DPP Registry: Who Registers Digital Product Passports and How

The EU's registry of digital product passports, the DPP registry for short, went live on July 20, 2026. It is where companies will register the passport of every product whose rules require one.

It is also widely misunderstood. The registry does not hold all your product data, it does not replace the passport, and it does not certify that a product complies with anything. This guide explains what the registry actually does, who has to register products and when, how registration works, and how it all connects to the 2D code on your packaging.

The short answer: the DPP registry is a list of identifiers, not a passport database

The DPP registry is a central system run by the European Commission. It stores the unique identifiers of products and their passports, plus a small set of required metadata. The passport itself, with its data on materials, repair, and recycling, stays with the company that created it or with that company's DPP service provider.

Think of the registry as a catalog. It tells authorities that a passport exists, who is responsible for it, and where to find it. Customs and market surveillance authorities can check a product without anyone having to put all the data in one place.

Registration is the job of the economic operator responsible for placing the product on the market or putting it into service under the applicable rules. The obligation only kicks in once the rules for your product group require a passport. Certain batteries come first, on February 18, 2027.

Where the DPP registry comes from

The registry is set up by Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation (ESPR). The ESPR introduces the Digital Product Passport, and its Article 13 required the European Commission to have the registry running by July 19, 2026.

Commission Implementing Regulation (EU) 2026/1778 of July 16, 2026 fills in the details: who can register, how companies are verified, what data they submit, and how long it is kept. The registry went live on July 20, 2026, and the implementing regulation has applied since August 6, 2026.

The July 19 deadline was the Commission's, not yours. It is the date the registry had to be ready, not a date by which every product had to be registered.

The registry also serves more than the ESPR. Products with their own passport rules, such as batteries, construction products, toys, and detergents, are registered there too.

For day-to-day work, the most useful source is the European Commission's Digital Product Passport portal. It has the timeline, registry guidance, and technical documentation, including the API.

What the registry holds, and what it doesn't

Only the European Commission, national market surveillance authorities, and customs can access the registry. Consumers can't search it. They reach the passport by scanning the code on the product, its packaging, or the documentation that comes with it.

Who has to register products in the DPP registry

Article 13 of the ESPR gives the job to the economic operator placing the product on the market or putting it into service. Who that is depends on your legal role in the supply chain, not on who physically made the product:

• Manufacturers established in the EU that sell their products on the EU market create the passport and register it.
• Companies selling products under their own name or brand can count as the manufacturer even when someone else makes the product. If so, they take on the manufacturer's obligations, passport included.
• Importers bring products from outside the EU onto the EU market and must make sure those products have a passport. Whether the importer also registers it depends on who formally places the product on the market in that supply chain.
• Authorized representatives of non-EU manufacturers don't take on this obligation. The ESPR explicitly excludes the passport from their mandate.
• Distributors, wholesalers, and retailers generally don't register passports. They check that each product has one and that customers can easily reach it, online sales included. If they sell a product under their own brand or modify it in a way that affects compliance, though, they can take on the manufacturer's obligations.

Not sure which role is yours? Check the rules for your product group before you start preparing to register.

Can a DPP service provider register on my behalf?

A DPP service provider is an independent company you authorize to store your passports. The ESPR requires a back-up copy of every passport to be held by one.

A provider can register passports for you only where the rules for your product group allow it, and it has to pass the registry's verification itself. Either way, you stay responsible for the accuracy of the data.

When you have to register

The registry is live now, but you only have to register products whose rules require a passport. Each product group has its own legal act and its own deadline.

For product groups under the ESPR, don't confuse two dates. The Commission publishes an indicative working plan with the dates it expects to adopt delegated acts for textiles, iron and steel, and other products. Those are not the dates the passport becomes mandatory.

The obligation starts on the date of application written into each delegated act. Under Article 4(4) of the ESPR, that date generally can't be less than 18 months after the act enters into force, though a shorter period is allowed in duly justified cases. This rule covers ESPR acts only. Sector-specific rules, such as the regulations on batteries, detergents, and toys, set their own deadlines.

If your products aren't in the table yet, you don't have to register anything today. But identifiers, product data, and a data carrier on the packaging all take time to prepare, so it pays to start early.

