Must I make commercially sensitive data about my aluminium public?

Not everything in the digital product passport is public

No, not automatically. The ESPR makes a distinction between information that is visible to everyone via the digital product passport and information that is intended only for specific parties, such as supervisory authorities or other actors in the supply chain. The fact that a piece of data is in the passport does not automatically mean it is public. For aluminium semi-finished products, this often concerns sensitive data such as the precise alloy composition, details about the production process or the identity of specific suppliers. The regulation takes into account that this type of information has business value, and therefore creates a distinction between what is publicly visible and what remains of limited access.

Who this applies to and what it does not

This applies to data that is specifically collected and provided for the digital product passport: technical characteristics, origin, processing history and the like. So it concerns the information that ultimately is attached to the product via the QR code. It does not apply to business confidential information that is separate from the passport, such as financial data, internal cost prices or customer lists — these are governed by ordinary rules on trade secrets, and these do not change with the arrival of the digital product passport. There is also a difference between what a manufacturer or importer must internally record and provide, and what ultimately comes back as a publicly visible field in the passport itself. This distinction is made concrete in the delegated act per product category, and this does not yet exist for aluminium.

No fixed date for this rule yet

There is no firm date yet. The ESPR itself is already in force, but which data for aluminium semi-finished products must exactly be in the passport, and which of these is publicly accessible versus limited to certain parties, is laid down in a product-specific delegated act. According to the European Commission's work plan for 2025-2030, this delegated act for aluminium is expected around 2027. Until this delegated act is published, there is no concrete obligation for aluminium to enter data in a passport, let alone to make it public. As soon as the text is published, the exact date and the content of the information requirements will appear here.

How to approach this in practice

The first step is to make an overview of which data about the aluminium product is already being shared, with whom, and on what basis — think of certificates, material declarations or data that is already being provided for other regulations. This overview can later be used to determine what will probably end up in the passport and what will not. The second step is to wait for the publication of the delegated act for aluminium: only then will it state which fields are mandatory and which of these become publicly visible. The third step, for those who have a passport compiled via alupas.eu: data provided for the passport does not need to be separately marked as "confidential" before the regulation itself makes this distinction — the platform processes the submission according to the access levels prescribed by the regulation once these are established. If you are already in doubt whether a specific piece of data is commercially sensitive, it is advisable to state that clearly upon submission, so that this can be taken into account when compiling the passport.

The basis: Article 10 and Article 38 ESPR

Article 10 of the ESPR (Regulation (EU) 2024/1781) sets out the general requirements for the digital product passport, including the way in which information is made accessible to different types of users — from consumer to competent authority. It follows from this that not every piece of data in the passport needs to be equally visible to everyone; which data are accessible to whom will be determined further for each product group. Article 38 regulates the obligations of actors in the supply chain, such as manufacturers and importers, to provide correct and complete information to whoever compiles the passport. This is a submission within the chain, aimed at correctly building the passport — not automatic disclosure to the outside world. The distinction between "submitting for the passport" and "making public via the passport" is thus already present in the regulation itself, and will be worked out further once the product-specific implementation is available.

If you wish to prepare now, it is best to keep a list of which data on the aluminium product are available internally and which of these are considered sensitive, so that this list is ready once the delegated act for aluminium is published. For specific questions about a particular submission, you can contact alupas.eu, and for the formal text the official publication by the European Commission remains the source to follow.