can I arrange an NDA with my supplier regarding the data for the passport

Yes, an NDA and the product passport are separate matters

You can ask a supplier for a confidentiality agreement, and nothing in the ESPR (Regulation (EU) 2024/1781) prevents this. An NDA governs the relationship between two parties: who receives which information, and what may and may not be done with it. The ESPR regulates something different, namely which data must ultimately appear in the product passport of a mattress and that those data are accessible to those who have the right to them under the rules. These are two different layers: the agreement between buyer and supplier regarding confidentiality, and the obligation that rests on the product itself to provide certain information. An NDA can arrange the first layer, but cannot override the second layer.

What an NDA does and does not regulate

A confidentiality agreement can stipulate that a supplier may not share technical drawings, foam formulation, or supplier names with third parties, and that a buyer does not pass that same information on to competitors. That is precisely what an NDA is intended for: protection of commercially sensitive information between two trading parties. What an NDA is not intended for, and cannot be used for, is restricting the data that ultimately end up in the product passport. Article 10 of the ESPR describes which product information must be made available via the passport, and that obligation applies to the product, not to the individual supplier who happens to be bound by a confidentiality agreement. A supplier can therefore agree with a manufacturer that certain underlying business information is not shared with the world, but that does not exempt anyone from the obligation to provide the data that the passport requires to the party that compiles the passport. The distinction between "confidential to third parties" and "required for the passport" is precisely where an NDA must be tailored: formulated too broadly, and it unintentionally hinders the submission of passport data; formulated too narrowly, and it protects nothing.

No fixed date yet, but a fixed role distribution

When the product passport for mattresses becomes mandatory is still not established — that follows from a delegated act that does not yet exist for this product category. What is already established, regardless of that date, is the role distribution in the supply chain described in Article 38 of the ESPR for actors such as suppliers of components, and Article 29 for importers who place products from outside the EU on the market. These articles establish who must be able to provide which information, regardless of when the obligation for mattresses comes into force. An NDA that is concluded with a supplier now can therefore be well prepared for this, even if the precise date of obligation is not yet known. More about that date can be found on the page on when the passport becomes mandatory, and the background of how such a delegated act is drawn up can be found on the explanation of delegated acts.

How to approach this in practice

Anyone wishing to agree an NDA with a supplier of mattress components starts by separating two lists: which data are needed for the product passport, and which other business information is exchanged between the parties in addition. Only the second category should fall within the confidentiality agreement; the first category must remain available, even if the commercial relationship were to change. A useful step in this regard is first to clarify which data are actually needed — an overview of what the supplier is asked to provide helps to sharpen that list before the NDA text is drafted. After that, it is wise not to let the NDA stand alone, but to align the two: the purchase contract provides that the passport data is supplied, the NDA regulates how confidential information is otherwise handled. How that supply of passport data is contractually recorded is elaborated on the page on agreements in the purchase contract. An NDA can certainly exist alongside it, as long as it does not accidentally shield the same data that the contract actually requires. If in doubt about the precise boundary between "confidential" and "passport-mandatory" it is advisable to explicitly name that boundary in the NDA text, rather than relying on a general confidentiality clause that later proves open to debate.

Where this is found: Articles 10, 38 and 29 of the ESPR

The obligation to make product information available via the passport follows from Article 10 of the ESPR. The role of suppliers of components and materials within the supply chain is described in Article 38, and the additional obligations for importers who place products from outside the EU on the market are set out in Article 29. None of these articles regulate confidentiality agreements between private parties; these remain a civil law matter between buyer and supplier, with the caveat that such an agreement cannot contract away the statutory obligation to supply.

Whoever takes this on would be well advised to first obtain a complete list of required passport data, discuss that list with the supplier, and only then draft the NDA text so that it aligns precisely with what is and is not subject to confidentiality.