ESPR and Trade Secrets: Who actually sees your chemical data?

The digital chemical passport is coming. And the same question immediately comes up in every conversation with manufacturers: “Will I have to disclose my formula?”

An understandable fear. But a mistaken one.

The ESPR regulation, which introduces the digital passport (DPP) as a mandatory element for all products on the EU market, is explicitly designed to protect confidential business information. In it, transparency and the protection of trade secrets are not in conflict, they are parallel requirements.

How does that work in practice?

Who sees what: Three layers of access

The DPP is not a single document that everyone reads. It is a system with granular access rights, defined in Article 10(1)(g) of the ESPR Regulation (EU) 2024/1781.

Think of it as a building with different access levels. Each actor in the supply chain enters on a different floor.

The public level is available to everyone. The consumer scans the QR code and sees information on the product’s sustainability, recyclability and origin. This is general data, with no chemical formulas, no CAS numbers, no concentrations.

The professional level is available to authenticated actors. Recyclers, processors and partners in the supply chain see the presence of hazardous substances and instructions for safe waste management. They know what is in the product, not how it is made.

The regulatory level is reserved for market surveillance authorities and customs. They have full insight into the complete technical documentation in order to verify compliance.

The boundary between these three levels is not improvised. Each sector-specific “delegated act” under ESPR precisely defines which information goes to which level for a given product category. The same principle the EU applies to textiles from 2027 will be applied, with adjustments, to chemical compounds when their turn comes.

Three layers of access to data in the digital product passport

How the data is physically protected

This brings us to the heart of the matter. Many imagine the DPP as a central database somewhere in Brussels or Helsinki where everything sits in one place. That is the wrong picture.

ESPR Recital 32 explicitly states that the DPP “should be based on a decentralised data system” managed by the economic operators themselves. In practice, this means your data stays with you, on your servers or with an authorized DPP provider of your choice.

The central DPP Registry, which is due to be operational by July 2026, stores only unique identifiers and pointers, not the data itself. It works like a phone book that knows where something is, but does not read the content.

This architecture achieves what many consider essential: the manufacturer retains physical and logical control over sensitive information. Authenticated actors get access only to the data intended for their level. Everything else stays locked.

For the chemical industry this is particularly relevant. Under REACH, companies already have to communicate the presence of SVHC substances above 0.1% in the supply chain. The DPP extends and structures that communication, but does not require disclosure of exact concentrations or procedural details that form the core of a trade secret.

What this concretely means for a chemical engineer

The direct consequence of this architecture is clear: the DPP is not a document you fill in once a year. It is a living digital record that pulls data from the systems your company already uses.

That is both the problem and the solution.

The problem is that a company that manages chemicals today through Excel spreadsheets and Word documents physically cannot create a functional DPP. It has nothing from which to pull the structured, machine-readable data that the standard requires.

The solution is systematizing data, which brings operational benefits anyway. A company that has orderly digital records of its chemicals — classifications, SDS documents, substance inventory, supplier data – has a solid basis for DPP implementation.

Here is a concrete example that illustrates indirect exposure. Textile regulation under ESPR comes into force in 2027-2028. If you supply dyes, finishing agents or process chemicals to the textile industry, your customers will demand DPP-compatible data on the substances in your products well before the chemical industry gets its own delegated act. The deadline for chemicals as a standalone category is realistically 2031 or later. But the indirect obligation through customers arrives much earlier.

The DPP as a market filter, not a burden

There is one dimension of the DPP that is rarely talked about. Transparency is not just a regulatory requirement – it is a market mechanism.

European manufacturers that comply with REACH, CLP and safety standards have for years been struggling with competition from countries where those standards do not exist or are not fully enforced. Verifying compliance today depends on sampling, testing and inspections – processes that are expensive, time-consuming and cannot cover every product that enters the market.

The DPP changes that equation. A verifiable digital record of a product’s composition and compliance becomes an entry requirement for the EU market. A company from any country that cannot create one, or whose data does not pass verification, will not pass customs control.

For companies that play by the rules, that is protection, not a burden. Transparency becomes a competitive advantage precisely because non-transparent competitors cannot replicate it.

Where we are now and what needs to be done

It is important to be precise about deadlines. Chemicals as a standalone category are not in the first ESPR working plan (2025-2030). The Commission launched a feasibility study at the end of 2025. The realistic deadline for a mandatory DPP for chemical products is 2031 or later.

But that does not mean you can wait.

Three steps that make sense to take right now:

First, make an inventory of the digital data you have on the chemicals in your portfolio. Classifications, SDS documents, SVHC status, supplier data – all of it needs to be structured and accessible.

Second, follow the development of delegated acts for the sectors you supply. Textiles, steel, electronics, all of them come before chemicals and all of them will have requirements towards your substances.

Third, understand the difference between the data you must disclose and the data you can protect. That boundary is key to any strategic preparation.

Conclusion

The digital chemical passport is not an open book. It is a system of controlled access that gives everyone what they need, no more and no less.

The consumer sees that the product is safe for recycling. The recycler sees which substances require special treatment. The regulator sees everything needed to verify compliance. And the formula stays where it belongs, with you.

The essential message is simple: preparing for the DPP is not preparing for the regulator. It is preparing for better management of data you already have, in a way that will open doors for you in the future instead of closing them.

References:

This blog post is for informational purposes only and does not constitute legal advice. For specific situations, consult a licensed chemical adviser or a lawyer specialising in chemical regulation.