Who is allowed to view which data from the digital product passport?
Access to the passport is tiered, not everything for everyone
Which data from the digital product passport anyone may view depends on the type of data and the role of the person viewing it. The ESPR does not work with a single public passport where everyone sees the same information, but with a tiered system: some data is accessible to everyone as soon as someone scans the QR code, other data is only visible to parties with a demonstrable interest, such as repairers, market participants further down the supply chain, or supervisory and customs authorities. Which data falls into which tier is determined per product category. For tyres, that allocation is not yet fixed, because the delegated act that makes this concrete for tyres has not yet been published.
For tyres, the general framework applies, not yet the details
Article 10 and article 11 of the ESPR describe the general system: that a distinction is made between the general public and parties with a specific interest, and that the technical design of the passport must be able to support this distinction. That framework applies to all product categories falling under the digital product passport, so also for tyres. What does not yet follow from these articles is the precise allocation for tyres themselves: which data — for example the rolling resistance coefficient, the year of production, data about raw materials, or repair and maintenance information — comes into the public tier and which data is restricted to specific parties. That specification is reserved for the product-specific delegated act for tyres. This article therefore concerns the existing distinction between access levels in the ESPR, not a ready-made access matrix for tyres.
The date is not yet fixed, the framework is
There is no fixed date yet on which the access rules for the tyre passport will become concrete. According to the ESPR's work plan for the period 2025-2030, the delegated act for tyres is expected in 2027; the first obligations for tyre passports are expected around 2029. Both dates are indications from the work plan, not fixed obligations. Until the delegated act for tyres is published, there is no legally established allocation of data across access levels for tyres. What is fixed is the underlying system from article 10 and 11 of the ESPR: a passport with differentiated access, supported by a technical design that makes this distinction possible. Once the delegated act for tyres is published, the allocation for tyre data will be made concrete here.
What an importer or distributor can do with this now
For anyone already dealing with tyre passports or preparing for them, it is useful to already make a distinction between types of data in their own administration: data that by their nature seem intended for everyone (such as product characteristics that already appear on the label), and data that are more relevant to a limited circle (such as detailed composition data, test reports, or data relating to confidential business information). That allocation does not yet need to be definitive, but helps to be able to respond quickly once the delegated act for tyres makes clear which tier applies to which data. In addition, it is practical to think about who within your own organisation or supply chain provides which data, and how that provision aligns with a system with different access levels — that is different from the current label, where all information is equally visible to everyone. Finally, following the publication of the delegated act for tyres is the most concrete step: only then will it become clear which data will be for the general public and which for specific parties such as supervisory authorities, customs or professional users in the supply chain.
What this is based on: article 10 and 11 ESPR
The distinction between access for the general public and access for parties with a specific interest follows from Article 10 of Regulation (EU) 2024/1781 (ESPR), which describes the requirements for the digital product passport. Article 11 of the same regulation describes the technical design and operation of the passport, including the way in which the system must be able to facilitate different access rights. Which data for tyres specifically fall into which layer is laid down in the product-specific delegated act for tyres still to be published, which according to the ESPR work plan 2025-2030 is expected in 2027.
What to do now
Those who manage tyre data can now already map out what data exists and roughly categorise it according to sensitivity, without yet drawing final conclusions from it. Following the publication of the delegated act for tyres — via official EU sources — is the way to find out in time which data will be public and which will remain of limited access.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 11 (technical design and operation of the digital product passport)
The regulation itself is available on EUR-Lex. We provide references per statement; you do not have to take our word for it.
What you must do concretely
What is expected of you
The product passport is not a single block of data that everyone sees in the same form. The ESPR makes a distinction between who can access which layer of information, and that distinction is precisely where businesses run into practical difficulties. Article 10 of the ESPR (Regulation (EU) 2024/1781) determines which data must be accessible and to whom, and Article 11 of the ESPR (Regulation (EU) 2024/1781) regulates how that access is technically arranged via the data carrier and the underlying registration system.
Distinguishing between public and restricted access
Some of the data in the passport is intended for anyone who scans the QR code: the end user, the garage, the private buyer. Another part is intended for parties with a specific role in the chain, such as market surveillance authorities or customs. For a tyre importer or wholesaler, this means that not everything that is supplied automatically becomes publicly visible. Which category belongs to which audience depends on the delegated act for tyres that must specify this for the product group. For a company with 10 to 100 employees, it is practical to ensure, when supplying data to a passport service, that it is recorded which fields are intended as public and which as restricted, rather than having this sorted out afterwards.
Ensuring the right party reaches the right layer
Article 11 of the ESPR (Regulation (EU) 2024/1781) describes that the technical design of the passport must enable layered access: the QR code on the tyre leads to a basic level, while supervisory authorities and other authorised parties can access more detailed data via a different access path. For an importer, this means that the choice of a passport service is also a choice for how that layered access is technically arranged. A service that puts all data flat behind one QR code does not meet what Article 11 intends, and that risk ultimately lies with the party responsible for the passport, not solely with the service provider.
Shielding business-sensitive information without evading the obligation
Some of the data that a manufacturer or importer supplies may be commercially sensitive: compositions, test methods, supplier relationships. Article 10 of the ESPR (Regulation (EU) 2024/1781) recognises that not all underlying information needs to be public, but this does not exempt a company from the obligation to correctly supply the data that is intended for the public or the supervisory authority. What can and cannot be treated as business-sensitive, and how this relates to the obligation to share data, is covered more extensively on the page about whether business-sensitive data on tyres must be made public.
Aligning access with what actually is in the passport
The question of who may see which data is inevitably linked to the question of which data is in the passport at all. A company that still has to determine which fields are mandatory for tyres would be well advised to first clarify that overview via the page about which data will be in the product passport for tyres, before it sets up an access structure that does not align with it.
Where things go wrong in practice
A wholesaler has a passport service set all supplied data to public by default, including internal test results that were not intended for the end user, because no one had indicated in advance which fields should remain restricted.
An importer assumes that market surveillance accesses via the same QR code as the consumer, and therefore does not set up a separate access path — with the result that an inspection is delayed because the supervisory authority cannot access the underlying technical documentation.
A company confuses the distinction between "who may read the passport" and "who may edit the passport", and grants an external party read rights that inadvertently also include write rights, risking unauthorised modifications.
A fleet manager receives from a supplier only a general link to the product passport, without clarity on which part of the information is specifically intended for the tyre user and which part for supervision — with confusion about what is relevant for maintenance and replacement.
A manufacturer treats the rubber composition as fully public because it is included in the product passport anyway, without investigating whether that specific field can fall under a restricted access category; those wishing to explore this further will find more background on the page about what data on rubber composition must be recorded.
What you can record
- An overview of which fields in the product passport are publicly accessible and which fall under restricted access, coordinated with the passport service when submitting data.
- An internal agreement on who within the company has which rights: to read, submit, or modify data in the product passport.
- Documentation on how layered access has been technically implemented by the chosen passport service, so that this can be demonstrated during an inspection.
- An overview of which data have been marked as business-sensitive and on the basis of which consideration this was done.
- A documented procedure for what happens if data must be adjusted after publication, including who has access for this — more information on this is available on the page about whether data can be adjusted after the product passport has already been published.
- A contact point within the company that can answer questions from supervisory authorities about access to specific data layers.
Once the delegated act for tyres is published, it will likely specify more clearly which data categories are public and which are restricted, and which parties exactly belong to the group with expanded access. Until then, documenting one's own choices and the reasoning behind them is the most concrete action a company can take.
This is not legal advice. This page provides general information about the legislation that this platform concerns. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something incorrect? Let us know — corrections are given priority.