Do I have to make commercially sensitive data about my mattresses public?

What you concretely must do

What is expected of you

A product passport demands openness, but not the disclosure of everything a manufacturer prefers to keep confidential. The ESPR distinguishes between what belongs in the passport and who may see it. For business-sensitive data, there are in practice three layers to distinguish.

Determining which data must be mandatory in the passport

Article 10 of the ESPR (Regulation (EU) 2024/1781) lists which categories of information a digital product passport must contain. For mattresses, this concerns matters such as material composition, origin, and information on repair and recyclability. This list is not negotiable: what must be in it must be in it, regardless of whether a manufacturer prefers not to share it. For a company with 10 to 100 employees, this means primarily an internal exercise: identifying exactly which data fall under the mandatory categories, and separating that data from data that do not. An overview of what is specifically mandatory is on the page about what data will be included in the product passport for mattresses.

Making a distinction between passport data and underlying business information

Not everything a manufacturer knows about his mattress must be in the passport. A recipe, a supplier name, a purchase price or a production process are examples of information that usually do not fall under the mandatory categories of Article 10. The passport asks for the result — which material, which density, which flame retardant — not for the path a manufacturer took to get there. Those who do not make this distinction in advance run the risk of routinely sharing more than necessary, simply because it is easier to submit an entire file than to work selectively.

Taking into account who gets access to which data

The ESPR does not provide for one publicly accessible passport where everyone sees everything. There is a difference between data that are visible to everyone — for example to a consumer who scans a QR code — and data that are only accessible to specific parties, such as supervisory authorities or recyclers. Which role gets which access is described on the page about which data from the product passport each party may view. For a manufacturer, this is relevant when submitting data to a platform: not every piece of data that is submitted is also shown to everyone.

Weighing obligations as a link in the supply chain

Article 38 of the ESPR (Regulation (EU) 2024/1781) regulates what actors in the supply chain must pass on to each other in order to comply with passport obligations. This directly affects business sensitivity: a foam supplier or a flame retardant manufacturer may need to share data with the mattress manufacturer, who in turn must be able to pass it on for the passport. For a company with 10 to 100 employees, this often plays out at the level of purchase contracts and supplier agreements: what information must a supplier provide, and under what conditions does that information remain limited to what is necessary for the passport.

Where things go wrong in practice

A manufacturer submits the complete recipe of the mattress foam to a platform, out of habit or out of caution, while only foam type and density are mandatory. That excess of information is not necessarily harmful, but it is unnecessary, and makes it more difficult to determine afterwards what should and should not be public.

An importer is unsure whether the name of a specific flame retardant supplier should be in the passport, and includes that name "to be safe". When reporting which flame retardants must be listed in the product passport it is about the type of substance, not about the business relationship through which that substance was purchased.

A manufacturer draws up a supply agreement without regulating what happens to shared data once that data ends up in a product passport. Later, confusion arises over who gave consent for which level of detail, and whether a supplier agreed to disclosure of certain specifications.

A company assumes that "commercially sensitive" automatically means "does not need to be in the passport", without verifying this against Article 10. Some information that is perceived as sensitive — such as the share of recycled material — is nevertheless mandatory; see the explanation about how the share of recycled material in a mattress is demonstrated.

A manufacturer shares data with a platform without distinguishing between what must be publicly visible and what is intended only for a supervisory authority, causing competition-sensitive details to become visible to everyone who does not need to see them.

What you can record

• An internal list of which data fall under the mandatory categories of Article 10, separated from data that fall outside those categories.
• Agreements with suppliers on which information they must provide under Article 38, and what of that is intended for the passport and what is not.
• An overview of the roles that gain access to certain data, to be aligned with what is described about who may see which data.
• A documented procedure for determining foam type and density, so that it is clear which data is shared and which underlying recipe detail is not; see the approach for documenting foam type and density in the product passport.
• An internal note on the provision of data to the platform, so that a manufacturer can subsequently demonstrate which choice was made about what was and was not included.
• A note on the source and substantiation of data on expected service life, insofar as such data are derived from commercially sensitive test results; see the explanation about substantiating the expected service life of a mattress.