Hosting, Retention & the Registry
Where Is DPP Data Stored — and for How Long?
The EU's Digital Product Passport is deliberately decentralised. The passport data — materials, origin, substances, care, footprint — lives with the responsible economic operator or its DPP service provider, reachable through the QR data carrier on the product. What sits in Brussels is a registry: under ESPR Article 13 it stores at least the unique identifiers, not the full passport. Availability is long-horizon — at least the product's expected lifetime — with exact periods fixed by each delegated act.
Written by the DPPLive Team · Last updated: 19 October 2026
The Registry
Identifiers first, by design
Article 13's own words: the Commission's registry “stores in a secure manner at least the unique identifiers” — plus the commodity code for goods entering customs. Think land registry versus the house: the registry proves a passport exists; the full record stays with the passport host. Delegated acts may add data to the registry (Article 13(2)).
ESPR Art. 13
The Passport
Hosted at the operator's side
The record itself is decentralised: hosted by the responsible operator or its service provider, connected “through a data carrier to a persistent unique product identifier” (Article 10), built on open standards, machine-readable and interoperable — so a scan resolves to live data, not a PDF in an inbox.
ESPR Art. 10
Access
Tiered, not public-everything
Article 11 lists who must be able to reach passport data — customers, importers, distributors, repairers, remanufacturers, recyclers, market surveillance and customs authorities among them — each seeing the tier relevant to their role. Consumers see care and composition; authorities see compliance depth.
ESPR Art. 11
Retention
At least the product's lifetime
ESPR sets the floor: availability for at least the product's expected lifetime (Article 9(2)(i)), including after insolvency (Article 11(e)); each delegated act fixes the binding period per product group. For garments that means outliving the garment itself — a hosting commitment, not a website feature.
Continuity
Built to survive providers
Open-standards design (Article 10(1)(d)) lets passports migrate between systems, and the operator must keep a back-up copy with a service provider (Article 10(4)). Due-diligence question for any platform: can I export my complete passport archive, today, in a standard format? If not, keep looking.
Customs Link
The registry meets the border
For products covered by a delegated act, Article 15 requires the unique registration identifier to be provided to customs at release for free circulation, from the moment the registry is operational — the registry lookup becomes part of the import flow, while the data stays at your provider.
Hosting & Retention FAQ
Quick Answers
Does the EU store my product data in its registry?
+
Mostly no. Under ESPR Article 13 the Commission's registry stores at least the unique identifiers — plus the commodity code for imports — and delegated acts may add other passport data to it (Article 13(2)). The passport itself is stored by the economic operator or its DPP service provider (Article 11(c)).
Who hosts the actual passport data?
+
The economic operator responsible for the product — in practice usually its DPP service provider, which keeps the passport online, resolvable from the QR data carrier, backed up and updateable through the product's life.
How long must DPP data stay available?
+
For at least the product's expected lifetime: ESPR requires each delegated act to set an availability period that corresponds to at least that (Article 9(2)(i)), and the textile act is expected in 2027. The passport must stay available even if the responsible operator goes insolvent or stops trading (Article 11(e)).
What happens if a DPP provider goes out of business?
+
ESPR plans for it: the operator must keep a back-up copy of the passport with a DPP service provider (Article 10(4)), the passport must stay available even after insolvency (Article 11(e)), and open, interoperable standards (Article 10(1)(d)) let records migrate. Contractually, insist on data portability and an exportable archive from any provider.
Keep Reading
Go Deeper
Recompute a passport hash and follow it to the Bitcoin block that timestamps it.
What went live on 20 July 2026 — and what didn't.
Authenticity, integrity and who checks what.
The data carrier that resolves to the hosted passport.
The full process, hosting included.
Sources & official references
- Regulation (EU) 2024/1781 (ESPR) — full text on EUR-Lex — Article 10 (essential requirements), Article 11 (access), Article 13 (registry), Article 15 (customs)
- European Commission — Digital Product Passport — official FAQ (Dec 2025, PDF)
DPPLive’s Take
Hosting Is the Hidden Half of Compliance
Creating a passport is a project; keeping it resolvable for a decade is an operation. DPPLive runs that operation — persistent identifiers, live hosting, tiered access and an exportable archive that stays yours.