• Regulatory Guide

Persons of Legitimate Interest — DPP Data Access Explained

Last reviewed: August 2026 · PassoNext Team

Direct answer

​Within the ESPR framework, “Persons of Legitimate Interest” (PoLI) is the access level for parties that need restricted Digital Product Passport (DPP) data but do not fall under the categories of general consumers or regulatory authorities. This classification covers entities such as independent repairers, recycling facilities, auditing bodies, market monitoring groups, and academic researchers. Every PoLI gets access to a specific, role-based slice of passport information—allowing a recycler, for example, to view component breakdown maps and safety data while keeping wholesale pricing hidden.

Key Takeaways
  • ​Not all passport data is public — the regulation defines different access levels based on the requester.
  • Persons of legitimate interest include market surveillance authorities, customs, recyclers, and researchers.
  • ​Manufacturers can restrict access to commercially sensitive data like detailed supply chain information.
  • ​Access control is managed through the passport platform and the EU Central Registry.
  • PassoNext supports role-based access to published passport data.

​What “Persons of Legitimate Interest” Means

​The Ecodesign for Sustainable Products Regulation (ESPR) — Regulation (EU) 2024/1781 — establishes a tiered system for managing DPP data access. Rather than making all passport details universally visible, the framework reserves specific operational metrics for approved entities categorized as “persons of legitimate interest.”

​Article 10 of the ESPR sets out which user groups can view particular data tiers. The core goal is clear: promote circular economy practices by sharing necessary operational details with relevant specialists while shielding proprietary business details from open public view.

​This structure builds on previous EU legislative models. The Battery Regulation (Regulation (EU) 2023/1542) used a similar setup in Annex XIII, dividing general public metrics from data reserved strictly for approved entities. The ESPR expands this framework across all upcoming product groups required to carry a digital passport.

​The Three-Tier Access Model

​The ESPR organizes passport visibility into three distinct access levels, each serving specific user needs and imposing different identity verification rules.

​Tier 1: Public Access

​The open access level. Anyone—whether a shopper, journalist, analyst, or market rival—can scan a item’s QR code or type in its unique ID to view this baseline information without signing in. Public fields usually cover item branding, manufacturer details, energy ratings, sustainability grades, and core environmental metrics to encourage market transparency and help consumers make informed choices.

​Tier 2: Persons of Legitimate Interest

The controlled middle level. Viewing this data requires users to verify their identity and confirm they have an approved operational reason aligned with circular economy goals. This level contains technical metrics needed to fix, overhaul, recycle, or analyze products. It includes granular material percentages, disassembly steps, component specs, and exact locations of hazardous substances.

​Tier 3: Market Surveillance Authorities

The highest clearance level. EU Member State enforcement agencies and the European Commission hold full visibility into all passport records, including protected trade secrets and proprietary assembly methods, to conduct compliance checks and enforce laws. This access operates under Regulation (EU) 2019/1020 market monitoring rules and standard public sector confidentiality laws.

​The ESPR text does not rely solely on the literal phrase “person of legitimate interest.” Instead, proportional data access flows from Article 10(1)(g)—which ties visibility to essential regulatory rules and product-specific delegated acts—and Article 11(b), which lists the specific user types granted access rights. The exact phrase “persons with a legitimate interest” stems from the Battery Regulation (Regulation (EU) 2023/1542, Article 77(2)(c)), with its matching implementing act under Article 77(9) scheduled for adoption by 18 August 2026.

​Who Qualifies as a Person of Legitimate Interest

The ESPR avoids setting a fixed, closed list of users. Instead, Article 10 identifies broad categories of actors whose work advances recycling, environmental protection, or legal compliance. The Commission retains the authority to refine these user groups through future delegated acts under Article 10(2).

​Based on the core regulation and Commission working documents, the following groups are designated to qualify for elevated access:

  • ​Professional repairers — independent technicians and authorized repair centers needing service manuals, parts catalogs, and diagnostic data to fix products.
  • ​Refurbishers and remanufacturers — organizations reconditioning used goods for secondary sale that require structural specs and teardown guides.
  • ​Recyclers and waste treatment operators — commercial processors handling end-of-life items that need material breakdowns and hazard maps to process materials safely and efficiently.
  • ​Researchers and academic institutions — specialists studying product lifecycles, material streams, or circular economic trends under approved research parameters.
  • ​Customs authorities — border agents verifying product compliance at EU entry points who need restricted DPP fields to confirm legal entry requirements.
  • Notified bodies and conformity assessment bodies — officially recognized auditing organizations checking that products comply with relevant EU laws.
  • ​Second-hand dealers and resale platforms — secondary market businesses needing verified product histories and wear-and-tear records to support clear resale practices.

