Every garment placed on the EU market will soon need a Digital Product Passport. The regulation is already in force. The technical requirements for textiles are being finalised now. And the part most brands haven’t thought through yet: the QR code that connects a garment to its passport has to be on the product, which means brands designing their next collections are already in the window where this needs to be figured out.
We talk to textile and apparel brands every week about DPP. The conversations tend to follow a pattern. It starts with the basics; what is it, when does it apply, who’s responsible.
Then it gets more interesting. Brands realise that the timeline isn’t quite what they assumed. That their existing certifications cover less than they thought. That the data they need doesn’t all live where they expected it to. That some of the decisions they need to make aren’t really about compliance at all, they’re about labels, supplier relationships, and product architecture choices that have to happen months before anything hits the market.
Below are the twenty-one questions we hear most often, answered honestly, including the ones where the answer is still uncertain. If you’re just starting to think about DPP, start at the top. If you’re already in it, skip to whatever’s keeping you up at night.
*
Timing & scope
01. “When does DPP actually become mandatory for our products?”
The ESPR regulation entered into force in July 2024. The product-specific delegated act for textiles is indicated for adoption in Q4 2027. With a transition period of at least 18 months, DPPs are expected to become mandatory in mid-to-late 2029 at the earliest (an estimate; see our ESPR Textile DPP Tracker).
Here’s what that date actually means in practice. Creating a DPP, the digital passport itself, can be done quickly if using Portia once your data and systems are in place. That’s not the binding constraint. However you need to start working on the DPPs long before the products are ready.
In apparel, as you know, care labels and swing tags are ordered and printed months before a product hits the market. A label prepared for the DPP needs to carry a data carrier, such as a QR code, that links to a live, populated passport. That means your DPP system and your product identifiers need to exist and be functional at label artwork stage, not at shipping stage. For many brands, that’s 6 to 12 months before the product is ever seen by a customer.
02. “Does DPP apply to every SKU we sell, or can we do it per collection?”
The minimum requirement is model-level, one DPP per product style, where a style means all units sharing the same technical characteristics and construction. A black hoodie and a grey hoodie of the same design share a DPP. You don’t need one per collection, and you won’t need thousands of entirely separate passports.
That said, identifier structure still needs careful planning upfront. The DPP must be linkable to a specific product via a data carrier, a QR code, NFC tag, or similar, and the architecture decisions you make early about how identifiers map to models, batches, and items are difficult and costly to rework later. Getting this right from the start is significantly easier than untangling it under compliance pressure.
03. “We work with manufacturers in Asia. Who’s responsible, us or them?”
If you’re a brand placing products on the EU market under your own name, you’re responsible. If your manufacturer isn’t established in the EU, you as the importer hold the obligation to ensure the DPP is created, accurate, complete, and registered.
The regulation acknowledges the practical challenge here. But it doesn’t reduce the obligation, it distributes liability. If market surveillance authorities find the data is wrong, the importer can be held accountable for failure to exercise due diligence, while the manufacturer remains responsible for providing false information. Both parties are incentivised to get it right, which means your supplier relationships and data exchange agreements matter now, not when enforcement arrives.
04. “Do our fabric mills and yarn spinners need their own DPPs too?”
No. The current scope covers finished textile apparel only. Yarns, fabrics, and fibres are explicitly excluded from the DPP obligation under the textiles delegated act.
The catch, and it’s a significant one, is that much of the data required in your garment’s DPP originates upstream. Your mills don’t need their own DPP, but you’ll need their data on fibre origin, chemical usage, and recycled content. This is the supply chain traceability problem the JRC report spends considerable time on, and it’s consistently the hardest part of implementation. The earlier you start building structured data collection from your supplier base, the better positioned you’ll be.
Data & existing certifications
05. “We have GOTS and GRS certifications. Does that count toward DPP compliance?”
Partially, and usefully, but not completely. GOTS and GRS certifications support the disclosure of organic and recycled content, which are both required DPP data points. Third-party certifications are explicitly recognised as a valid verification path alongside self-declaration with supporting calculation parameters.
