Who may view which data from the product passport?
Access is tiered, not the same for everyone
The digital product passport operates with different access levels: not every user sees the same data. The ESPR (Regulation (EU) 2024/1781) stipulates that the passport indicates per user category which data are accessible. A consumer scanning the QR code typically sees different information than a market surveillance authority, a customs service, or a company further down the chain processing the aluminium semi-finished product. Some data are public and visible to everyone, others are restricted and accessible only to parties with a demonstrable role or authority, such as supervision or enforcement. Which data fall into which tier is ultimately determined per product group in the delegated act drawn up for that group — for aluminium semi-finished products, this is the act that this platform follows.
Who this applies to and what falls outside the passport
This subject concerns access to data contained in the digital product passport itself: technical characteristics, composition, origin, reuse and recycling information, and similar product data as established for aluminium semi-finished products. It does not concern access to internal business documents, quotations, contracts or other information that a manufacturer or importer maintains separately and that does not form part of the passport. Nor does it concern the question of who may create or modify the passport — that is a separate matter of management and responsibility, separate from who may view it. Business-sensitive information that is not required to be in the passport does not have to be made visible: the regulation explicitly distinguishes between data accessible to everyone and data that remain restricted to specific parties, precisely to protect confidential business information.
No fixed date yet, but a principle is set
The principle of tiered access is already in the ESPR itself, but the precise implementation — which data falls into which tier for aluminium semi-finished products — follows only from the delegated act for this product group. According to the European Commission's work plan for 2025-2030, that act is expected around 2027, after which a transition period applies before the obligation actually takes effect. This platform therefore assumes for now that the product passport for aluminium becomes mandatory around 2029, but that date is not yet fixed. Once the delegated act is published and the indicative date gives way to a firm date, this will be updated here. Until then, there is no legal obligation to operate a passport with tiered access for aluminium semi-finished products, and therefore no concrete breakdown of data per user group has yet been established for this product.
What this means for the passport approach
For a manufacturer or importer of aluminium semifinished products, the practical consequence is that the classification of data as public or restricted is not determined by themselves, but follows from the rules that will apply to the product category. Those who orient themselves now would be well advised to map out in advance which data about the product are available — composition, origin of raw materials, recycling content, technical specifications — and which of these may be commercially sensitive. That overview will be useful once the delegated act clarifies which level applies to which data. When compiling a passport via this platform, the classification into access levels is automatically applied once it is established; the manufacturer or importer then does not need to determine themselves who may see which data, but does provide the underlying data from which that passport is built. It is therefore worthwhile to start now working on a complete and structured overview of product data, even though the exact access classification is not yet final.
The basis: Articles 10 and 11 of the ESPR
That the digital product passport works with differentiated access follows from Article 10 of the ESPR (Regulation (EU) 2024/1781), which sets out the general requirements for the digital product passport, including the principle that for each user category it is determined which data are accessible. Article 11 of the same regulation deals with the technical design and operation of the passport, and ensures that this system of differentiated access rights is also technically maintained — for example through the way data are stored, linked and disclosed via the data carrier. Both articles leave the concrete implementation per product category to later delegated acts, which explains why for aluminium semifinished products there is as yet no exact access classification.
Those who wish to prepare now would be best advised to start by organizing their own product data along the lines that the ESPR already indicates — publicly accessible versus potentially confidential — so that those data are ready once the delegated act for aluminium establishes the final classification.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 11 (technical design and operation of the digital product passport)
The regulation itself is on EUR-Lex. We refer per statement; you do not have to take our word for it.
What you must concretely do
The digital product passport is not an open book for everyone who has access to it. The ESPR makes a distinction between data that is visible to everyone once someone scans the QR code, and data that only certain parties can see — think of a market surveillance authority, a recycler, or the next actor in the value chain. For a manufacturer or importer of aluminium semi-finished products, that distinction is relevant, because not everything you supply is automatically public.
What is expected of you
Making a distinction between public and restricted access
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes that the product passport contains different types of information, and that not all information is intended for the same target group. For a company with 10 to 100 employees, this means that the composition of the passport must be classified in advance: which data is intended for the end user or a random scanner of the QR code, and which data is intended for a specific party such as a market surveillance authority, a customs authority or a recycling company further down the value chain. That classification is not something that is added afterwards — it is already built into the design of the passport.
Setting up access rights technically
Article 11 of the ESPR (Regulation (EU) 2024/1781) deals with the technical design and operation of the passport, and from this it follows that access to certain data can be linked to the role of the user. For a foundry or profile manufacturer, this means that the platform used to compile and host the passport must support a role structure: a consumer who scans sees something different from a market surveillance authority who logs in with authority, and that in turn sees something different from the recycler who needs data on material composition at the end of life. This is one of the reasons why it is practical to delegate this to a platform instead of building your own PDF with QR code: the rights structure must move with who is scanning.
Determine which data you consider business-sensitive
Some of the data that ends up in a passport touches on production knowledge, alloy recipe, or supplier relationships. Article 10 provides scope to make a distinction between what is made public and what remains restricted access, but that distinction does not arise automatically — a company must itself determine which data it considers sensitive and why. This assessment is described in more detail in the question must I disclose business-sensitive data about my aluminiumand is closely linked to the question of which data should be in the passport in the first place.
Know who needs which data, and why
For a company of this size, it is practical to know in advance which parties will in practice request access: a customer who is themselves compiling a product passport for a processed product, an auditor, a recycler, or a market surveillance authority during an inspection. This requires an overview of which data goes to which layer of the passport — public, restricted, or for market surveillance only — and that overview is different from the question of which data should be in the passport from a content perspective, as described in which data come in the digital product passport for aluminium.
Where things go wrong in practice
Everything is set to public by default. A company supplies all data without making a distinction between what must be public and what can remain restricted, with the result that sensitive alloy composition data is visible to anyone who scans.
No account is taken of the recycler's role. At the end of life, a recycler needs different data than a consumer at the beginning — for example, detailed information on alloy composition according to the EN-AW designation. If that information is only available in a public, simplified form, the recycler is missing what he needs.
Access rights are not taken into account when choosing a platform. A company chooses a solution that offers only a static QR code with a single fixed data file, without the possibility of distinguishing between target groups. Once it becomes clear that certain data must have limited accessibility, that is technically no longer feasible to arrange.
No distinction is made between the technical dossier and the product passport. Data intended for internal use or for a supervisory authority are confused with what must appear in the public product passport. The difference between these two documents is explained under what is the difference between my technical file and the digital product passport.
No one is responsible for keeping access rights up to date. An employee who previously had access to restricted data leaves the company, or a new party in the supply chain is not granted access, resulting in data not reaching those who need it. This is linked to the question how often must I update the data in the product passport, because access and timeliness often go hand in hand.
What you can document now
- An overview of which data in the product passport are publicly visible and which have restricted accessibility, with a brief justification per category.
- A list of parties expected to need access to restricted data — such as supervisory authorities, customers further down the supply chain, and recyclers — and which data are relevant for each of them.
- An internal agreement on who within the company is responsible for granting and revoking access rights, and how often this is checked.
- A justification for the decision to classify certain data as commercially sensitive, including the distinction made between what is and is not made public.
- A brief description of how the chosen platform technically manages access — via roles, via login, or via separate data layers — so that this can be demonstrated during an inspection.
This is not legal advice. This page provides general information on the legislation that this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something not right? Let us know — corrections are prioritised.