can I agree on an NDA and still comply with the passport
Yes, confidentiality and the product passport do not exclude each other
A confidentiality agreement (NDA) with a supplier or customer can coexist alongside the obligations of the digital product passport. The ESPR requires that certain product data be made available via the passport, but it does not specify how parties agree among themselves on who may use, share, or resell which information outside that passport. An NDA governs the relationship between two parties; the passport governs what becomes visible to the market, the competent authority, and the next actor in the supply chain. These are two different layers, and they can coexist perfectly well as long as the NDA is not used to withhold the mandatory passport data itself.
What an NDA can and cannot shield
An NDA can establish agreements on matters that do not fall within the mandatory passport content: price agreements, production processes, supplier relationships, internal quality data, or commercial terms. What an NDA cannot do is exempt from that obligation the data that Article 10 of the ESPR (Regulation (EU) 2024/1781) designates as mandatory information for the product passport. Once a delegated act for steel specifies which data must be included in the passport — such as origin, composition, or conformity information — that obligation applies regardless of what stands in a confidentiality contract between two trading partners. An NDA applies between the parties who sign it; the passport obligation applies to the supply chain and the competent authority, and the two do not automatically align.
That distinction is particularly relevant when drafting purchase contracts. Whoever sets out agreements in the purchase contract on the provision of passport data should take care to separate those agreements from any NDA covering other business information. A supplier who refuses to provide the data required for the passport by invoking a confidentiality agreement conflates two different obligations — that is a situation separately described under what to do if a supplier does not provide the data.
No fixed date yet, but a fixed sequence
No delegated act has yet been published that specifies precisely which data for iron and steel must be mandatory in the passport. Without that act, it is also impossible to say with certainty exactly where the boundary lies between what must be publicly or supply-chain-wide available and what can be shielded within an NDA. What is certain: the ESPR itself already establishes in Article 10 the framework for what a product passport must contain, and in Article 38 the obligations for actors in the supply chain to pass on relevant information. Until the delegated act is in place, there is thus a general framework but no sector-specific data list for steel. Once that act is published, the date and precise content will be posted here.
How to approach this in practice
If you are already considering an NDA alongside passport obligations, it is advisable first to determine which data will form part of the mandatory passport content in the future — this will become clear once the delegated act is available, but the systematic approach of Article 10 already provides an indication of the categories (origin, composition, conformity). Next, it is useful to formulate the NDA in such a way that it explicitly does not apply to data that must legally be included in the passport; this prevents subsequent disputes over which information falls under which agreement. Thereafter, it is practical to establish who within your own organisation or at the supplier is responsible for separating "passport data" and "confidential business data" — it may be the same person, but it is a different consideration. For those importing steel from outside the EU, this carries additional weight: the obligations of importers follow from Article 29 of the ESPR, and that obligation is separate from any confidentiality agreements with the foreign supplier — more on this is set out at what the product passport means when importing from outside the European UnionTo conclude, it is prudent to consider in advance, when compiling the passport from multiple sources, how this is consistent with any confidentiality agreements per supplier, a matter that is explained further at combining data from multiple suppliers.
The legal basis: Articles 10, 38 and 29 of the ESPR
Article 10 of the ESPR (Regulation (EU) 2024/1781) determines which categories of information a digital product passport must in principle be able to contain and thus sets the baseline for what cannot be withdrawn from contractual confidentiality. Article 38 governs the obligations of actors in the supply chain to make relevant information available to the next actor, meaning that an NDA between two actors cannot set aside that obligation to pass on information. Article 29 lays down specific obligations for importers regarding product information they must be able to demonstrate, regardless of agreements they have made with their foreign supplier concerning confidentiality of other business data. Together, these articles determine that an NDA can be a supplement to the commercial relationship, but not a substitute for the passport obligation.
Anyone currently drafting or revising an NDA in light of the future passport obligation can best structure the text so that it leaves the statutory information obligation unaffected and limits itself to business information that falls outside it — and verify the final delineation once the delegated act for steel has been published.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 38 (requirements for actors in the supply chain)
- Regulation (EU) 2024/1781 (ESPR), Article 29 (obligations of importers)
The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.
