No, the digital product passport for steel does not replace or amend the GDPR. The two regulations are separate from each other and that does not change this year: the GDPR continues to apply to personal data, regardless of whether a product receives a passport. What does change is that companies that will be compiling a passport must for the first time carefully examine what data it contains, and whether any personal data is included.
This is particularly important for companies that themselves collect data and pass it on to a supplier, customer or platform: the office manager who maintains files, the director who signs off on a supplier declaration, and everyone involved in completing technical documentation. For most SMEs in the steel trade and metal processing sector, the impact this year remains limited, because the first delegated act of the ESVPR has not yet been published and the obligations are therefore not yet established.
What the regulation does and does not provide for
The ESVPR (the European regulation on ecodesign for sustainable products) describes what product data must be included in a passport: origin, composition, processing, recycling information. In practice, this data is mainly about the product, not about persons. The regulation says nothing about the GDPR and does not impose any GDPR obligation. Supervisory authorities that deal with product passports look at the product data; the Data Protection Authority remains the authority that looks at personal data, regardless of which passport it is based on.
The reason these two come together anyway is practical: a passport often also contains names of contact persons at a supplier, an importer or a manufacturer, and sometimes data of a notified body. Once such a name is linked to a job title or email address, that is personal data, and then the usual GDPR rules apply: a lawful basis, a retention period, and appropriate security. This already applied before the product passport and remains unchanged.
What concretely changes this year
At the moment, little changes because the obligation itself has not yet come into force. What does change is that more companies are preparing and encounter the same question in doing so: who will store what data, and where will that data be kept? Software providers offering a passport solution are beginning this year to set up data models. This is the moment at which it is worthwhile to ask where the data is hosted, who has access to it, and whether personal data in the passport is included that does not necessarily belong there.
This is also precisely what many companies are struggling with now: not the question of whether the GDPR is changing, but the question of whether their own design of the passport inadvertently contains more personal data than necessary. A technical file with the name of a quality officer, a test report with a signature, or a QR code that links to a contact form with an email address: these are all points where the two regulations touch each other, without one replacing the other.
For whom this matters
The impact differs depending on the role within a company. For a director of an installation company, this is primarily a matter of ultimate responsibility: who signs off on the accuracy of the passport, and is that person aware of the GDPR aspect of it. For an HR manager, the relevance is usually indirect, except when personnel data is used to demonstrate traceability in the supply chain. For an office manager who manages files and systems, this is often the most concrete: that person in practice determines which fields are filled in and what data is stored.
What remains as it was
The GDPR obligations that already existed remain unchanged: a lawful basis for processing, a retention period that is no longer than necessary, and security appropriate to the risk. The product passport does not add any new obligation to this, but can be a new place where personal data ends up if this is not consciously paid attention to. how we handle privacy and data describes how this is arranged in practice with the passport.
Anyone who wants to know how this works out for their own situation will find in the overview of topics that have been selected for each situation the background to both the regulation and the existing rules with which it runs in parallel. For your own situation, it remains advisable to consult a lawyer or contact the Personal Data Authority if in doubt; this article describes the regulations, not the outcome for a specific business.
Would you like to first see if this applies to your business? in a few questions see if this applies to you gives an initial indication, and answer to questions that come up frequently addresses the questions that other readers have already asked.