Who is allowed to view which data from the product passport?
Access varies by user: public, buyer and competent authority do not see the same
Not everyone who scans the QR code of a piece of furniture receives the same data. The digital product passport is structured in different layers: some information is visible to everyone, some is intended especially for the buyer at the time of purchase, and some is reserved for competent authorities such as market surveillance authorities and customs. ESPR (Regulation (EU) 2024/1781) determines in Article 10 which data must be included in the passport and for which target group they are intended; Article 11 regulates how the system must technically ensure that distinction. For a furniture manufacturer or importer, this means that not all data submitted need be equally visible to everyone: some information is included in the passport but is only accessible to parties with specific authority.
For whom this distinction applies, and what falls outside it
This distinction in access rights applies to data that must be included in the digital product passport on the basis of ESPR and the product-specific delegated act for furniture still to be established. This concerns information such as material composition, repair possibilities, origin of components and other data prescribed by the regulation. Data that a manufacturer keeps for other reasons falls outside this distinction — internal cost calculations, purchasing conditions, supplier agreements — which never end up in the passport and therefore are not part of this access arrangement. The distinction does not automatically apply either to information that a company voluntarily adds on top of the mandatory data set; for that kind of additional information, the choice of who sees it lies in principle with the person compiling the passport, unless the delegated act provides otherwise. It is therefore important to distinguish between what the regulation makes mandatory accessible, and what a company decides to share on top of that.
No fixed implementation date, but a fixed framework
For furniture, it is not yet established from when the digital product passport becomes mandatory, and therefore also not from when these access rules come into force in practice. That moment depends on the product-specific delegated act for furniture, which according to the European Commission's work programme for 2025-2030 is expected in 2028. As long as that act is not in place, there is also no definitive specification of the access layers for furniture. Articles 10 and 11 of ESPR do provide the framework within which that specification must fit: they lay down that a distinction is made between target groups, but not which specific data belongs to which layer for furniture specifically. Until the delegated act is published and becomes applicable, there is no obligation for furniture to maintain a digital product passport with this access structure.
How to prepare for this in practice
Anyone now thinking about structuring the product passport would be well advised to first map out what data about a piece of furniture is already available and organize it: data that is expected to be visible to everyone (general material and maintenance information), data that is mainly relevant to the buyer (repair and warranty information), and data that is mainly important for supervision (technical documentation, conformity data). Next, it is useful to determine which part of that data is already available internally and which part still needs to be requested from suppliers. After that, it is worthwhile to review what data might contain confidential business information, so that this can be taken into account when compiling the passport. Finally, it is advisable to follow the publication of the delegated act for furniture, since it is only then that it will be concretely established which data falls into which access layer.
Where this appears: Articles 10 and 11 of the ESPR
This classification into access levels follows from Article 10 of the ESPR (Regulation (EU) 2024/1781), which describes the requirements for the digital product passport, including what information it must contain and who it is intended for. Article 11 of the same regulation describes the technical design and operation of the digital product passport, including how access rights must be technically guaranteed. The concrete implementation for furniture — which data exactly falls into which layer — follows from the product-specific delegated act that still needs to be adopted under this regulation.
As a manufacturer, importer or project manager, if you want to get started now, you can organize your own product data along the layers mentioned above — public, buyer, supervision — so that the passport can be compiled with less work once the delegated act for furniture has been published and the date is made known here.
This is based on
- Regulation (EU) 2024/1781 (ESPR), article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 11 (technical design and operation of the digital product passport)
The regulation itself is available on EUR-Lex. We refer per statement; you do not need to believe us.
What you concretely have to do
What is expected of you
Distinguish between public and non-public data
Article 10 of the ESPR (Regulation (EU) 2024/1781) proceeds from data in the digital product passport that is accessible to different target groups: some data is visible to everyone, other data only to specific parties such as market surveillance authorities, economic operators in the supply chain, or repairers. For a furniture manufacturer or importer, this means that the data collection underlying the passport is not a single undifferentiated pool of information. A distinction must be made: what may the consumer see in the shop via the QR code, and what is intended, for example, only for an economic operator who later dismantles or repairs the furniture. Which data exactly belongs in the passport is described on the page about what data will be included in the product passport for furniture. For a company with 10 to 100 employees, this is usually not a technical task but an organisational one: someone must determine in advance which data falls into which "category", before the passport is assembled.
Differentiate access by role
The idea behind the passport is that a market surveillance authority, a recycler, a repairer and a consumer do not all have the same information needs and therefore do not all need the same access. Article 11 of the ESPR describes the technical design of the passport, including how the data carrier and the underlying system must be able to display data to different parties. For a furniture company, this means that the choice of platform or system also depends on whether that system can distinguish access levels. A simple PDF behind a QR code that everyone views in exactly the same way does not automatically meet the idea of differentiated access.
Shield business-sensitive information without evading the obligation
Not everything a manufacturer would prefer not to share may be omitted for that reason. But not everything that is required to be collected must therefore also be publicly visible to everyone who scans the QR code. That distinction — between what must be collected and what must be shown publicly — is precisely what many companies struggle with. The page about business-sensitive data describes how that distinction works. For a mid-sized furniture company, this means that the composition of the passport is not just a matter of "what do we know", but also "who is allowed to see it" — and ideally those two questions are not answered by the same person at the same time, because one question is technical and the other is commercial.
Ensure that access continues to work after sale
A passport is not viewed once and then never again. A repairer who replaces a component years after purchase, or a recycler who dismantles the furniture at the end of its life, still needs access to the relevant data at that point. This touches on the question of how current that data is at that time, which is described on the page about how up-to-date the data in the product passport must be. For a company, this means that granting access is not just a snapshot at the time of sale, but a provision that must continue to work for ten years.
Where things go wrong in practice
A first situation: a manufacturer puts all data collected for the passport behind the same QR code, without distinction. The consumer then also sees technical production data that was not intended for them, and which perhaps never needed to be public.
A second situation: an importer wants to shield certain recipe or composition of a material, and therefore leaves that information completely out of the passport — while the obligation was to collect that data and make it available to a specific target group, just not to everyone.
A third situation: a company works with an external platform or supplier for the QR code, but has not documented who within the company is authorized to modify or supplement which data on its behalf. After a staff change, it is unclear who has access to managing the passport.
A fourth situation: a project furnisher supplies furniture to a business customer and assumes that the customer automatically has access to all underlying data, whereas this depends on how the passport and access rights are configured by the manufacturer.
A fifth situation: data on hazardous substances, as described on the page on hazardous substances in furniture, is not clearly marked as information that must be able to be shown to a supervisory authority, so during an inspection it is not immediately clear which part of the information was intended for that purpose.
What you can put in order now
- An overview of which data from the collected product information is publicly visible via the QR code, and which are intended only for specific parties.
- A list of roles or parties that need access (consumer, supervisory authority, repairer, recycler, next link in the chain) with what each role gets to see.
- Agreements with the platform supplier on how access levels are technically configured and managed, including who within the company is authorized to change that management.
- An internal overview of which data are considered commercially sensitive and on what basis that choice was made, so that this can be explained if questioned.
- Documentation of how changes to the data, for example after a repair as described on the page on repairs and refurbishment in the product passport, are implemented and who has access to it.
- A contact point or procedure in case a supervisory authority or other entitled party requests access to specific data.
This is not legal advice. This page provides general information about the legislation that this platform concerns. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, reviewed by a human on 2026-08-22. Is something wrong? Let us know — corrections take priority.