Do not treat the passport as one undifferentiated dataset. Annex XIII and Article 77 separate public model information, restricted point 2 model information accessible to notified bodies, market surveillance authorities, the Commission and persons with a legitimate interest, point 3 test-report information reserved for notified bodies, market surveillance authorities and the Commission, and individual-battery information for legitimate-interest users. Article 77(9) requires an implementing act to specify legitimate-interest persons, their fields, and their download, sharing, publication, and re-use rights, so keep those permissions configurable and record the applicable act and version used.
For each field, record the source system, data steward, evidence artifact, access class, update trigger, and validation rule. This prevents public-facing passport data from exposing restricted dismantling, test-report, or individual-battery data.