The EU DPP Registry: Technical Architecture
ESPR Article 13 requires the European Commission to establish and maintain an EU product database (the EU DPP Registry) that stores Digital Product Passports for all ESPR-regulated products. The registry goes live on 19 July 2026. It is built on the existing EPREL (European Product Registry for Energy Labelling) infrastructure, which already stores product data for energy-related products subject to EU energy labelling requirements.
The EU DPP Registry uses a distributed architecture. The registry itself stores product passport identifiers and metadata, but the full DPP data may be hosted by the manufacturer, a third-party DPP service provider, or the registry itself. The registry resolves product passport identifiers to DPP data records using GS1 Digital Link. When a QR code is scanned, the GS1 Digital Link URL is sent to the registry resolver, which returns the DPP data from wherever it is hosted.
Technical Requirements for DPP Registry Compliance
| Requirement | Technical Specification | Mandatory Date |
|---|---|---|
| Product registration | REST API registration with EU DPP Registry (EPREL) | 19 July 2026 |
| Data carrier standard | GS1 Digital Link (ISO/IEC 18975) QR code | Per delegated act |
| Data format | JSON-LD with EU DPP ontology | Per delegated act |
| Data hosting | Manufacturer server, third-party DPP provider, or EPREL | Per delegated act |
| API availability | 99.9% uptime, response time <2 seconds | Per delegated act |
| Data update frequency | Real-time for dynamic fields (SoH), annual for static fields | Per delegated act |
| Access control | Public, restricted, and confidential access levels | Per delegated act |
| Data retention | Minimum 10 years after last product of model placed on market | ESPR Article 8(6) |
Registration Process
To register a product's DPP with the EU DPP Registry, manufacturers must: (1) obtain a GS1 company prefix and GTIN for the product; (2) create the DPP data record in JSON-LD format according to the applicable delegated act specification; (3) host the DPP data at a stable URL; (4) register the product with EPREL via the EPREL API, providing the product passport identifier and the DPP data URL; (5) generate a GS1 Digital Link QR code encoding the product passport identifier; and (6) affix the QR code to the product or its packaging.
The National DPP Registry at digitalproductpassports.co.za provides a managed DPP registration service for manufacturers who do not want to build their own DPP hosting infrastructure. The registry handles DPP data hosting, EPREL registration, QR code generation, and ongoing data management.
Data Hosting Options
Manufacturers have three options for hosting DPP data: self-hosting (building and maintaining their own DPP data server), third-party hosting (using a DPP service provider such as digitalproductpassports.co.za), or EPREL hosting (uploading DPP data directly to the EU DPP Registry). Self-hosting gives manufacturers full control over their DPP data but requires significant technical investment. Third-party hosting is the most practical option for most manufacturers. EPREL hosting is the simplest option but may not support all data fields required by specific delegated acts.
Uptime and Availability Requirements
ESPR Article 8(6) requires that DPP data be accessible throughout the product's lifetime — which for some products (such as construction materials) may be 50 years or more. This creates a long-term data hosting obligation that manufacturers must plan for. DPP data must remain accessible even if the manufacturer ceases trading — which is one reason why third-party DPP registries with long-term data custody commitments are preferable to self-hosting for most manufacturers.
EU Product Database Architecture
The EU product database established under Article 12 of ESPR will be a centralised repository for Digital Product Passport data, accessible to market surveillance authorities, economic operators, and the public. The database will be operated by the European Commission and will be integrated with existing EU databases including ECHA's SCIP database, the EPREL (European Product Registry for Energy Labelling) database, and the EUDAMED (European Database on Medical Devices) database. The technical architecture will use a federated model — manufacturers register their products in the EU product database, but the actual DPP data may be stored on the manufacturer's own systems or on a third-party DPP platform, with the EU product database serving as the index and resolver.
