What is changing this year for the Digital Product Passport due to GDPR?
The General Data Protection Regulation itself is not changing this year for mattresses. What is changing, however, is the context in which you will be dealing with it: the digital product passport makes product information publicly accessible via a QR code, and that raises new questions about which data should and should not be included in it. For manufacturers, importers and sellers who also collect customer data at purchase or registration, this is a new point of attention alongside existing GDPR obligations.
This is not about an amendment to privacy legislation, but rather about the interaction between two regulations that will continue to exist side by side: GDPR remains in force unchanged, and the regulation for the digital product passport adds a new layer on top of it. For your business, what is particularly relevant is whether, and how, these two interact in practice.
What the passport does and does not ask for
The digital product passport is intended for product information: materials, origin, maintenance, recycling options and similar data about the mattress itself. The regulation does not focus on data of individual customers. Yet in practice, a link sometimes arises, for example when a warranty registration or a service contract is attached to the same passport or the same QR code as the product information.
Once that happens, it is not the product passport regulation that provides the framework for assessment, but GDPR. Supervisory authorities then look at the usual GDPR questions: is there a legal basis for processing the data, has the customer been clearly informed about what the data will be used for, and are they not kept longer than necessary. This does not change with the arrival of the passport; the passport merely makes it more visible where these two worlds interact.
Where this goes wrong more often than expected
In practice, the mixing does not occur with the passport itself, but with the software or portal used to manage it. Some systems offer convenience by linking warranty, maintenance reminders and customer contact to a single environment. This is functionally convenient, but it does mean that personal data ends up in a system that was originally set up for product information that must remain accessible for ten years.
This is relevant because the retention period for the passport and the retention period for customer data do not automatically run in parallel. Product information may, and often must, remain available for a long time. Customer data falls under a different regime, with its own limits on how long and for what purposes they may be kept. When setting up a system, it is therefore worthwhile to separate in advance which data falls under which regime, rather than discovering this afterwards.
Questions you can ask your supplier
For companies having the passport set up by a software supplier or platform, it is advisable to explicitly ask how product data and customer data are separated from each other, who has access to which part, and whether data about customers is shared with third parties. This is not a question that follows from the product passport regulation itself, but rather one that arises from ordinary due diligence obligations under GDPR.
how data about your products and your customers remain separate from each other provides a picture of how this is arranged in practice. For a broader overview of how the various regulations relate to each other, the knowledge base with topics per situation provides a starting point.
What this could mean for your business
Whether, and to what extent, this applies to your company depends on how you set up the passport and any customer registrations. A retail store that only unlocks product information via the QR code is in a different situation than a manufacturer that links warranty, maintenance and customer contact to the same system. A first indication of where your company stands, you can get from a few questions that map out your situation.
For questions that frequently come up among companies dealing with this, there is an overview with answers to questions that other companies also ask.
What is not yet established
The precise structure of the digital product passport for mattresses, including which data must be included, follows from a delegated act that has not yet been published. As long as it is not available, it cannot be said with certainty how the fields in the passport relate in detail to personal data. For the current state of the GDPR itself, and for questions about your specific processing of customer data, the Autoriteit Persoonsgegevens is the designated supervisory authority, and for an explanation of your own situation, a lawyer is the appropriate point of contact.
Briefly summarized
Do you want to know where your company currently stands, without having to go through an entire file immediately? Do the free quick-scan or read the topics that are closest to your situation.