Why Blockchain Matters for the Digital Product Passport
EU regulations require DPP data to be verifiable and tamper-proof. Here is why blockchain is the most credible answer, and how a hybrid on-chain/off-chain architecture works.
By Izvera Team
A core DPP requirement under ESPR and the EU Battery Regulation is verifiability: data must be tamper-evident throughout the product lifetime. Traditional centralised databases struggle to meet this requirement. Blockchain doesn't.
This post explains why blockchain is the right tool for DPP, where it does and doesn't belong, and Izvera's hybrid architecture.
The trust problem in supply chains
Consider a textile product's DPP. The data chain looks like this:
- Fibre producer — "30% recycled polyester"
- Spinner — "GRS certified"
- Weaver — "OEKO-TEX 100"
- Dyer — "ZDHC-compliant chemistry"
- Garment maker — final product
In a centralised database:
- The DB admin can rewrite history.
- Counterfeit certificates pass undetected.
- It is hard to prove when data actually arrived.
- An EU auditor's question "was this entered in 2026 or 2027?" has no cryptographic answer.
What blockchain gives you
1. Immutability
Records are cryptographically chained — changing past data invalidates every block after. Once written, the record can't be silently rewritten.
2. Timestamping
Every transaction is tied to a block timestamp. "This certificate was uploaded 2026-03-12 14:22" becomes cryptographically provable.
3. Multi-party verification
Multiple parties (manufacturer, auditor, brand customer) see the same record. None of them can rewrite it alone.
4. Audit trail
Who submitted what, when — kept as an unforgeable log. Gold-standard evidence for an EU audit.
"Should everything go on-chain?" — No
A common mistake. Putting raw data on-chain is expensive and bad for privacy. The right architecture is hybrid:
| Data type | Where it lives |
|---|---|
| Raw DPP data (BOM, chemistry, etc.) | Off-chain database |
| Data fingerprint (hash) | On-chain |
| Certificate files | IPFS or cloud, hash on-chain |
| Key events (shipments, certificates) | On-chain |
Which blockchain?
For DPP:
- Permissioned chains (Hyperledger Fabric, Quorum) — fast, privacy-friendly, enterprise-grade
- Public L2 chains (Polygon, Arbitrum) — low gas, globally verifiable
- Hybrid — permissioned chain anchored periodically to a public chain
Izvera picks the right mix based on customer requirements — customers don't manage chain mechanics.
Blockchain ≠ crypto
DPP-grade blockchain needs no coins, no mining (on PoS chains), no speculation. The product's QR doesn't say "this is on a blockchain" — the customer just sees verified data.
Related reading
Bottom line
If your answer to "has this data been tampered with?" needs to be cryptographic — and under ESPR audits, it will need to be — blockchain-backed DPP is the only credible architecture.