EU Digital Product Passport Supplier Data Validation Workflow

Start the workflow when a supplier provides a new data field, a changed value, a certificate or declaration, a calculation input, a facility or operator identifier, or evidence for a product model, batch, or item that may appear in the Digital Product Passport.

Do not accept a supplier submission as passport-ready until it has a named source owner, a product link, and a stated access class. The supplier may provide or enter data, but the economic operator responsible under the applicable product rule retains its own duties and remains responsible for data it submits to the Commission Registry. Feed supplier submissions into a governed product record rather than an unmanaged inbox.

Give each submission one explicit outcome: accept for the approved passport version, return for correction, quarantine while scope or evidence is unresolved, or reject as unsupported or outside the permitted DPP data set. A waiver should identify the unmet rule, decision owner, expiry or review date, affected products, and release consequence; it should not silently convert missing evidence into an approved value.

Validate each supplier field as a structured record. The record should show the value, who supplied it, which product it belongs to, the supporting evidence, and who approved it for the current DPP version.

Use quality checks that match the DPP technical design requirements: completeness for the required field, consistency with the product identifier and passport level, machine-readable format where needed, source traceability, and controlled update rights.

Supplier data should be reviewed for access before it is published. ESPR allows access rights to vary by actor type, and DPP guidance distinguishes public information from restricted information made available to particular parties.

This review should happen before a supplier field is mapped into the passport, because the same evidence may contain public attributes, commercially sensitive details, authority-facing documentation, and personal data that should not be exposed through the same view.

Close the workflow with an approval record that can be traced back from the live DPP value to the supplier evidence. The record should be usable by product compliance, sustainability, master data, quality, and supply-chain teams without relying on private comments or undocumented emails.

Keep approval records separate from public passport content. The public DPP should expose the approved data and relevant access-controlled evidence; the evidence record should explain how the organization validated the supplier submission and who approved the release.