The digital product passport for aluminium is based fundamentally on data about the material and product: alloy, origin, weight, recycling content, technical specifications and sometimes information about the manufacturing location. These are not personal data within the meaning of the GDPR, because they are not attributable to a natural person. For most companies that produce, import or process aluminium semi-finished products, the passport therefore remains largely a product administration and not a privacy matter.
At the same time, there is often a layer beneath it in practice that does have links to the GDPR: the data of the market participant who supplies or manages the passport. Think of a company name, a Commercial Register number, an address and sometimes a contact person with name and position. In the case of a sole proprietorship or a partnership, that business information can in fact coincide with data of a natural person, and that is precisely the detail this subject is about.
What is generally included in the passport
The regulation focuses on product information: where the material comes from, how it is composed, what properties it has and how it can be processed at the end of its life. These are data about the aluminium itself, not about the people who work with it or sell it. Anyone wishing to read the regulation itself can find the full text on EUR-Lex; we keep a short answer and the source reference for each topic in the knowledge base where this has been examined for each situation.
Within that product data, an organisation name sometimes appears, for example that of the manufacturer or importer responsible for the data. An organisation name in itself is usually not personal data, unless that name directly designates a natural person.
When personal data do play a role
The situation changes as soon as a contact person with name, telephone number or email address is linked to the passport, or when the market participant is a sole proprietorship where the business data and the personal data of the owner coincide. In those cases, it is no longer just about product information, but also about data that fall under the GDPR. Supervisory authorities look at who processes the data, for what purpose, and whether there is a legal basis for that processing.
This also applies when creating and managing an account: a business account is attached to a legal entity with a Commercial Register number and VAT number, but the person who manages the account on behalf of the company does provide their own contact details. How such data are stored and secured is described on the page how we handle privacy and data.
The GDPR and the digital product passport regulation alongside each other
The regulation for the digital product passport and the GDPR are two separate frameworks that exist alongside each other. One regulates which product information must be available and how it is shared via a QR data carrier; the other regulates how personal data are handled, regardless of sector. A company that compiles a product passport is therefore not automatically exempted from the usual GDPR questions: who is the controller, what is the legal basis, and how long are data retained.
Because these two frameworks touch each other but do not regulate the same things, it is sensible for your own situation to examine both separately: the product content of the passport on the one hand, and the contact details processed around it on the other. For questions about your own processing of personal data, the Data Protection Authority is the designated supervisory authority, and for an explanation of a specific situation, a lawyer is the right point of contact.
What you can practically do now
For most SMEs in aluminium profiles, foundries or packaging, the practical work remains manageable: ensure that the product data is correct, and be aware that contact details relating to the management of the passport must be separately assessed on a GDPR basis if there is reason to do so. If you are unsure whether your situation requires specific attention, the product scan with a few brief questions provides an initial indication of where you stand.
Frequently asked questions about the relationship between the passport and existing rules, including the GDPR, are clearly set out on the page with answers to frequently asked questions. You will also find references to the source there, so you can read it yourself.
Would you like to know whether personal data and the product passport play a role in your case? Take the free quick-scan or browse through the topics in the knowledge base; both can be consulted without any obligations and provide immediate guidance.