​Category-specific delegated acts will outline exactly which user types gain access and what fields they can view for a given product group. Consequently, permissions will differ across sectors; a recycler’s data clearance for an EV battery will not look the same as their clearance for a apparel product.

​What Data Persons of Legitimate Interest Can Access

The boundary between open and restricted data carries real commercial weight. Restricted fields often contain the exact engineering designs and material recipes that businesses treat as intellectual property. Authorized parties under Tier 2 can view technical details hidden from the general public, including:

  • ​Detailed material composition — exact ingredient breakdowns, specific alloy grades, plastic types, and chemical additives that go far beyond basic public labeling.
  • ​Dismantling instructions — step-by-step guides for taking products apart without causing damage, including required tool specs, fastener locations, and critical disassembly sequences.
  • Repair manuals and diagnostic data — technical guides needed to troubleshoot errors, replace broken components, and restore full product operation.
  • ​Component-level data — part-by-part specifications inside complex assemblies, including supplier origins, sub-part material grades, and operational ratings.
  • ​Hazardous substance locations — clear maps highlighting where regulated or dangerous substances sit inside an assembly, allowing safe handling during disposal or recycling.
  • ​Supply chain traceability data — documentation detailing the origin of key raw materials, ethical sourcing proofs, and chain-of-custody records.

​The Battery Regulation offers a clear template for this setup, providing a practical model for data tiering. Annex XIII breaks data requirements into four numbered levels: point 1 covers public model-level metrics; point 2 restricts detailed chemistry specs (like cathode, anode, and electrolyte formulations) and teardown guides to approved actors and the Commission; point 3 limits test logs to notified bodies and regulators; and point 4 reserves individual battery health metrics and usage logs exclusively for authorized users. The ESPR builds on this general layout across broader product lines.

​Why Restricted Access Exists

​The three-tier framework balances two competing needs in modern product legislation. Driving a circular economy requires open data sharing—technicians cannot fix products without repair guides, and recyclers cannot reclaim materials without knowing what is inside an assembly. However, publishing every technical detail openly would expose proprietary designs and trade secrets to market competitors.

Article 10 of the ESPR handles this challenge using the principle of proportionality. Users get access strictly to the data fields necessary for their specific job. A technician gets repair guides without seeing the manufacturer’s raw bill of materials; a recycler gets material breakdowns without seeing proprietary chemical formulas.

​Protecting commercial trade secrets remains an explicit legal priority. Recital 37 of the ESPR stresses that “the protection of commercially confidential information” must be maintained alongside circular economy goals. Furthermore, Directive (EU) 2016/943 on trade secrets applies right alongside the ESPR, legally binding any person of legitimate interest who accesses restricted fields to strict confidentiality standards.

​This protection responds directly to practical business concerns. Manufacturers frequently highlight that releasing complete engineering and material blueprints publicly would allow competitors to reverse-engineer their products. The three-tier model mitigates this risk by restricting detailed technical files to vetted users who hold a legal duty to safeguard the data they view.

​Legal Basis in the ESPR

​The primary statutory foundation governing persons of legitimate interest sits inside Article 10 of Regulation (EU) 2024/1781.

​Article 10(1) sets the baseline requirement: access to passport fields must be granted strictly according to the permissions written into the matching delegated act. The economic operator launching the product holds the legal duty to implement these access controls correctly.

​Article 10(1)(g) specifies that access to stored passport fields is controlled based on the core requirements in Articles 10 and 11, alongside the specific clearance rules set for each product group under Article 4 delegated acts. As a result, exact visibility rules take effect category by category as these secondary laws pass.

​Article 11(b) lists the entities entitled to request access: buyers, manufacturers, importers, distributors, sellers, professional repairers, third-party operators, refurbishers, remanufacturers, recyclers, market surveillance officers, customs agents, civil groups, labor unions, and related parties are granted free, straightforward access to passport entries based on the rules set in each delegated act. Meanwhile, Article 10(3) sets a separate requirement for economic operators placing goods on the market to supply sellers and online platforms with a digital copy of the data carrier or product ID.

