Who is allowed to view which data from the product passport?

What you concretely must do

What is expected of you

The digital product passport is not a single document that everyone sees in the same form. The ESPR is based on layered access: some data is visible to everyone with a QR scanner, other data only to a limited group of parties with a justified interest, such as supervisory authorities or market participants further down the chain. Article 10 of the ESPR (Regulation (EU) 2024/1781) makes this distinction between what is publicly accessible and what remains restricted. Article 11 then sets out how that access must be technically arranged, via rights and roles linked to the data carrier.

Making a distinction between public and restricted data

Not all information in the passport is intended for every consumer. Some data is useful for a customer in the shop, other data is mainly relevant for a recycler, a supervisory authority or a next step in the production chain. For a manufacturer, this means that when compiling the passport, the question must always be asked: who benefits from this, and who does not need to see this? That distinction directly affects, for example, the question of which data precisely belongs in the passport of a mattress — see what data will be included in the product passport for mattresses for an overview of the categories that are usually included.

Arranging access technically via the data carrier

Article 11 describes that the passport must be designed so that access to certain data can be restricted to specific user groups. For a company with 10 to 100 employees, this practically means that the company's own IT department does not need to build this: that is precisely the part that a platform such as matrapas.eu handles when compiling and hosting the passport. What the manufacturer must decide for themselves is which data belongs in which layer — that choice does not lie with the platform but with the party supplying the data.

Protecting business-sensitive information without concealing the core

Part of the questions about access actually concern commercially sensitive information: foam formulation, supplier names, composition details. The ESPR provides scope to make a distinction between what must be publicly visible and what can remain restricted to authorized parties. That is a different question from whether data must or must not be in the passport — that assessment is further explained on the page about whether or not to make business-sensitive data about mattresses public.

Ensuring that the right party can access the right layer

Who exactly gets access to which layer depends on the role that someone has in the chain or market: consumer, trader, supervisory authority, recycler. For a mid-sized company, this means that when submitting data to the platform there must be clarity about which data is intended for which group. This is not a one-time exercise: as data changes — think of a new composition or an amended durability claim — the question of who may see which version sometimes shifts as well. That relates to how often and in what way data must be kept current, as described on the page about how often the data in the product passport must be updated.

Where things go wrong in practice

A manufacturer enters all technical specifications, including supplier names of raw materials, in the publicly accessible layer of the passport, without considering whether this is necessary. Competitors can then scan this information just as easily as consumers.

An importer assumes that the platform itself determines which data is public and which is restricted, and supplies everything unsorted. Without clear instruction from the manufacturer or importer, a platform cannot make this assessment on their behalf.

A bedding specialist shop expects that customers in the shop can view all underlying test reports via the QR code, while only summary data is intended for that group. This leads to confusion and sometimes to complaints that the passport "shows nothing".

A manufacturer changes the foam composition of a mattress but forgets to indicate that the new supplier information does not need to appear in the public layer, causing sensitive data to be accidentally visible to anyone who scans.

A hotel procurement officer requests access to detailed fire safety data intended for supervisory authorities, and is told that this is not standard in the consumer layer — leading to unjustified doubt about the completeness of the passport, when the question is really about which flame retardants must be reported rather than about access.

What you can record

• An internal list of which data per mattress model are intended for the public layer and which for the restricted layer, drawn up before data are submitted to the platform.
• A submission instruction to the platform in which per data category it is stated who should have access — consumer, trade, supervisory authority, recycler.
• Agreements with suppliers about which information (for example origin of raw materials or share of recycled material) may or may not be shared in the public layer, also relevant for substantiation of the share of recycled material in a mattress.
• An overview of who within the organisation is responsible for keeping the access settings up to date when product data change.
• A documented assessment of business-sensitive information, so that when a supervisory authority or business partner makes a request it is clear why certain data have or have not been made public.
• A brief internal explanation for the sales team about what consumers see via the QR code, so that questions in the shop do not lead to wrong expectations.