What you actually register: three different identifiers

Registration involves three identifiers that are easy to mix up. Each one does a different job:

Example: a product with a GTIN and a serial number

Say your product's passport has to be kept at item level:

1. Prepare the product identifier. The item is identified by GTIN 00012345000058 and serial number SN12345.
2. Put it in a GS1 Digital Link address and print that address in the 2D code on the product: https://gtin.at/01/00012345000058/21/SN12345. This is a live demo product in the Thing Identity resolver, so go ahead and open it.
3. Publish the passport at that address and keep a back-up copy with a DPP service provider.
4. Register the passport. The registry returns a unique registration identifier, a new value it generates. It is neither the GTIN nor the address in the code.

That's three different values: the GTIN, the address in the code, and the registration identifier. You create the first two, and the registry gives you the third. The exact identifier formats are set by the standards and rules for each product group.

How to register a product, step by step

1. Check the requirements for your product group

The delegated act or sector-specific rules say what data the passport must contain and whether it covers a model, a batch, or a single item. That decides how many passports you register: one per model, or one for every batch or unit.

2. Prepare the passport and its back-up copy

The passport has to exist before you can register it. You can host it yourself or with a DPP service provider, but the back-up copy must always sit with such a provider. The data has to stay available for at least the product's expected lifetime, even if your company stops trading.

3. Assign a unique identifier and add a data carrier

The ESPR separates two things. The unique product identifier pins down the product at the required level. The data carrier, a barcode, a 2D code, or another machine-readable medium on the product, its packaging, or its documentation, gives access to the passport.

GS1 Digital Link does both. It puts the GTIN, and the batch or serial number where needed, into a web address, so a single address identifies the product and leads to its passport.

4. Register your company

You sign in to the registry with EU Login, the account used across European Commission systems. Then you enroll your organization with an identifier such as its company register number, VAT number, or LEI.

Your company then has to verify its identity. A legal entity signs a declaration with a qualified electronic seal, and a sole trader signs with a qualified electronic signature. Only verified companies can register passports, and verification has to be renewed periodically.

5. Register the passports

You can register passports in the web interface, one at a time or in bulk, or through the registry's official API. The registry checks that the data is complete and valid, then returns a unique registration identifier and proof of registration.

6. Give the registration identifier to customs

When goods are released for free circulation in the EU, the declarant gives customs the registration identifier. Customs checks it against the registry, together with the commodity code, before releasing the goods. The plan is to automate this check by connecting the registry to the EU Customs Single Window Certificates Exchange System (EU CSW-CERTEX).

7. Update the entry when your registered data changes

The passport lives outside the registry, so editing it, for example adding a new manual or updated repair information, doesn't necessarily mean touching the registry entry. You update the entry when the data you registered changes, such as the provider holding the back-up copy.

Does the DPP registry have an API?

Yes. The European Commission has published an official registry API with documentation: an integration guide for economic operators, an OpenAPI specification, and a guide to service accounts for system-to-system access. There is a test environment too.

If you have hundreds or thousands of products, the API is the only realistic way to register them. You can trigger registrations straight from your ERP or PIM, for example whenever a new batch is created or serial numbers are assigned.

Registering a passport and publishing it are two separate jobs, though. The registry API only takes identifiers and metadata. The passport itself still has to be available at the address your code points to.

Registration is not a certificate of compliance

The registration identifier proves one thing: that the passport has been registered. The ESPR states explicitly that it is not proof of compliance. Likewise, clearing customs doesn't mean a product meets every rule.

You remain responsible for the passport's content and for the product itself, and market surveillance authorities can check either at any time.

How the DPP registry connects with GS1 Digital Link

The registry stores the identifier, not the page it leads to. That part is up to you.

A GS1 Digital Link resolver is the service that answers each scan. It reads the identifiers in the address and decides where to send the person scanning. Because the code holds the product identifier rather than the address of a specific page, you can change the content without reprinting labels.

Can one QR code serve both the passport and a regular product page?

Yes. One GS1 Digital Link address can lead to several resources for the same GTIN, each tagged with a link type (linkType) from the GS1 vocabulary. A customer scanning with a phone lands on the default link, usually the product page. An app or system that needs the passport asks the resolver for that specific link type.

In practice, one code can lead to:

• a product page for customers, set as the default link,
• the product passport, as a separate resource,
• an e-label, instructions, or recycling information.

Keep in mind that a passport is more than a page to read. The rules may require machine-readable access to the data, different access rights for different audiences (some data only for surveillance authorities, for example), and a specific data format. A plain HTML page won't always be enough, and whether a data carrier meets the requirements depends on the rules for your product group.

Is a QR code enough to meet DPP requirements?