​Article 10(1)(b) states that the physical data carrier—whether a QR code or another scannable tag—must be placed directly on the product, its packaging, or accompanying paperwork as mandated by the relevant delegated act. Article 10(1)(c) mandates that both the data carrier and the unique product code follow the standards listed in Annex III or approved equivalents.

Article 12 sits separately, controlling unique operator and facility ID codes.

​Article 13 directs the European Commission to build and manage the central registry that logs all unique product codes for items sold across the EU. Article 14 requires the Commission to run a publicly accessible online portal allowing users to look up and compare passport entries in line with established access permissions.

The Battery Regulation Approach

The Battery Regulation (Regulation (EU) 2023/1542) represents the first EU framework to launch an operational Digital Product Passport with tiered permissions. Its practical structure serves as a clear blueprint for how the broader ESPR framework will operate.

​Annex XIII of the Battery Regulation breaks down passport data needs into explicit access brackets. General baseline details (like company names, battery models, dimensions, and capacity) are open to the public. However, performance and degradation metrics (such as state of health, cycle counts, and total energy throughput) carry restricted access depending on the exact data field.

​While the Battery Regulation uses phrasing like access for “notified bodies, market surveillance authorities and the Commission,” Article 77 also includes access rights for “any natural or legal person with a legitimate interest.” This confirms that elevated access extends past state authorities to include private sector circular economy actors.

​For businesses, the main lesson from the Battery Regulation is clear: passport systems must support granular, field-by-field access rules right from launch. Releasing a single, flat file that exposes all internal data publicly does not comply with the law. Every data field needs an assigned access tier, and the underlying platform must enforce those boundaries whenever a user queries the record.

​Authentication Requirements

​Authorized parties cannot access restricted passport fields anonymously. The ESPR requires users to verify their identity and prove their operational credentials before unlocking protected data tiers.

While the primary regulation does not mandate a single tech standard for signing in, the Commission will set formal technical rules through implementing acts under Article 10(3). Based on existing EU digital ID standards, the login process will feature:

  • ​Identity verification — users must prove their real-world identity, likely using eIDAS (Regulation (EU) 910/2014) digital credentials or the updated European Digital Identity Wallet
  • under eIDAS 2.0 (Regulation (EU) 2024/1183).
  • ​Role attestation — users must provide verifiable digital credentials confirming their professional status (such as a certified repair business license, an approved recycling permit, or academic accreditation).
  • ​Purpose declaration — users must state why they need to view the restricted data, ensuring their request matches the approved use cases in the governing delegated act.
  • Audit trail — the system must log every data request and download to maintain complete accountability and support compliance reviews.

​The Central EU DPP Registry built under Article 14 will help manage these user credentials. The central system may maintain a master directory of verified users, issue temporary access tokens, or delegate user checks to national authorities in each Member State.

Technical Implementation

​Building a passport system that supports the three-tier access model requires a modern software setup. A compliant system relies on several core tech components:

​Role-Based Access Control (RBAC)

​The passport software must enforce RBAC down to individual data fields. Every metric stored in a passport file needs a clear access level tag. When a user requests data, the system must evaluate their identity credentials against the field’s security level before returning any restricted values. Under Article 10(1), the economic operator bears direct legal responsibility for enforcing these access boundaries.

​Credential Verification

​The platform must check that a user’s professional credentials remain valid in real time. For instance, if a repair shop loses its official business registration, the system should revoke its elevated access rights immediately. This requires live API connections to the Central EU DPP Registry or national databases that track accredited professionals.

​API Authentication

​System-to-system data requests—which will handle the vast majority of B2B queries—must connect through secure API protocols. OAuth 2.0 architecture using scoped tokens matched to user clearance levels is the expected industry standard. Every incoming API call must send a valid token detailing the user’s approved role and data access limits.

​Audit Logging

Every view or download of restricted fields must generate an unchangeable audit log entry containing the user’s ID, accessed fields, timestamp, and declared access purpose. These logs fulfill two key needs: proving to regulators that access rules are enforced, and catching suspicious or unauthorized data access patterns early.

​PassoNext includes all four components out of the box. The platform features field-level data tagging, live credential checks against the EU Central Registry, OAuth 2.0 API connections with role-scoped tokens, and automated audit logs—allowing manufacturers to meet Article 10 rules without building custom security tools from scratch.

Data Protection and GDPR Intersection

​Running an access control system for authorized users requires processing personal data. When a technician signs in to view restricted files, the platform collects personal details such as their name, professional registration ID, and access reason. This data handling falls directly under General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) rules.

