How to Create a Digital Product Passport: Step-by-Step Guide (2026)

Creating a Digital Product Passport (DPP) is the process of collecting, structuring, and publishing product-level sustainability and compliance data in a machine-readable format, then linking it to each physical unit via a QR code or digital identifier. For a small brand's first product, expect 3–6 months from initial data audit to live deployment — with supply chain data collection (not technology) consuming the majority of that time, and each subsequent product costing a fraction of the first.

This guide walks you through the full process in seven concrete steps — using a fictional small brand, "Luma Apparel" (a 12-person cotton t-shirt company), to show what each step looks like in practice.

Step 1: Determine Your Product Scope

Before collecting a single data point, define which products need a DPP and when. The ESPR — Regulation (EU) 2024/1781, which entered into force in July 2024 — uses delegated acts — secondary legislation published per product category — to specify exactly what data is required and by when.

Identify Your Product Category

The Commission groups products into categories. Each category gets its own delegated act with specific requirements and timelines:

Pick Your Pilot Product

Start with one representative product — not your entire catalog. Choose a product that:

• Has a relatively simple supply chain (fewer variables to manage)
• Sells in high volume (maximizes the value of the effort)
• Has suppliers willing to cooperate on data sharing

Step 2: Audit Your Existing Product Data

Now map what data you already have against what a DPP will likely require. This gap analysis is the foundation of the entire process.

The Core Data Categories

While exact requirements depend on your delegated act, the ESPR framework establishes common data categories across all product types. For each category, assess whether you already collect this data:

Conduct the Gap Analysis

For Luma, the audit reveals three critical gaps:

1. Detailed material composition — They know the t-shirt is "100% organic cotton" but cannot specify the cotton variety, fiber length, or breakdown of dyes and finishes by weight percentage
2. Supply chain traceability beyond tier 1 — They buy fabric from a Portuguese mill but do not know where the raw cotton is grown or ginned
3. Environmental impact data — No carbon footprint calculation, no water usage figures, no lifecycle assessment

These gaps are typical. According to OECD research on due diligence in the garment and footwear sector (OECD, 2018), fewer than one in five fashion brands can trace materials beyond their direct suppliers.

Step 3: Engage Your Supply Chain

Your DPP is only as complete as the data your suppliers provide. This step is where most small brands hit their biggest challenge — and where starting early pays off the most.

Map Your Supply Chain Tiers

For each component of your product, identify every entity in the chain:

Luma's t-shirt supply chain:

• Tier 1: Garment manufacturer (Porto, Portugal) — cuts, sews, finishes
• Tier 2: Fabric mill (Guimarães, Portugal) — weaves and dyes the cotton
• Tier 3: Cotton ginner (Izmir, Turkey) — processes raw cotton into bales
• Tier 4: Cotton farm (Aegean region, Turkey) — grows the raw cotton

Request Data From Each Tier

Create a standardized data request template covering:

• Material composition and weight percentages
• Country and facility of processing
• Certifications held (GOTS, OEKO-TEX, BCI, etc.)
• Environmental data (energy source, water usage, waste handling)

Set Up Data Sharing Agreements

Suppliers are often wary of sharing detailed process data. Address their concerns:

• Confidentiality: Use NDAs where needed. DPP access levels mean proprietary data is only visible to regulators, not competitors
• Standardization: Use industry data exchange formats so suppliers do not have to create custom reports for each customer
• Mutual benefit: Suppliers who already collect this data can serve more customers. Frame it as a competitive advantage for them

Luma's result: After 6 weeks, they have complete data from tiers 1 and 2, partial data from tier 3 (composition yes, environmental data pending), and are still negotiating with the tier 4 farm via their Turkish ginner.

Step 4: Structure Your DPP Data

With raw data collected, the next step is organizing it into a standardized format that machines can read and regulators can verify.

Choose a Data Standard

The EU is converging on specific technical standards for DPP data. The key standards to know:

For most small brands, you will not build this from scratch. Your DPP platform will handle the data model — your job is to provide clean, accurate input data.

