📌 Packaging DPP: the core “system” you must plan for

A packaging DPP is not only “data fields.” It depends on a set of interoperable components that the ESPR ecosystem expects.

🧩 1) The DPP-IT System

The DPP system is a network of hardware and software that follows common technical specifications—so DPP data can be discovered, accessed, and validated across organizations and sectors.

🗃️ 2) DPP-as-a-Service

Independent third parties can provide certified DPP services, such as:

• Data storage and processing
• Backup and continuity services
• Hosting decentralized repositories on behalf of economic operators

This is particularly relevant for packaging portfolios where brands manage thousands of SKUs and frequent artwork/material changes.

🔄 3) Data Spaces (trusted data exchange)

A data space is secure digital infrastructure for standardized, trusted data exchange across stakeholders—supporting shared protocols, formats, and permissioning.

For packaging, this can connect material suppliers, converters, brand owners, logistics, and recyclers without forcing everyone into one database.

🧱 What goes into a Packaging Digital Product Passport (DPP)?

ESPR describes broad required attribute categories that will be tailored by delegated acts.

For packaging, the following DPP data blocks are the practical starting point.

🆔 Identification & accountability (who made it, who placed it on the market)

• Economic operator details (name, contact info, unique operator identifier)
• Importer details (including identifiers such as EORI where applicable)
• Unique facility identifiers (trace production origin—critical for multi-site converters)
• Additional operator identifiers when multiple actors share responsibility
• Commodity codes where required (e.g., TARIC references under applicable rules)
• The unique product identifier at the level required (model, batch, or item)

📘 Product & compliance information (what it is, and what you can prove)

• Instructions, warnings, or safety information required by applicable law
• Compliance documentation pointers (e.g., declaration of conformity, technical documentation references, certificates where applicable)
• References that remain traceable over time (versioning matters in packaging)

♻️ Lifetime & circularity information (how it should be used and recovered)

• Durability/reliability considerations where relevant (especially for reusable packaging)
• Ease of repair/maintenance where relevant (e.g., reusable transport packaging components)
• Reuse/refurbishment readiness (where packaging is designed for multiple cycles)
• End-of-life instructions: return, take-back, disposal, recycling guidance
• Ease and quality of recycling (design-for-recycling attributes)

🧪 Materials & substances of concern (what it’s made of—and what’s risky)

• Substances of concern present in the product
• Their location within the product (important for multi-layer packaging)
• Concentration (or max/range), at product or main component level
• Safe-use instructions and disassembly/separation information supporting recovery

🌍 Environmental impact & efficiency (the sustainability proof points)

ESPR includes a wide range of potential fields, including:

• Resource and energy efficiency indicators (where relevant)
• Recycled content
• Recovery potential (recycling/reuse/refurbishment where relevant)
• Waste generation expectations (including packaging waste and plastic waste)
• Weight/volume of the product and its packaging, and product-to-packaging ratio
• Environmental footprint and carbon footprint fields (where required)
• Emissions to air, water, or soil across lifecycle stages (where required)

For packaging portfolios, the key is not to “collect everything,” but to implement a governed data model that can expand as delegated acts evolve.

🧑‍💼 Who is responsible? The Responsible Economic Operator (REO) in Packaging

Under ESPR, a Responsible Economic Operator (REO) can include manufacturers, authorized representatives, importers, distributors, dealers, and fulfillment service providers—who place the product on the market or put it into service.

✅ Typical REO responsibilities for a Packaging DPP

• Ensure a Product UID exists and is attached to the packaging via a data carrier
• Upload mandatory DPP information and keep it accessible
• Manage updates over time (e.g., material change, new supplier, revised recyclability guidance)
• Support cases where responsibility may shift (for example, when packaging is part of a system that is refurbished or reintroduced)

Packaging adds a real-world complication: identifiers may be needed at model/SKU level for mass-produced items, or at batch level for lot traceability—depending on delegated acts and operational realities.

🔐 Access levels: what the public sees vs what recyclers/authorities need

DPP data is not “all public.” ESPR anticipates structured access levels, for example:

• 👤 Public (product model level): identification, safe-use info, key sustainability/circularity attributes, substances-of-concern disclosure at the required level
• 🧑‍🔧 Legitimate interest: higher-detail information that could expose know-how (e.g., detailed composition, disassembly/separation instructions)
• 🏛️ Notified bodies & market surveillance authorities: restricted compliance evidence such as test report results proving compliance
• 📦 Individual product data: restricted lifecycle or batch-specific information where applicable

For packaging, this typically translates into: consumers get “how to dispose/sort and what it contains,” while recyclers and authorities can access deeper technical details.

