A DPP service provider is the company that keeps a brand's Digital Product Passports online and serves the right data to the right people. When a customer, repairer or customs officer scans a product's QR code, the passport they reach is usually stored and delivered by a service provider.
The role is defined in the Ecodesign for Sustainable Products Regulation (ESPR). A DPP service provider is an independent third party, authorized by the economic operator that places the product on the market, that processes the passport data to make it available to everyone with a right to access it under EU law.
What ESPR requires
- A back-up copy. When a product is placed on the market, the economic operator must make a back-up copy of its passport available through a DPP service provider (Article 10(4)). This keeps the passport available even if the brand goes out of business.
- Importer checks. Importers must verify that a passport exists, including the back-up copy held by a service provider, before placing a covered product on the market (Article 29).
- Limits on data use. A service provider may not sell, reuse or process passport data beyond what the service needs, unless the economic operator specifically agrees (Article 11).
- Open, interoperable data. Passport data must be based on open standards, machine-readable and transferable without vendor lock-in (Article 10).
- Registry link. Under Implementing Regulation (EU) 2026/1778, each registration in the EU DPP registry includes a reference to the DPP service provider.
Rules still to come
ESPR Article 11 lets the Commission adopt a delegated act setting the requirements a company must meet to act as a DPP service provider, the rules for providing the service and, where appropriate, a certification scheme. The Commission's indicative timeline expects that act in 2027.
Until then, the benchmark is ESPR's essential requirements and the CEN-CENELEC EN 18216 series of harmonized standards, which cover identifiers, data carriers, access rights and data exchange.
What a service provider typically does
- Hosts the passport and keeps it online for the period the delegated act requires.
- Issues identifiers and data carriers, such as a GS1 Digital Link QR code.
- Controls access, showing public data to everyone and restricted data only to legitimate-interest users and authorities.
- Keeps versions, so every change to a passport is recorded and earlier versions can be shown.
- Prepares registry data for upload to the EU DPP registry.
- Exchanges data with suppliers, customers and other systems in open formats, such as verifiable credentials.
How to choose a DPP service provider
- Check the standards. Ask which parts of the EN 18216 series and which data formats the provider supports.
- Ask about longevity. Passports may need to stay online for 10 years or more; find out what happens if you change provider.
- Test the export. You should be able to take all your passport data with you in an open format.
- Look at access control. Restricted data for repairers, recyclers and authorities needs proper roles, not just a public web page.
- Confirm the back-up copy arrangement in writing, since it is a legal duty for the economic operator.
- Check sector support for your products, for example the battery passport data model if you sell batteries.
How Veribl helps
Veribl hosts Digital Product Passports free on every plan, keeps them online for at least 10 years and stores each published version as a signed record that can't be changed. Public, legitimate-interest and authority access levels are built in, and passports are published in open formats including JSON-LD, UN Transparency Protocol credentials and the Asset Administration Shell, with a full ZIP export at any time.
See how Veribl hosts passportsOfficial sources
Frequently asked questions
Do I need a DPP service provider?
Yes, at least for the back-up copy. ESPR Article 10(4) requires the economic operator to make a back-up copy of the passport available through a DPP service provider when the product is placed on the market. The main passport can be hosted by the brand itself or by the same or a different provider.
Are DPP service providers certified?
ESPR allows the Commission to set the requirements DPP service providers must meet, and where appropriate a certification scheme, through a delegated act. The Commission's indicative timeline expects that delegated act in 2027. Until then, brands should check providers against ESPR's essential requirements and the harmonized DPP standards.
Can a DPP service provider use my product data?
Only as needed to provide the storing or processing service. ESPR Article 11 says DPP service providers may not sell, reuse or process passport data beyond that, unless the economic operator that placed the product on the market specifically agrees.
What happens to a passport if the company goes out of business?
The passport must stay available for the period set in the delegated act, which is at least the product's expected lifetime. The back-up copy held by a DPP service provider is what keeps it available if the economic operator stops trading.
What should I look for in a DPP service provider?
Support for the open standards in the EN 18216 series, a GS1 Digital Link or other compliant data carrier, role-based access for the public, legitimate-interest users and authorities, versioned records, a clear guarantee of how long passports stay online, registry-ready data and a full export so your data stays portable.
Last reviewed