Registration Process for the EU Product Database
Manufacturers must register their products in the EU product database before placing them on the EU market after the relevant delegated act deadline. The registration process will require: the manufacturer's EORI (Economic Operators Registration and Identification) number, the product's GTIN or other ISO/IEC 15459-compliant identifier, the product category code (based on the EU's product classification system), the DPP data in the specified format (JSON-LD or XML), and the URL of the DPP resolver. For non-EU manufacturers, the EU Authorised Representative's EORI number must be provided in addition to the manufacturer's details. The registration will generate a unique EU product database identifier that must be included in the product's DPP data carrier.
Data Sovereignty and GDPR Compliance in the EU Product Database
The EU product database will contain commercially sensitive information — material compositions, manufacturing processes, and supply chain data that manufacturers may consider trade secrets. Article 12(3) of ESPR provides that the Commission shall ensure that commercially sensitive information is protected and not made publicly accessible. The database will implement role-based access control — market surveillance authorities will have full access to all DPP data, while the public will have access only to the data fields specified as publicly accessible in the delegated act. Manufacturers should identify which data fields in their DPP contain commercially sensitive information and flag these fields appropriately when registering their products. The EU product database will be subject to the EU's General Data Protection Regulation (GDPR) for any personal data it processes, including the personal data of individuals named as responsible persons in the DPP.
Register Your Digital Product Passport
The EU DPP Registry goes live on 19 July 2026. Register now at Africa's first ESPR-compliant DPP registry.
Register Your Digital Product Passport →EPREL — The EU Product Registry for Energy Labelling
The European Product Registry for Energy Labelling (EPREL) is the EU's existing product database for energy-labelled products. EPREL was established under the Energy Labelling Regulation (EU 2017/1369) and is managed by the European Commission. Manufacturers of energy-labelled products (including washing machines, dishwashers, refrigerators, televisions, and lighting products) must register their products in EPREL before placing them on the EU market. EPREL contains product model information, energy label data, and product information sheets for all registered products.
Under ESPR, the EPREL database is expected to be expanded to serve as the central registry for ESPR DPPs. The Commission is working on a technical architecture that would allow manufacturers to register their DPPs in EPREL and link them to their existing EPREL product registrations. This would create a single point of access for all product compliance data — energy label data, DPP data, and conformity assessment data — for EU market surveillance authorities, customs officials, and consumers.
The technical requirements for the expanded EPREL database include: a standardised API for submitting and retrieving DPP data; a unique identifier scheme for DPPs that is compatible with ISO/IEC 15459 and GS1 Digital Link; a data validation system that checks submitted DPP data against the requirements of the relevant delegated act; a public search interface that allows consumers and market surveillance authorities to search for DPPs by product identifier, manufacturer, or product category; and a secure access control system that restricts access to sensitive DPP data (such as trade secrets) to authorised parties.
Frequently Asked Questions
The ESPR implementing regulations will specify the registration requirements for DPPs. It is likely that DPPs for products that are already required to be registered in EPREL (energy-labelled products) will be registered in EPREL. For other product categories, a separate registration mechanism may be used. The Commission is working on a unified product database architecture.
EPREL is the existing EU product database for energy-labelled products. The ESPR DPP registry is the planned system for hosting DPP data. The Commission is working on integrating these two systems so that manufacturers do not need to register their products in multiple databases. The exact architecture has not yet been finalised.
ESPR allows manufacturers to use private DPP registries (operated by third-party service providers) as long as the registry meets the technical requirements specified in the implementing regulations. The DPP data must be accessible to market surveillance authorities and, for public data, to consumers. Private registries must be able to provide data to EPREL or the central EU registry on request.
The Commission is developing API standards for DPP data exchange based on the W3C Verifiable Credentials Data Model and the GS1 Digital Link standard. The API will support both RESTful and GraphQL interfaces. The exact API specifications will be published in the ESPR implementing regulations and the EPREL technical documentation.
ESPR requires that DPP data be retained for the full lifecycle of the product, plus a minimum period after the product is placed on the market. The exact retention period will be specified in the relevant delegated act. For long-lived products (such as buildings and industrial equipment), the retention period may be 30–50 years or more.