🏷️ Data carriers for Packaging: QR, RFID, and placement rules

ESPR states the data carrier containing the Product UID must be physically present on the product, its packaging, or accompanying documentation as specified.

🧷 Common carrier options

• QR code (low-cost, widely scannable)
• RFID (useful for reusable packaging, pooled transport items, and automated scanning)

🧾 Typical requirements to design for

• Readability (fast, reliable scanning)
• Durability (carrier survives expected handling)
• Storage capacity appropriate to the identifier strategy
• Data protection considerations
• Environmental impact considerations

🛒 Online sales requirement

For online marketplace listings, ESPR requires the Product UID to be provided so the DPP can be discovered from the online listing (e.g., via a link/identifier reference).

Publish one stable URL for the passport endpoint and manage duplicates with standard web canonicalization practices if needed.

🔎 How a Packaging DPP works (scan → resolve → enforce access → retrieve data)

A practical DPP flow looks like this:

1- 📌 The packaging carries a Product UID in a QR/RFID data carrier

2- 📲 A scanning device reads the UID

3- 🔁 If needed, the system performs UID → URI transformation (so the UID becomes globally resolvable)

4- 🌐 A resolver routes the request to the correct data location

5- 🧭 A Policy Decision Point (PDP) enforces role-based access (who can see what)

6- 🗃️ Data is fetched from decentralized DPP data repositories, with backup and archive support for continuity

This matters for packaging because portfolios evolve rapidly; you need stable identifiers and reliable resolution even as internal systems change.

🧠 Data quality & interoperability: knowledge graphs + SHACL validation

CIRPASS-oriented thinking treats the DPP conceptually as a knowledge graph using Semantic Web standards (e.g., RDF).

This supports semantic interoperability across industries and avoids brittle “one-format-only” integrations.

✅ SHACL Control Engine (validation & enforcement)

A SHACL control engine can:

• Distribute templates (“shapes”) to REOs for pre-validation
• Support market authorities for consistent surveillance checks
• Translate delegated act rules into automated validations (reducing manual bureaucracy)

In packaging, SHACL is especially useful to prevent common failure modes: missing composition fields, inconsistent units, incomplete substance declarations, or outdated end-of-life instructions.

🧭 Architecture options for Packaging DPP: HTTP URIs vs DIDs

ESPR-aligned DPP ecosystems typically evaluate two access architectures.

🔗 Option A: HTTP URI-based access (web-native)

• Uses familiar internet protocols (HTTP/HTTPS, TLS)
• Product UID is a URI or can be transformed into one (e.g., GS1 Digital Link style GTIN → URI)
• Uses resolvers (including REO-controlled resolvers) to redirect to DPP data
• Easier integration with retail and web environments

🪪 Option B: DID-based access (decentralized identity + privileged access)

DIDs are URIs that resolve to a DID Document containing verification methods and service endpoints, resolved via a Verifiable Data Registry (VDR) mechanism (ledger- or web-based, depending on the DID method).

DID-based DPP supports:

• Stronger identity and authorization patterns
• Verifiable Credentials (VCs) for “legitimate interest” access to restricted data
• Improved resilience against certain DNS/domain ownership risks

Practical note: broad consumer support for DIDs may require dedicated apps/wallet functionality, but the model is powerful for stakeholder-to-stakeholder data access (recyclers, authorities, auditors).

🗄️ Decentralized repositories, backup, and archives (continuity by design)

ESPR anticipates decentralized storage with continuity safeguards:

• Decentralized DPP Data Repositories (DDR): primary data storage under REO control or trusted providers
• Backup service providers: certified continuity support
• Archives (“service of last resort”): preserve critical DPP data when original sources disappear

This is not theoretical: organizations restructure, suppliers change, and product lines end.

Packaging DPP must remain usable for compliance, recycling, and market surveillance across time.

🤝 How ComplyMarket supports Digital Product Passport (DPP) for Packaging

ComplyMarket helps companies implement Packaging DPP requirements through its integrated Compliance Management Platform—bringing packaging specs, supplier inputs, and compliance evidence into a structured, validation-ready workflow.

Why ComplyMarket

• End-to-end enablement: from DPP scoping and data mapping to publishing and updates
• Packaging data consolidation: connects fragmented sources (ERP/PLM/PIM, documents, supplier files) into one governed dataset
• Audit-ready controls: validation and traceability to reduce gaps and rework
• Role-based access: supports public vs legitimate-interest vs authority access needs
• Integration at scale: designed to fit existing enterprise systems without vendor lock-in