, including after an insolvency, a liquidation or a cessation of activity in the Union.
Can a provider use the data for its own purposes?
Not beyond what the service requires, unless specifically agreed with the operator placing the product on the market.