Digital Product Passport: Two New EU Standards for Data Security and Access Control
Europe has completed a major step in standardizing the Digital Product Passport (DPP). With the publication of EN 18239 and EN 18246, all eight European standards covering the technical framework for the DPP are now available. The two latest standards address access rights, information security, business confidentiality and data integrity, providing essential requirements for trusted data exchange across industrial value chains.
The Digital Product Passport is a central element of the European Union's Ecodesign for Sustainable Products Regulation (ESPR). It is designed to make relevant product information accessible throughout the lifecycle of products, supporting transparency, sustainability, circularity and regulatory compliance.
For the DPP to operate across industries, countries and digital platforms, companies need common technical standards. These must ensure that different systems can exchange information while protecting confidential business data and maintaining the authenticity and integrity of product records.
The European standardization organizations CEN and CENELEC have now completed the publication of eight standards developed by their joint technical committee CEN/CLC/JTC 24 under a standardization request from the European Commission.
The two latest additions, EN 18239:2026 and EN 18246:2026, focus on two critical areas: controlling access to sensitive product information and establishing trust in exchanged data.
EN 18239: Managing Access to Sensitive Product Information
Not every piece of information in a Digital Product Passport is intended for public access. Consumers may need details about materials, repair options or recycling, while manufacturers, suppliers, regulatory authorities and other stakeholders require different levels of access.
EN 18239 addresses access rights management, information system security and business confidentiality. One important element is identity management, which enables organizations, individuals, machines and digital services to be assigned recognized identities.
Based on these identities, access rights can be managed to determine which participants are authorized to retrieve restricted DPP information.
This is particularly relevant for industrial supply chains, where companies must share product-related information without exposing confidential manufacturing processes, proprietary specifications or other trade secrets.
A component supplier, for example, may be required to provide material composition or product compliance information while maintaining control over sensitive technical data.
EN 18246: Ensuring Data Authenticity, Reliability and Integrity
The second standard, EN 18246, focuses on the authenticity, reliability and integrity of information exchanged through Digital Product Passport systems.
It establishes requirements for secure information processing and communication, helping verify that product information originates from trustworthy sources and has not been modified without authorization.
This becomes increasingly important as product data is generated, updated and exchanged by different organizations throughout a product's lifecycle.
Relevant information may include material composition, technical product characteristics, compliance-related information and lifecycle documentation.
EN 18246 also introduces a framework involving electronically signed data constructs (ESDC) to support trustworthy data exchange between multiple participants, including across different industries and languages.
The standard is particularly relevant where several companies contribute information to the same product record or where data must remain verifiable as products move through manufacturing, distribution, use and recycling.
Why the New Standards Matter for RFID, Auto-ID and Industrial IoT
The Digital Product Passport establishes a connection between physical products and their associated digital information. Technologies such as QR codes, RFID and other automatic identification solutions can provide access to the relevant digital records.
An RFID tag or another data carrier attached to a product can enable its identification and link it to a digital dataset. However, the identification technology itself does not determine who is authorized to access sensitive information or whether the retrieved data can be trusted.
These functions depend on the digital infrastructure and security mechanisms behind the Digital Product Passport.
The new European standards therefore complement existing specifications covering unique identifiers, data carriers, communication interfaces and interoperability.
For manufacturers in automotive, mechanical engineering, electronics and other industrial sectors, this distinction is particularly important. Product information is often generated by multiple suppliers and exchanged between enterprise systems, production environments and external partners.
Common requirements for access control and data integrity can help companies develop DPP architectures that support secure information exchange without unnecessarily exposing confidential business data.
All Eight European DPP Standards Now Published
The first six European standards addressing the technical foundation of the Digital Product Passport were published earlier in 2026. They cover unique identifiers, data carriers, data exchange protocols, data storage, application programming interfaces and system interoperability.
With the publication of EN 18239 and EN 18246 in September 2026, the complete set of eight European standards is now available.
Six of these standards have already been referenced in the Official Journal of the European Union. Formal publication of references to the two latest standards is still pending.
This distinction is important: publication as a European standard does not automatically mean that a standard has been cited in the Official Journal for the purposes of demonstrating conformity with the relevant EU requirements.
Together, the eight standards establish a common technical framework to support the implementation of Digital Product Passports under the ESPR. The specific products covered and their implementation deadlines will be determined by the applicable EU regulatory measures.
For manufacturers, technology providers and system integrators, the completion of this standards series provides greater clarity for DPP development and integration. The two latest standards address essential requirements for trustworthy industrial data sharing: secure access to sensitive product information and reliable verification of the data exchanged throughout the product lifecycle.