​The legal basis for processing this personal data rests on Article 6(1)(c) of the GDPR—processing necessary to fulfill a statutory legal duty. The ESPR places a legal requirement on economic operators to verify the identity and legitimacy of anyone requesting restricted passport files, making personal data collection a necessary part of compliance.

​At the same time, the data minimization rule (Article 5(1)(c) GDPR) remains fully active. System setups should collect only the personal details strictly needed to authenticate users and log access events, avoiding long-term storage of personal data beyond required audit windows. Privacy-by-design standards must be built into passport access tools right from the start.

A Data Protection Impact Assessment (DPIA) under Article 35 of the GDPR may be necessary, especially for platform setups processing user credentials at scale or using automated rules to grant or deny access permissions.

​Challenges in Implementation

​While the policy behind restricting data access is clear, managing it in practice presents several operational challenges:

​Cross-Border Recognition

​A repair technician registered in Germany must be able to access restricted passport fields for a product manufactured and sold in France. Achieving this requires all 27 EU Member States to recognize each other’s professional credentials seamlessly. While the Central EU DPP Registry is designed to bridge these gaps, the cross-border verification network remains under active development.

​Defining “Legitimate” Across Sectors

What counts as a valid need varies significantly across different product types. A recycler looking at garment material composition faces different operational needs than a processor handling EV battery chemistries. Each category-specific delegated act must define access permissions tailored to its product type, meaning manufacturers selling diverse product catalog lines may need to manage overlapping or distinct access setups.

​Preventing Misuse

Restricted data shared with authorized users may be further distributed to other entities, used irresponsibly, or employed for purposes beyond legitimate operations. The regulation protects against such misuse through trade secret law, as stated in Directive (EU) 2016/943, and requires logging all access to ensure accountability. Nevertheless, this depends on how strongly Member State authorities enforce the law.

​Scalability

A multinational company selling millions of products across Europe would have to respond to thousands of access requests from technicians and recyclers each month. For such a large entity, checking each request manually would be time-consuming and ineffective. Thus, it would be necessary to implement a standardized system of digital certificates and software that could automatically and efficiently verify applicants’ identities.

Expected Commission Guidance

​The European Commission has indicated that technical implementing rules and official guidance on access permissions will launch alongside the first sector-specific delegated acts under the ESPR. These updates are expected to cover:

  • ​Standardized categories for authorized users, unified across product groups wherever practical.
  • ​Technical specifications for sign-in and authorization systems, aligned with eIDAS 2.0 and the European Digital Identity Wallet.
  • ​System compatibility rules ensuring any compliant DPP software can process access requests from verified users smoothly.
  • ​Detailed guidance clarifying the line between public and restricted data, including real-world examples across key product categories.
  • ​Transition rules covering the rollout phase between the ESPR entering into force and the full launch of the Central EU DPP Registry.

The initial delegated acts are slated for release during 2025–2026, with the Commission prioritizing product groups that already fall under existing ecodesign regulations. Businesses should follow Commission DPP updates closely to see how access levels will be structured for their specific product sectors.

How PassoNext Implements Three-Tier Access

​PassoNext’s software is engineered directly around the three-tier permissions framework set out in Article 10. Every metric added to a product passport receives a dedicated access level tag during initial setup. When a user requests data—whether through a physical QR scan, a web portal, or an API query—the software checks their credentials against the field’s security tag before displaying any restricted values.

​Public data requires no login checks; scanning a product’s QR code leads directly to an open web page showing all Tier 1 information. When a user requests restricted data, the platform runs an authentication check to confirm their identity and role before logging the view. For market regulators, a dedicated secure channel opens full data visibility backed by expanded audit logging.

​This built-in setup spares manufacturers from developing and maintaining their own security tools. Companies simply select which fields belong in each security tier—following the rules of their governing delegated act—and the platform handles access enforcement automatically.

