No fixed deadline, but a realistic estimate is possible
The regulation on the digital product passport does not prescribe a deadline within which you must check whether the data in the passport falls under GDPR. This check is a separate step that you, with or without a lawyer or data protection officer, take alongside the development of the passport. In practice, this ranges from a few days for a simple profile without identifiable data to several weeks when it is unclear which fields contain a contact person, a serial number or a delivery address of a natural person.
What determines the processing time most of all is not the check itself but the question before it: do you know exactly which data will appear in the passport, and where that data comes from. Companies that have already created this inventory for other purposes complete the check faster than those mapping it out for the first time.
What exactly a GDPR check of a product passport entails
The aluminium product passport contains, at its core, technical and material data: alloy, origin, processing method, recycling information. These are not personal data in themselves. The check becomes relevant once identifiable data of a natural person is added, for example the name of a contact person at a small supplier, a self-employed person acting as a manufacturer, or a serial number that can be linked to a specific employee who created it.
The check generally consists of three parts: identifying which fields are actually populated in the passport, assessing whether it contains personal data, and documenting on what basis that data is processed if it does. For more information on exactly what goes into the passport and how data is handled within it, see the page on how we handle privacy and data.
Where the processing time typically gets held up
Three bottlenecks come up most often. First: nobody in the company knows exactly which data the software supplier or the party compiling the passport requests in the first place. Without that overview, the check cannot begin. Second: the question of who may or must conduct the check remains internal, because no data protection officer has been appointed or because the office manager and the IT department refer to each other. Third: for companies working with multiple suppliers or subcontractors, it takes longer to determine for each party whether personal data is being shared, and on what basis that is happening.
The delay thus rarely lies in the check itself, but in the preparation for it. A GDPR check conducted on an incomplete dataset will have to be redone afterwards.
Who you practically involve
Within an SME, this is usually not a role that exists separately; the office manager, the HR manager or the director takes on the coordination. The substantive assessment requires legal expertise, internal or external. On questions about the processing of employee data involved in the passport, the works council or employee representative also plays a role, especially if new registrations or linkages are created. Additionally, the software supplier is a regular point of contact: that party partly determines which fields are technically recorded and where that data is stored.
An overview of everything involved and the order in which to address it can be found in the knowledge base with detailed topics per situation. For each topic, it also shows the source in the official text, so you can check where an obligation comes from.
How to get an estimate for your own situation
Because the lead time depends heavily on how much data you already have in order, a general guideline is of little value. A practical first step is to check which data your company already records about suppliers, contacts and employees, and whether that data will also be included in the passport. With a few questions get an indication of where your company stands, shows how much preparation is still needed before a GDPR assessment can meaningfully start.
For the question of whether your specific passport contains personal data and which legal basis applies to it, assessment by a lawyer or, in case of doubt, the Authority for Personal Data remains the appropriate point of contact. This article describes the process in general terms and does not replace that advice.
Finally
The lead time of a GDPR assessment for the aluminium product passport is not a fixed number, but the result of how well your data is already in order before you start. If you want to know which steps are still open for your company, check the frequently asked questions about the product passport or do the free quick-scan to see where you stand now.