What you must concretely do
What is expected of you
A confidentiality clause with a supplier or a customer is not in itself a problem. The question that matters is not whether an NDA is in place, but whether the data that the passport mandatorily requires are made available for the passport despite that NDA. These are two separate matters: what you agree with each other about confidentiality, and what must ultimately appear in the passport according to Article 10 of the ESPR (Regulation (EU) 2024/1781).
The content of the passport is not open to negotiation
Article 10 of the ESPR describes which product information a digital product passport must contain. Which specific data that is for iron and steel follows from the delegated act for that product group — see also what a delegated act is and why it determines what you must doAn NDA cannot arrange for a mandatory item to be omitted from the passport. For a company with 10 to 100 employees, this means in practical terms: a confidentiality clause may restrict the manner in which data are shared and used, but not whether the item appears in the passport.
Actors in the chain must pass on data
Article 38 of the ESPR describes obligations for actors in the supply chain regarding the provision of product information. For a metal processor or steel trader purchasing and reselling semi-finished products, this means that their role in the chain requires receiving data from the predecessor and, where necessary, passing it on to the next party. An NDA with a supplier does not change this obligation; it merely governs how the underlying source documents are handled confidentially. The precise data you need from a supplier is described at which data you must request from your steel supplier.
Importers have their own responsibility
Whoever imports steel from outside the EU falls under Article 29 of the ESPR, which describes obligations for importers. This obligation is separate from any confidentiality agreements with the manufacturer outside the EU. An importer who relies on an NDA with a non-EU supplier to avoid sharing data does not change their own obligation as an importer by doing so. More on this situation is at what the product passport means when importing from outside the European Union.
Where things go wrong in practice
The NDA is used as a reason to share nothing. A supplier refers to a confidentiality clause and subsequently provides no data at all, including data needed for the product passport. The clause was intended to protect, for example, formulation or pricing agreements, not to withhold product passport data — but in practice it is used that way.
Confidential and mandatory data are not separated. A manufacturing company includes all technical information in a single NDA as "confidential", without distinguishing between data that is competitively sensitive and data that simply must be in the product passport. In a later discussion, it is then impossible to trace which data was withheld for which reason.
An NDA is drawn up after a dispute. A trader and a supplier disagree over data sharing, and only then is a confidentiality clause brought in as an argument for not delivering. Without having previously established what is and is not covered by the NDA, this puts both parties in a difficult position.
Further processing changes the data flow, but not the NDA. A construction company processes steel into another product and must pass on data from the original supplier to the next link in the chain. If the NDA with that supplier does not provide for this type of forwarding, uncertainty arises about what may and may not be passed on. See for this situation what happens to the product passport if steel is processed into another product.
Data from multiple suppliers under different NDAs. A processor combines material from multiple suppliers, each with its own confidentiality agreement with its own terms. When compiling a single product passport, uncertainty then arises about which data from which supplier may be included under which conditions. This situation is addressed at how you combine data from different suppliers in one passport.
What you can document
- An exception in the confidentiality clause for data that is legally required in the product passport, so that the NDA does not inadvertently also obstruct the product passport obligation.
- A list of data that remains confidential under the NDA, separated from a list of data intended for the product passport and thus may be shared with parties that need it.
- Agreements on who may view, modify or pass on the product passport data, even if the underlying source documents (such as test reports or composition data) remain confidential.
- A provision on passing data through the chain, so that a subsequent processor or customer receives the necessary data without this being considered a breach of the NDA.
- Recording these agreements in the purchasing contract itself, rather than in a separate NDA document — see how you set out the supply of passport data in your purchase contract for a structure that combines both components.
- A checkpoint to verify whether the data received actually matches what is needed, separate from confidentiality arrangements — more on this at how to verify whether your supplier's data is correct.
This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, verified by a human on 2026-09-05. Is anything incorrect? Let us know — corrections are given priority.