Where they fall short: certifications give you a pass/fail or a percentage for those specific categories. The DPP also requires data on substances of concern, robustness scores, recyclability scores, and carbon footprint, none of which your current certifications cover. Think of GOTS and GRS as a useful foundation for two or three data categories, not as a path to full compliance.
06. “How is DPP different from the sustainability report we already publish?”
Almost entirely different in structure and purpose. Your sustainability report is company-level, narrative, and published annually. The DPP is product-level, machine-readable, and permanently linked to each specific product via a data carrier.
A sustainability report is written for investors, regulators, and NGOs who want to understand your company. A DPP is for everyone who ever comes into contact with that specific product; the customs officer checking it at the border, the consumer scanning a QR code in a store, the second-hand buyer wanting to know what they’re getting, the recycler at end of life figuring out how to process it. It follows the product, not the company.
07. “The physical label already has fibre composition. Why does it need to be in the DPP too?”
Three reasons. Care labels degrade, get cut off, or become unreadable over a product’s life. The DPP makes that information permanently accessible, relevant for second-hand markets, recyclers, and automated sorting at end of life. Second, the DPP links fibre composition to a machine-readable identifier, enabling automated use cases a physical label can’t support. Third, the DPP carries more than a label can hold: verification source, granularity level, and connection to related data like recycled content and substances of concern.
08. “We only know what our tier-1 supplier tells us. Is that going to be a problem?”
Yes, and the JRC report is direct about it. The typical apparel supply chain involves at least fifteen economic operators before a garment reaches the consumer. Most brands have strong visibility over tier-1 assembly and progressively less over fabric, yarn, and raw material origin. 80% of garments circulating in the EU are imported, which compounds the difficulty.
The regulation doesn’t mandate full supply chain traceability at this stage. But several required data points; recycled content verification, chemical substance data, origin of recycled inputs, can only be accurate if they flow from upstream. The JRC found that current practices beyond tier-1 are dominated by manual processes, email chains, and unstructured PDFs. Brands that invest now in structured data collection from their supplier base will have a meaningful advantage when enforcement arrives.
This is where preparation time pays off most directly. Suppliers don’t change their data practices overnight. Building the relationships, the agreements, and the collection workflows takes time — typically 12 to 18 months to meaningfully improve. Brands that start in 2026 solve this before it becomes a crisis. Brands that start in 2027 don’t.
The harder data points
09. “What exactly is a robustness score and how do we get one?”
The robustness score is a new ESPR-specific performance indicator, defined in detail by the delegated act. Based on the JRC preparatory study, it derives from a set of standardised tests most manufacturers already conduct internally: visual inspection (ISO 15487), spirality (ISO 16322-3), and dimensional change after washing (ISO 3759).
The tests exist and are widely used for internal quality control. The challenge is that results are currently stored as internal PDF documents, not as structured, externally disclosable data. You’ll need to produce the score at style level for public disclosure, and conduct tests at batch level to catch manufacturing variation. It’s the same process most factories already run, it just needs to be formalized and connected to a system that can expose it.
10. “What’s a recyclability score? Do we need to redesign our products?”
The recyclability score assesses how suitable a product is for textile recycling, based primarily on material composition and construction. The methodology will be set in the delegated act, but the JRC report indicates it derives from information brands largely already hold, fibre composition, the presence of blends, and construction details.
You don’t necessarily need to redesign. A product made of 100% mono-material polyester will score well. A complex blend with bonded non-textile elements and integrated trims will score lower. In the short term it’s primarily a disclosure exercise. Over time, brands that design with recyclability in mind will have better scores, which will matter increasingly as consumer and procurement decision-making catches up with the data.
11. “How does the carbon footprint requirement work? Do we need an LCA for every product?”
The required disclosure is a performance class based on the Product Environmental Footprint Category Rules (PEFCR) for Apparel and Footwear, not a full individual LCA for every SKU. The methodology will be defined in the delegated act, using PEFCR as the basis.
Industry feedback to the JRC was consistent: batch-level carbon footprint calculation is not currently practicable. Style-level reporting using averages, agreed default values, and PEFCR benchmark datasets was seen as the only proportionate approach. The performance class, think A–G rating, not a precise number, is the public-facing output. Underlying absolute values and calculation parameters are restricted to authorities and actors with legitimate interest.