Map Data to Required Fields

Take each piece of raw data and map it to the appropriate DPP field. For Luma's t-shirt:

Product Identification
├── GTIN: 4012345678901
├── Model: LMA-TEE-001
├── Batch: 2026-Q1-B003
└── Description: Organic cotton crew-neck t-shirt

Material Composition
├── Organic cotton: 95.2% (GOTS certified, Aegean origin)
├── Elastane: 3.1% (synthetic, Portuguese supplier)
└── Reactive dyes: 1.7% (OEKO-TEX compliant)

Manufacturing
├── Assembly: FabricaPorto Lda, Porto, Portugal
├── Fabric: TecelMinho S.A., Guimarães, Portugal
└── Energy: 62% renewable (supplier-reported)

Environmental Impact
├── Carbon footprint: 7.2 kg CO₂e (cradle-to-gate)
├── Water usage: 2,495 L (cotton cultivation through finishing)
└── Recycled content: 0%

End of Life
├── Recyclable: Yes (mono-material after removing elastane thread)
├── Collection: Textile collection bins or retailer take-back
└── Material recovery: Mechanical recycling suitable

Validate Data Quality

Before publishing, verify:

• Accuracy — Do the weight percentages sum to 100%?
• Consistency — Does the carbon footprint calculation methodology match the standard?
• Completeness — Are all mandatory fields populated?
• Traceability — Can each data point be traced to a source document?

Step 5: Register Product Identifiers

Every DPP needs a globally unique identifier that links the physical product to its digital passport. GS1 Digital Link has emerged as the de facto standard for DPP data carriers, supported by major industry initiatives including the CIRPASS project (2024) and CEN/CENELEC JTC24 standards development. While the ESPR itself is technology-neutral — referencing "internationally recognised standards" rather than naming GS1 specifically — the industry has converged on GS1 as the practical choice.

Get a GS1 Company Prefix

If you do not already have one, register with your national GS1 organization:

1. Apply for membership — Visit your country's GS1 member organization (e.g., GS1 Germany, GS1 UK, GS1 Netherlands)
2. Receive your company prefix — A unique number block assigned to your company
3. Generate GTINs — Create individual product identifiers from your prefix

Create GS1 Digital Link URIs

A GS1 Digital Link URI combines your product identifier with a web-resolvable URL:

https://id.gs1.org/01/04012345678901/21/2026Q1B003
         ↑ GTIN                       ↑ Serial number

This URI serves as both:

• A product identifier (machine-readable, globally unique)
• A web address (scannable, resolves to your DPP data)

Luma's setup: They register with GS1 Portugal, generate GTINs for each t-shirt SKU, and create Digital Link URIs that include batch-level serialization.

Step 6: Set Up DPP Hosting and Access

Your DPP data needs to be hosted somewhere accessible, reliable, and compliant with ESPR requirements.

Hosting Requirements

The ESPR mandates that DPP data must be:

• Available 24/7 with high uptime
• Accessible for the product's expected lifetime (plus end-of-life period)
• Machine-readable via standard APIs
• Access-controlled with the correct tiered permissions (public / supply chain / regulatory)
• Registered in the future EU DPP registry

Hosting Options

For most small brands, a SaaS platform is the practical choice. It handles the technical infrastructure — data hosting, API endpoints, access control, and registry integration — so you can focus on data quality.

Configure Access Levels

Set up the three ESPR access tiers:

1. Public — Product name, material composition summary, sustainability scores, recycling instructions, certifications. Accessible by scanning the QR code.
2. Supply chain — Detailed composition breakdowns, supplier identities, batch-specific data. Accessible to verified business partners.
3. Regulatory — Full dataset including proprietary manufacturing data. Accessible only to market surveillance authorities.

Step 7: Deploy Data Carriers and Go Live

The final step connects the physical product to its digital passport through a data carrier — the QR code, NFC tag, or RFID chip that consumers and inspectors will scan.

Choose Your Data Carrier

For most textile products, a printed QR code on the care label or hangtag is the most practical and cost-effective option.

Generate and Test QR Codes

Your QR code encodes the GS1 Digital Link URI you created during product identifier registration. Before mass production:

1. Generate test codes using your DPP platform
2. Scan with multiple devices (iPhone, Android, different apps) to verify the link resolves correctly
3. Check at minimum print size — QR codes must remain scannable at the size you plan to print
4. Verify data loads correctly — The scanned URL should display the public DPP data

Integrate With Your Production Process

Work with your label printer or packaging supplier to integrate QR code generation into the production line:

• Batch-level DPPs: One QR code per batch (all units in a production run share the same passport). Simpler, lower cost.
• Unit-level DPPs: One QR code per individual product. More granular, required for some product categories (batteries require unit-level).

