Who may read a Digital Product Passport, and who decides
A Digital Product Passport is not one document with one audience. Part of it is public, part is for named readers only, and part is for authorities. Who sits in which group is decided in three places: the regulation itself, an implementing act that - for batteries - now exists in draft, and two European standards published in September 2026 that say how a passport system must enforce the split.
This article walks through all three. The detail of which battery fields are public is in our battery passport guide; here the question is who may read the rest, and who decides.
Layer 1: the regulation names purposes, not companies
Batteries. The Battery Regulation splits the passport three ways (Article 77(2)): information for the general public, information for notified bodies, market-surveillance authorities and the Commission, and information for “any natural or legal person with a legitimate interest”. It then defines that interest by purpose, not by relationship:
- dismantling, safety measures during dismantling, and the detailed composition of the battery model, where that is essential for repairers, remanufacturers, second-life operators and recyclers to do their work; and
- for an individual battery, what the purchaser - or someone acting for the purchaser - needs to offer that battery to independent energy aggregators or energy market participants.
Access is free of charge (Article 78(b)). A recycler’s claim does not depend on whether it ever bought anything from the manufacturer: access follows the activity.
Everything else, under ESPR. The Ecodesign Regulation (EU) 2024/1781 works the same way one level up. It lists who should have free and easy access to passports - customers, manufacturers, importers, distributors, dealers, professional repairers, independent operators, refurbishers, remanufacturers, recyclers, market-surveillance and customs authorities, civil society organisations, trade unions and other relevant actors - “based on their respective access rights” (Article 11(b)). Who sees which data is left to each product group’s delegated act (Article 9(2)(f)). The same article requires that only those with rights may add or change data (11(f)), that data authentication, reliability and integrity are ensured (11(g)), and that passports are built for a high level of security and privacy (11(h)). Customers’ personal data may not be stored in a passport without their explicit consent (Article 10(1)(e)).
Layer 2: the draft battery act names the readers
The Battery Regulation required the Commission to name the legitimate-interest readers in an implementing act by 18 August 2026 (Article 77(9)). That deadline passed. On 19 October 2026 the Commission published a draft (Ares(2026)9814179), open for feedback until 16 November. It is a draft, not law, but it shows the shape of the answer.
| Annex XIII information | Readers named in the draft |
|---|---|
| 2(a) detailed composition and 2(c) dismantling information | repairers, remanufacturers, repurposers, waste-management operators carrying out treatment, recyclers, and vocational training centres for battery repair, repurposing or remanufacturing |
| 2(b) part numbers and sources of spare parts | repairers, remanufacturers, repurposers, and the battery’s purchaser |
| 2(d) safety measures | all of the above, plus end-of-life vehicle treatment facilities and treatment facilities for electrical and electronic waste |
| 4 the individual battery’s data (performance, state of health, use history) | the purchaser, or a third party acting on the purchaser’s behalf |
Reading comes with terms (draft Article 2). The purposes are evaluating a battery’s status, residual value and capability for further use, and repair, re-use, repurposing, remanufacturing or recycling - or choosing between them; the purchaser may also use its battery’s data to offer the battery to independent aggregators or market participants. Readers may download and use what they can see, but keep it no longer than they need. They may not share or publish it, with listed exceptions: emergency services, poison centres for composition data, prospective buyers and authorities for the individual battery’s data, customs, and anything the economic operator authorises. Safety measures are the exception to the exception: those readers may share and publish them freely.
Three things stand out:
- The individual battery’s data belongs to the purchaser’s side. A recycler reads how the model is built and taken apart; a specific battery’s history is for the purchaser, and anyone else - a repurposer valuing a used pack, for example - reads it as a party acting for the purchaser.
- Access is not a yes/no gate. Each reader gets a purpose, a retention limit and sharing rules, and the restricted part splits four ways rather than into one “restricted” bucket.
- The draft does not say how a reader proves it is a repairer or a recycler. That is left to the economic operator and its passport system.
Layer 3: EN 18239 and EN 18246 say how a system must enforce it
CEN published two standards in September 2026 that complete the set of eight for Digital Product Passports: EN 18239 (access rights management, information system security and business confidentiality) and EN 18246 (data authentication, reliability and integrity). Unlike the other six (EN 18216 to EN 18223), they are not yet cited in the Official Journal. Neither decides who reads what - EN 18239 leaves the roles for each product group to the legal act. What they add is how.
EN 18239 asks, among other things, that:
- public data is readable without logging in, and is not refused because of where the reader is;
- every actor is identified by a unique operator identifier (EN 18219), and the economic operator assigns rights to identified actors in line with the legal act;
- access rights are enforceable per data element, according to the reader’s role;
- the system resists mass scraping;
- every read of restricted data and every change of rights is logged, in a log that resists tampering;
- rights can be granted, changed, delegated and revoked - including in an emergency - under a documented process and a written revocation policy;
- readers are not profiled unless authentication is strictly required;
- security is managed in line with ISO/IEC 27001, with business continuity planned.
EN 18246 adds integrity and authenticity:
- passport data is protected from unauthorised change and attributable to a verifiable source, and its integrity can be checked whatever channel it arrived through - free of charge;
- whoever provides data signs in with a certificate obtained through identity proofing, and every change - including creation and deletion - is bound to that identity;
- public readers need no login and no special software, and no personal data is collected from them;
- in a normative annex, passport data can travel as electronically signed data constructs, signed by their issuer - for core product data, typically the economic operator placing the product on the market.
Two caveats. Both standards are a voluntary way to meet the law, and their Annex ZA ties them to one ESPR requirement only - organisational interoperability under Article 11(a). Even once cited, they do not by themselves show that a passport meets the rest of Articles 10 and 11.
What to do now
- Map restricted data to readers by sub-point, not to one restricted tier - the draft splits Annex XIII point 2 four ways.
- Treat individual-unit data as the purchaser’s, and plan for parties acting on the purchaser’s behalf.
- Attach terms to every grant - purpose, how long the data may be kept, with whom it may be shared - and show them to the reader.
- Keep the public part public: no login, no tracking. Check your passport pages for analytics and IP logging.
- Ask your passport provider how it identifies readers, logs access, revokes rights and signs data.
- Keep it configurable. The battery act is a draft, the two standards are not yet cited, and ESPR product groups will bring their own access rules.
- If you have a view on the draft, comment by 16 November.
For how we approach Digital Product Passports, see the DPP Platform and our ESPR and DPP overview.
Frequently asked questions
Is a Digital Product Passport public?
Partly. Each passport has a public part that anyone can read without logging in, and restricted parts for named readers and for authorities. For batteries, Annex XIII point 1 is public; points 2 to 4 are not.
Who decides who may read the restricted part of a battery passport?
The Battery Regulation sets the purposes (Article 77(2)), and a Commission implementing act names the readers (Article 77(9)). That act was published in draft on 19 October 2026 and has not been adopted.
Can a recycler read an individual battery’s state of health?
Not under the draft. An individual battery’s data (Annex XIII point 4) is for the purchaser or a party acting on its behalf. A recycler reads the battery model’s composition, dismantling and safety information.
Do EN 18239 and EN 18246 decide who may read a passport?
No. They specify how access is managed, secured and verified. Who reads what comes from the legal act for each product group - for batteries, the Article 77(9) act.
Are EN 18239 and EN 18246 mandatory?
No. They are published European standards and a voluntary way to meet the law. They are not yet cited in the Official Journal; once cited, the presumption of conformity covers organisational interoperability under ESPR Article 11(a) only.