Short answerA Digital Product Passport architecture combines a unique identifier (often GTIN plus batch or serial), a data carrier such as a GS1 Digital Link QR code, a resolver, decentralised passport storage, role-based access control and a link to the EU DPP registry. PLM, PIM and ERP supply the data, and a DPP service provider usually publishes it.
Key takeaways
- ESPR keeps passport data decentralised with the economic operator, while the EU registry, live since July 2026, stores identifiers and links.
- A GS1 Digital Link URI encodes GTIN, batch and serial number in one web address, so a single QR code serves consumers, retail scanning and passport access.
- Six CEN and CENELEC JTC 24 standards on identifiers, data carriers, storage, APIs, data exchange and interoperability were cited in July 2026 and now give a presumption of conformity.
The architecture has five layers
Every DPP implementation resolves the same chain: identify the product, carry the identifier physically, resolve it to data, control who sees what, and register the passport with the EU. Treating these as separate layers keeps choices independent and avoids lock-in.
| Layer | Function | Typical options |
|---|---|---|
| Identifier | Uniquely names the product at model, batch or item level | GTIN, GTIN plus batch, GTIN plus serial (SGTIN), other ISO/IEC 15459 schemes |
| Data carrier | Physical link on product, packaging or documents | QR code, Data Matrix, RFID, NFC |
| Resolver | Turns the identifier into the right web resource | GS1 Digital Link resolver, provider-hosted resolver |
| Storage and access | Hosts passport data and enforces access tiers | Operator systems, DPP service provider |
| Registry | EU-level index of identifiers and links | Commission DPP registry |
The legal frame comes from ESPR, described in the ESPR guide. The technical detail comes from harmonised standards, the first of which were cited in July 2026.
Identifiers decide granularity and cost
The identifier is the most expensive decision to reverse. A GTIN identifies a trade item at model level. Adding a batch or lot number identifies a production run. Adding a serial number identifies an individual unit. Each step multiplies the number of passport records and requires changes in production, marking and logistics.
The delegated act sets the minimum granularity per product group. The battery passport requires item level, while many ESPR groups are expected at model or batch level. Companies that already assign GTINs through GS1 can extend them, and economic operator and facility identifiers, such as GLN, complete the picture.
GS1 Digital Link lets one QR code serve several purposes
GS1 Digital Link expresses GS1 identifiers as a web address. A URI such as https://id.example.com/01/09506000134352/10/ABC123/21/12345 encodes GTIN, batch and serial number. Consumer phones open it as a web page, point-of-sale scanners read the GTIN, and a resolver can redirect each request to the right resource: passport, instructions, recall information or product page.
The main advantages for DPP work:
- One carrier on pack instead of separate barcodes and QR codes.
- A resolver under the brand's own domain keeps control if the hosting provider changes.
- Link types let the same identifier serve passport data, care instructions or spare parts.
- Retail moves towards 2D barcodes at checkout, so the investment serves two purposes.
Owning the resolver domain is the key design principle. Passport data must stay available for many years, often beyond any single vendor contract.
Storage stays decentralised, access stays role-based
ESPR keeps passport data with the economic operator or a DPP service provider acting on its behalf. The Commission registry, live since July 2026 under Implementing Regulation (EU) 2026/1778, stores the unique identifiers and the links, which lets customs check that a passport exists. Backup copies held by an independent service provider are required so the data survives insolvency.
Access rights follow roles: public data for consumers, extended data for repairers and recyclers, full data for authorities. Implementations verify the identity and role of each requester for restricted tiers, log every access and review permissions periodically. Implementing Decision (EU) 2026/1736 of 14 July 2026 cites six CEN and CENELEC JTC 24 standards, EN 18216 and EN 18219 to EN 18223, covering data exchange protocols, unique identifiers, data carriers, storage and archiving, APIs and interoperability. Conformity with them gives a presumption of conformity with the ESPR passport requirements. Further JTC 24 standards published in September 2026 still await citation, so architectures should track them closely.
PLM, PIM, ERP and the DPP provider each own one part
The source systems already hold most passport data, and the integration design decides whether it flows reliably.
- PLM: materials, composition, substances, supplier per component, test results.
- ERP: identifiers, batches, production sites, purchase and stock data.
- PIM: consumer-facing content, translations, images, channel-ready attributes.
- DPP service provider: passport assembly, hosting, resolver, access control, registry submission.
PIM often acts as the assembly point for model-level data, while batch and item data flows from ERP or manufacturing systems through events. Integration patterns are covered in the PLM, ERP, PIM and DAM integration article.
The central insight is that DPP architecture should separate the stable layers (identifiers, resolver domain, attribute ownership) from the replaceable ones (hosting and passport rendering). Companies that own the first group can switch providers without reprinting codes. Vendor options are listed in the vendor directory.
Frequently asked questions
Is GS1 Digital Link mandatory for the Digital Product Passport?
No. ESPR requires identifiers and data carriers that comply with recognised standards such as ISO/IEC 15459, and delegated acts may specify further. GS1 Digital Link is one widely used option, attractive for companies already using GTINs, because it combines retail scanning and web access.
Where is passport data stored?
Passport data stays decentralised with the economic operator or a DPP service provider acting on its behalf. The EU registry stores identifiers and links. An independent backup copy is required so the passport remains available if the operator or provider ceases business.
Should PIM or PLM own Digital Product Passport data?
Both contribute. PLM usually owns technical and material attributes created during development, while PIM owns consumer-facing and channel-ready content. Ownership should be set per attribute, with one system of record each, and the DPP provider consuming data rather than storing original values.