Luma's complete DPP is now live. A consumer in Berlin buys the t-shirt, scans the QR code on the care label, and sees: organic cotton composition, Portuguese manufacturing, OEKO-TEX certification, carbon footprint, and recycling instructions — all in a structured, regulation-compliant format.

What Does It Take? Realistic Timeline and Budget

Based on Luma's experience and early adopter benchmarks (Informatica, 2024), here is what a small brand should expect for their first DPP:

Timeline

Budget Estimates for Small Brands

The front-loaded costs are primarily labor for data collection. According to Informatica's DPP implementation research (Informatica, 2024), 60–80% of DPP data originates from tier 2+ suppliers — which is why supplier engagement consumes the majority of the budget. Once your supply chain data processes are established, adding subsequent products to your DPP system becomes significantly faster and cheaper.

How Long Does Each Step Actually Take?

The Luma Apparel timeline above is a single example. Here is how each step's duration compares against data from the CIRPASS project (2024), battery passport pilots, and early textile DPP implementations:

The most striking pattern from early adopters: the gap between first-product and subsequent-product timelines. Once your data collection infrastructure exists, adding products becomes primarily a data-entry task. Research from Bain & Company (2024) suggests that only 10% of brands currently view DPPs as a strategic opportunity rather than a burden — yet starting with a single pilot, even before the delegated act is finalized, has such high ROI that the learning and infrastructure from your first DPP accelerates every product that follows.

What Are the Most Common DPP Creation Mistakes?

These are the pitfalls we see most often across early adopters:

1. Waiting for the delegated act — The act specifies exact requirements, but 80% of DPP data (product identification, material composition, supply chain info) is consistent across categories. Starting now saves months.

2. Trying to DPP your entire catalog at once — Pilot with one product. Get the process right. Then scale.

3. Ignoring supply chain data — Your tier 1 supplier data is the easy part. The hard work is tiers 2, 3, and 4. Budget time accordingly.

4. Using non-standard identifiers — The EU is standardizing on GS1. Using proprietary identifiers will likely require migration later.

5. Treating DPP as a one-time project — Product data changes with every batch (new suppliers, updated certifications, revised carbon calculations). Plan for ongoing data maintenance from day one.

Next Steps

If you are ready to start your DPP journey:

1. Check your readiness — Our free assessment identifies your specific data gaps and gives you a prioritized action plan
2. Understand what data you need — Deep dive into each required data category
3. Learn about QR codes and GS1 — Technical guide to data carriers and product identifiers
4. Review the ESPR timeline — Know your deadlines by product category
5. Understand non-compliance penalties — What happens if you miss the deadline

Frequently Asked Questions

How long does it take to create a Digital Product Passport?

For a small brand's first product, expect 3–6 months from initial audit to live deployment. The majority of that time goes to supply chain data collection. Subsequent products take significantly less time because supplier data and processes are already in place.

Can I create a DPP without a dedicated platform?

Technically yes — you could host structured data on your own server. Practically, a DPP platform handles compliance updates, access control, registry integration, and data format changes that would be costly to manage yourself. For small brands, the build-vs-buy calculus almost always favors a platform.

What if my suppliers refuse to share data?

Start with what you can get. Some suppliers have legitimate concerns about sharing proprietary process data. Use NDAs and explain that DPP access levels protect confidential information from public view. If a supplier categorically refuses, you may need to find alternative sources (industry averages, third-party audits) or consider switching suppliers.

Do I need a separate DPP for each product variant (e.g., different colors)?

It depends on whether variants differ in material composition. A t-shirt in different sizes using identical materials can share a DPP at the model level. Different colors that use different dyes may need separate DPPs if the composition varies. The delegated act for your product category will specify the required granularity level.

Is the Digital Product Passport requirement already in effect?

The ESPR framework — Regulation (EU) 2024/1781 — entered into force in July 2024, but product-specific DPP requirements roll out via delegated acts. Battery passports are mandatory from February 2027 under the Battery Regulation (EU) 2023/1542. Textile and electronics DPP requirements are expected around 2028–2029. See our ESPR timeline guide for the full schedule.