No. A QR code is just a data carrier. To meet the requirements, you need four things:

1. A product identifier at the level the rules require.
2. A data carrier, such as a 2D code, placed where the rules say.
3. A passport with all the required data, available for the product's whole lifetime, with a back-up copy held by a DPP service provider.
4. Registration of that passport in the EU registry.

A code without a passport doesn't comply. Neither does an unregistered passport where the rules require registration.

The back-up copy: what if your provider goes out of business?

Before choosing a DPP platform, ask one question: what happens to your passports if your company, or your software provider, disappears? The ESPR answers it with a mandatory back-up copy.

What the rules say

• The passport has to stay available for at least the product's expected lifetime, including after the company that created it goes insolvent, is liquidated, or stops operating in the EU.
• When you place a product on the market, you have to make a back-up copy of its passport available through a DPP service provider (ESPR Article 10(4)).
• A DPP service provider is an independent third party authorized by the operator placing the product on the market (ESPR Article 2(32)).
• The provider may not sell, reuse, or process the passport data beyond what the service requires, unless you agree otherwise.
• The registry records which provider holds the back-up copy, so authorities know where to look.

Delegated acts and standards for individual product groups may add more detailed requirements for DPP service providers.

A back-up copy is not a database backup

Any decent software provider backs up its database, for example by copying the database and files to another cloud region. That protects against outages, but not against the provider itself going away: the same company controls the backup, and it disappears along with that company.

The back-up copy in Article 10(4) exists for exactly that moment, when the main system is gone. That is why it is made available through a DPP service provider rather than simply stored in the same system's infrastructure. To do its job, it shouldn't depend on the company that runs the main version.

The copy has to stay current

A year-old copy is of little use if the passport has changed since. In practice, you need:

• every newly published version of the passport sent to the back-up provider,
• versioning, so you know which version was valid at any given time,
• regular checks that the copy is complete and matches the main version,
• a documented procedure for making the copy available if the main version goes down.

Three scenarios to prepare for

The domain is the easiest thing to overlook. If nobody renews the domain in your code, the code stops working, even though the passport's back-up copy still exists. Decide in advance who will take over the domain and how customers and authorities will reach the copy.

Questions to ask before choosing a platform

• Who controls the domain in the code? If the code points to your provider's domain, switching providers may mean reprinting labels. Your own domain or subdomain lets you switch without touching the code.
• Who holds the back-up copy, and is it a different company from the one hosting the main version?
• How often is the copy updated, and who is responsible for it?
• What format can you export passports in, and what does migrating to another system involve?
• How long does the contract guarantee the copy stays available, including after the contract ends?
• What happens to the data if the manufacturer is liquidated?

Thing Identity lets you print codes on your own brand domain and keeps the product identifier separate from the system where you manage content. The code on your packaging stays the same even if you move your data elsewhere. Thing Identity can also hold just the passport's back-up copy, as described below.

Where Thing Identity fits in

Thing Identity is infrastructure for identifying products and sharing product information. With it, you can:

• generate GS1 Digital Link codes,
• manage a resolver that sends one code to many resources,
• build multilingual product pages,
• share documents and product information.

It covers what the registry doesn't: a stable identifier on the packaging and an address where customers and systems can find your product information.

Thing Identity as your passport's back-up copy

You can keep the passport in your own system and let Thing Identity store and serve its back-up copy. You run the main version, and Thing Identity, as an independent provider, holds a copy that keeps working even if your system goes down.

A back-up copy doesn't mean paying a subscription every month for the product's whole lifetime. A single monthly payment is enough: Thing Identity then stores and serves the copy for at least 2 years.

Frequently asked questions

Summary

The DPP registry is a central list of digital product passport identifiers. Products are registered by the operator responsible for placing them on the EU market, and only once the rules for their product group require a passport.

Registration is the last step, not the first. Before it, you need the passport, its back-up copy, a unique identifier, a data carrier on the product, and a stable address where the passport will live.

Want your product identifiers ready before the rules arrive? Create a code with the GS1 Digital Link generator or book a free consultation.

Official sources

• European Commission: Digital Product Passport resources and documentation (including the registry API)
• European Commission: The Digital Product Passport Registry is now live (July 20, 2026)
• Regulation (EU) 2024/1781 on ecodesign for sustainable products (ESPR)
• Commission Implementing Regulation (EU) 2026/1778 on the digital product passport registry
• Regulation (EU) 2023/1542 concerning batteries
• Regulation (EU) 2026/405 on detergents
• Regulation (EU) 2025/2509 on the safety of toys