​Practical Steps for Manufacturers

​Businesses should start organizing their passport data access policies now, even before final delegated acts for their specific product lines are published. Recommended actions include:

  1. ​Audit your product data. List every data point that will go into your Digital Product Passport. Classify each item as public, restricted (authorized users), or confidential (regulators only). Use Annex XIII of the Battery Regulation as a reference guide if your category’s delegated act is still pending.
  2. ​Identify sensitive data. Pinpoint which metrics contain proprietary designs or sensitive commercial data. Work with your legal team to confirm which data fields qualify for trade secret protection under Directive (EU) 2016/943. Document your reasoning clearly, as regulators may challenge overly broad confidentiality claims.
  3. ​Prepare access control procedures. Plan how your passport software will check user credentials and verify access requests. If you use an enterprise solution like PassoNext, confirm it supports field-level access tags and connects to the Central EU DPP Registry for credential validation.
  4. ​Implement audit logging. Make sure your system logs every restricted data view with enough detail to satisfy compliance audits. Logs must record the user’s identity, accessed fields, timestamp, and verification path used, and be retained for the timeframe required by law.
  5. ​Train your teams. Ensure compliance, legal, and IT departments understand the three-tier framework and their specific roles. Compliance leads assign access levels, legal teams review trade secret boundaries, and IT staff manage technical integrations.
  6. ​Monitor regulatory developments. Category delegated acts will set the final access levels for each product sector. Follow Commission updates and technical publications from ECHA and CEN-CENELEC to track emerging access control standards.

​This reference reflects the legal status as of March 2026. ESPR delegated acts and Commission technical guides are actively evolving. Subscribe to PassoNext’s Regulatory Radar for updates as new delegated acts and access rules are officially published.

What This Means For Your Business

Managing who can view specific parts of your product passport is essential for protecting valuable business information. The law does not require you to make every internal metric public. Details like supply chain maps, component costs, and vendor lists can be restricted strictly to verified users.

​At the same time, core baseline data—including basic product IDs, environmental impact scores, and consumer safety guidance—must remain open to everyone. Setting up accurate access levels from the beginning ensures you avoid both accidental data leaks and non-compliance fines.

Action Steps

  1. ​Review regulatory rules to identify which data fields must remain publicly visible.
  2. Flag commercially sensitive metrics that should be limited to verified users.
  3. ​Set up access levels in your DPP software before releasing product passports live.
  4. ​Keep clear internal records of your data access decisions to support future regulatory audits.
EU DPP Regulatory Hub
Battery Passport
Days
Feb 18, 2027

Frequently asked questions

What is a Person of Legitimate Interest under the ESPR?

A Person of Legitimate Interest (PoLI) is an individual or entity that needs access to restricted fields within a product passport (DPP) that goes beyond general consumers but does not operate as a state enforcement agency. Article 10 of the ESPR (Regulation (EU) 2024/1781) establishes a middle security level that covers repair technicians, recyclers, auditing bodies, market regulators, and academic researchers, who are granted access to specific passport fields depending on their area of operation.

The first tier is designed for everyone: a simple QR code scan opens a page with general information about the product, its name, manufacturers, energy ratings, and generic environmental data – without any identification or authorization needed.

The second tier is for persons of legitimate interest. It requires a verified login to view technical details necessary for the repair, refurbishing, recycling, or research of the specific product.

The third tier is for market surveillance authorities: it involves all passport fields, including those containing commercially sensitive data, and is opened upon explicit authorization by an official acting within the scope of their authority in accordance with Regulation (EU) 2019/1020 and applicable confidentiality rules.

While the regulation does not list examples of legitimate interest, Article 10, as well as the Commission’s working papers, specify several categories of persons that may qualify for extended access. These include professional repairers, refurbishers, or remanufacturers, recyclers or waste processors, research organizations, customs officials controlling compliance of imported products with the Union law, independent auditing bodies, and second-hand dealers. The competent authorities acting under the Regulation will adopt delegated acts specifying the categories of persons entitled to access information on a product category basis.

Users of legitimate interest may view certain restricted fields of a product passport inaccessible to the general public. The fields may contain detailed information on the content of materials in a given product, technical specifications of disassembly tools, repair manuals, diagnostic tests, or component-specific data, the location of hazardous materials within a product, and relevant supply chain information on critical raw materials.

A legitimate interest user cannot gain access to restricted fields anonymously: a verification procedure should be applied that confirms the user’s actual existence (possibly through eIDAS 2.0-conformant credentials and the European Digital Identity Wallet), attests to the user’s roles (by providing verifiable electronic credentials), and records the legitimate interest to access specific fields in accordance with the procedural requirements. In addition, an audit trail must be created every time the user accesses the system.

Ready to start your product passport?

Start free. No credit card required. Your first 10 passports stay free, even after the trial ends.

Start Free on Shopify
View Live Demo →