12. “What about substances of concern? Do we need chemical lab tests on every garment?”
This is one of the lowest-readiness data points in the entire DPP framework, and the JRC report acknowledges it directly. Current practice, OEKO-TEX Standard 100 and similar certifications, gives a binary pass/fail. The DPP is expected to require disclosure of specific substances present, their concentration range, and their location within the product.
Stakeholders told the JRC consistently that substance-level data is not available in a form that could be disclosed reliably or proportionately. This will be one of the most contested points in the stakeholder consultation phase, and the final requirement may be softer than the current study proposes. This is one to monitor closely, but not one to ignore.
Access, identifiers & infrastructure
13. “Will competitors be able to see our supplier names through the DPP?”
Public data includes manufacturer and importer identification, your name, address, and facility location. Supplier contact details are restricted to authorities only. Commercially sensitive information like detailed chemical concentration ranges or carbon footprint calculation parameters are restricted to market surveillance authorities or actors with a legitimate interest such as recyclers.
The manufacturing facility location is public data. If your competitive advantage relies on keeping your manufacturer confidential, this will need attention. The regulation balances transparency with trade secret protection, but the balance it strikes won’t satisfy everyone, and it’s worth thinking through now rather than discovering the implications at launch.
14. “Do we need a unique QR code on every single garment from day one?”
Not from day one, and the distinction between the identifier and the data it carries matters. The JRC recommends item-level identifiers as voluntary in the first phase, with batch-level as the mandatory minimum. You need a data carrier, a QR code, NFC tag, or similar, but it can reference a batch DPP rather than a unique item-specific one initially.
Some brands, particularly in the luxury segment, are already investing in item-level identifier infrastructure now, populating those identifiers with batch-level data in the first phase and planning to layer in item-specific data over time. This phased approach, the inheritance model, allows brands to future-proof their architecture without bearing the full item-level cost immediately. The physical investment in labelling infrastructure and the data collection investment can be decoupled and sequenced.
15. “We sell through our own site, retailers, and marketplaces. Does that affect our DPP obligations?”
Mostly no, your DPP obligation is set when you place the product on the EU market, regardless of channel. There’s a specific nuance for online sales: the regulation requires DPP information to be accessible to customers before they are bound by a contract. For marketplace listings, the platform can’t always guarantee which specific batch a customer will receive.
The JRC proposes that online platforms may display model-level data or a representative batch DPP at the listing stage, with complete batch-level data available once a specific product unit is assigned. Marketplaces have their own verification obligation, the burden sits with you as the brand, but the platform has a role in ensuring the data is present and accessible.
16. “What is the EU DPP Registry and do we register there ourselves?”
The EU DPP Registry is a Commission-operated database that stores unique product identifiers and a limited set of reference data. It doesn’t store all your DPP content, most product information is held in your own systems or those of a DPP service provider such as Portia, in a decentralized model.
The registration obligation falls on whoever places the product on the EU market. The registry’s primary function is to allow customs authorities to verify at point of import that a product has a registered DPP. The Commission launched the registry on 20 July 2026, well before textile requirements are expected to apply.
Looking ahead
17. “What happens to the DPP when a product is sold secondhand?”
The DPP stays with the product and remains accessible, this is a core design principle. Second-hand sellers fall under the distributor role in ESPR: they’re required to verify that the DPP is accessible before making the product available again, but they don’t bear the same data creation obligation as the original manufacturer.
This is one of the more valuable use cases for the DPP. A second-hand buyer scanning a garment’s QR code accesses fibre composition, care instructions, robustness score, and brand-provided repair service information, all the information that typically disappears once a product changes hands. Brands that think of the DPP as a customer touchpoint across the entire product lifecycle, not just the first sale, will find long-term value here.
18. “We have hundreds of styles per season. Is the data workload actually manageable?”
Honestly, more than you’d think, for a big chunk of it. A lot of what the DPP asks for is data you’re already collecting: what the product is, who made it, what’s in it, how to wash it. That stuff lives in your ERP, your tech packs, your label artwork. The work is less about finding new data and more about getting it out of those silos and into a format that can be shared and verified. Or if you already use Portia, most of the information will already be in the system and easily reused.
