The digital tire passport is fundamentally composed of product data: material composition, technical specifications, label values and conformity documents. These are not personal data, and the GDPR is not essentially applicable to them. The question becomes more interesting once a company begins using the passport in its own business operations, for example by linking it to a license plate, a driver or a maintenance log with a name in it.
At that point, a second layer of data emerges that is not prescribed by the regulation, but by the way a company uses the passport in its own processes. That layer can contain personal data, and then it is up to the company itself to assess whether and how the GDPR applies to it. That distinction between the mandatory product data and the voluntarily added business data is the detail that comes most to the fore on this subject.
What the passport contains as standard
The data categories for the tire passport will be established via a delegated act under the ESPR regulation. That act has not yet been published; the work plan mentions 2027, and the date on which tire passports actually become mandatory is expected to be around 2029. What is clear: the data prescribed by the regulation concerns the product. Think of the identification of the tire, the materials used, performance values and documentation proving compliance with rules. There is no reason in that design to include names, addresses or other data of persons. Anyone wishing to see which categories are already visible in practice and where they come from will find an overview in the knowledge base with explanations per topic.
Where personal data can still appear
Companies often build their own administration around the passport. A fleet manager links a tire to a license plate and a driver. An installation company records maintenance work with the name of the fitter who mounted the tire. A garage registers a customer name with a warranty claim. That data is useful for their own business operations, but it does not belong to the mandatory product data of the passport itself. It arises in the systems around it: the fleet management system, the accounting system, the CRM environment. It is that own layer where the GDPR can play a role, not the passport as such.
Who is responsible for what data
For the product data in the passport, responsibility lies with the person who provides the data, usually the manufacturer or importer acting as a supplier. For the data that a company adds itself in its own administration, a different relationship applies: the company itself is the party that must assess whether personal data is being processed and on what basis that occurs. That is a separate assessment, separate from the obligations arising from the ESPR regulation. A lawyer or the Authority for Personal Data is the appropriate party to make that assessment for a specific situation.
What this means for agreements with your supplier or host
Once a company engages a software partner or hosting partner to manage the passport, it is useful to ask what data that partner stores exactly, where the data is located, and whether a processor agreement is needed. This is particularly relevant if the supplier also manages the additional business data, such as maintenance logs or links with license plates. How tyrepas.eu handles data storage and security of the passport's core data is explained on the page security and data handling. For your own supplementary administration, the assessment and the arrangement with the software supplier remains a matter for your company itself.
What you can check yourself
It is straightforward to first map out which data your company collects around the tyre passport, and which of those can be traced back to a person. If it is purely product data, the GDPR is not relevant. As soon as names, registration numbers linked to a driver, or other traceable data are added, a separate GDPR assessment is appropriate. A first impression of where your situation stands is provided by the product scan with a few short questions. For the precise assessment in your own company, a lawyer or the supervisory authority remains the appropriate point of contact.
Do you want to see more broadly which questions apply to the tyre passport, from role in the chain to contractual arrangements with your software supplier? The frequently asked questions about the tyre passport provide an overview, and the free quick-scan shows in a few minutes where your company stands.