The harder stuff, chemical substances, carbon footprint, recyclability scores, is new territory. Nobody in the industry has clean processes for this yet, and the EU knows it. The JRC study was pretty clear that requirements too far outside current industry reality would be disproportionate, so expect the final rules to reflect that. But even with that in mind, “manageable” is mostly a question of when you start rather than how many styles you have. The same workload spread over two years looks very different from the same workload compressed into six months. Plus, Portia has built in functionally where you can create hundreds of DPPs and all relevant information with on file upload.
19. “The delegated act isn’t even published yet. Why start now?”
Because the infrastructure you need to build takes time the compliance timeline won’t give you if you wait. The JRC preparatory study represents the Commission’s detailed technical position, and frameworks at this level of specificity tend to survive largely intact into final legislation. The broad direction is set even if specific thresholds and methodologies will shift.
More practically: the structural problems, supplier data gaps, unstructured processes, lack of harmonised formats, on’t resolve themselves quickly. Every brand that has started early reports that supply chain data collection takes 12 to 18 months to meaningfully improve. That is not time you want to discover on the enforcement deadline.
2029 is not the start date. It’s the earliest likely deadline. The start date is now.
20. “How long does the DPP have to remain accessible after the product is sold?”
Under the ESPR, the textiles delegated act will set how long the passport must remain available, and that period must correspond to at least the expected lifetime of the product. Separately, technical documentation must be kept for 10 years after a product is placed on the market, unless the delegated act sets a different period. This has real implications for data storage architecture, service provider selection, and system longevity planning.
If you use a third-party DPP service provider and they discontinue service in year four, you’re still responsible for the data. This is why the regulation defines the role of “digital product passport service provider” explicitly, and why contractual continuity matters when selecting a platform partner. Choosing the right infrastructure from the start is significantly easier than migrating data under compliance pressure later.
21. “Who owns the data and how do we know it’s secure?”
You own the data. Full stop. Under ESPR, the economic operator placing the product on the EU market, the brand, or the importer, is responsible for the DPP and the information in it. That responsibility comes with ownership. The regulation is also built on a decentralized architecture, which means your product data doesn’t sit in a central EU database, it lives in your own systems or those of the DPP service provider you choose to work with. The EU Registry only stores identifiers, not the actual content of your passports.
On security, the regulation mandates data integrity, authenticated access, and role-based visibility. With Portia, that principle carries through to how we operate. Your product data is yours, we don’t share it, sell it, or use it for anything beyond running your DPP. You can export everything at any time. Access is controlled at the field level, not just at the account level. And because the DPP must remain accessible for a minimum of ten years, we’re built for longevity, not a tool you’ll outgrow or lose data to if you ever decide to move on. Your data comes with you.
The window is open now
The questions above don’t all have perfect answers yet, because some of the decisions that will determine those answers are still being made in Brussels. What’s clear is that the framework is solidifying faster than most brands realise, and the structural challenges of DPP compliance won’t wait for the delegated act to land.
The brands that treat 2026 as a building phase rather than a waiting phase will be in a fundamentally different position by 2029. They’ll have supplier data workflows that function. They’ll understand what they have and what they’re missing. They’ll have made the architecture decisions that are easy to get right once and expensive to rework under pressure.
Portia is built to help textile brands prepare for the DPP, starting with where they are today, not where the regulation assumes they should be. We map your existing data against the full DPP requirement set, identify the gaps, and build the data collection and management infrastructure to close them systematically, before the deadline makes it urgent.
If you’re a textile or apparel brand thinking about DPP compliance and want to understand your actual readiness gap, not the theoretical one, start with Portia. The earlier you know what you’re dealing with, the more options you have.
*This article draws on the 2026 JRC Science for Policy Report “Study on DPP content for textile apparel products under ESPR” (González-Torres, M., Arcipowska, A.) and the ESPR Regulation (EU) 2024/1781. It reflects the state of the preparatory study as of May 2026. Final requirements will be set by the delegated act, indicated for adoption in Q4 2027.
