EN 18239: access rights, information security and business confidentiality in product passports

EN 18239 is the European standard for access rights management, information system security and business confidentiality in digital product passports. It is written for economic operators and service providers that build or run passport systems, and for anyone deciding who may see and change which data.

A product passport has many readers with different needs: a consumer in a shop, a repairer, a recycler, a customs authority. Most of a passport is meant to be public, but some data is commercially confidential or reserved for authorities. EN 18239 describes how that distinction is handled without closing off the public part.

Status: approved but not cited

This is the most important thing to know about EN 18239 today. It was approved by CEN on 17 August 2026 and published as SS-EN 18239:2026 on 16 September 2026, so it can be bought and followed. It is not cited in the Official Journal of the European Union. Implementing Decision (EU) 2026/1736, published on 15 July 2026, lists six passport standards, and EN 18239 is not among them. CEN and CENELEC wrote the same day that six of the eight standards had been cited.

The consequence is legal. Under ESPR Article 41(2), it is conformity with harmonised standards whose references have been published in the Official Journal that gives a presumption of conformity with the requirements of Articles 10 and 11. Following EN 18239 therefore gives no such presumption yet. It is a way of working, not a legal defence, and no provider can currently claim harmonised conformity on access rights.

What the standard covers

According to its published scope, EN 18239 specifies requirements for passport access rights management, including IT security, data protection and the transfer of responsibility between economic operators. It defines a framework for managing access to confidential information, while acknowledging that public passport data requires no access restrictions. It applies to all product groups subject to passport requirements under ESPR, with the specific access rights for each group to be set out in the relevant delegated act. The standard is 18 pages long.

At the CEN and CENELEC webinar on 25 June 2026, while the standard was still under formal vote (until 16 July 2026), the security working group described its mission. The standards were to be consistent with Union law on personal data, privacy, network and information security, cybersecurity and fraud protection. The threats named included identity and deception attacks such as fake QR codes (quishing) and faked systems, interception of data in transit, and untrustworthy access by insiders or partners. The resulting risks are leaked business data, infrastructure failure, and consumers or operators being sent to malicious websites.

What it requires in practice

The public part has to stay public

The standard draws a sharp line between public and protected data. Under clause 5.2, item 2, public passport data must be readable without authentication, and a note gives avoiding discrimination, among other things by geographical location, as the reason. Item 3 adds that access to and management of controlled data may not be prohibited solely on the basis of the actor's location or jurisdiction. A passport that needs a login to show its public part does not meet the standard, and country blocks go against the reason given in the note.

Protection against mass scraping

At the same time, clause 5.2, item 11 requires access to passport services to be limited so that attacks and unauthorised mass data scraping are prevented. That is harder than it looks, because the usual tools collide with other requirements. Logins and geo-blocking are ruled out by items 2 and 3. Tracking individual visitors runs into item 24, which requires measures against profiling users, and into data protection law. What is left are limits that do not depend on identifying the individual reader. Item 15 explicitly allows an economic operator to introduce access rate limiting for identified risks, as long as legally required information is not affected.

Protected data and transfer of responsibility

For data that is not public, the passport system must manage who is entitled to what: authorities, repairers, recyclers and others with access rights under the delegated act. The standard also covers the transfer of responsibility between economic operators, for example when another operator takes over responsibility for the passport.

Authoritiese.g. market surveillance

With access rightse.g. repairers and recyclers

Publiceveryone, with no login or location check (5.2 item 2)

Limits against mass scraping, without logins or geo-blocking (5.2 items 2, 3 and 11)

How it relates to the law and the other standards

ESPR

The standard's subject touches several requirements in ESPR Articles 10 and 11:

• Article 10(1)(e): personal data about customers may not be stored in the passport without their explicit consent,
• Article 10(1)(g): access to the data is regulated by Articles 10 and 11 and by the access rights set for the product group in the delegated act,
• Article 11(b): customers, manufacturers, repairers, recyclers, authorities and other relevant actors have free and easy access based on their access rights,
• Article 11(f): the rights to introduce, modify or update data are restricted based on the access rights,
• Article 11(h): the passport is designed and operated to ensure a high level of security and privacy and to avoid fraud.

The standard's own Annex ZA, however, maps only Article 11(a) to it, through clause 4.2 and limited to organisational interoperability. Even once cited, the presumption would reach that far and no further.

Which actors may see and change which data is decided in the delegated acts, under ESPR Article 9(2)(f), (g) and (h). Article 11 also allows the Commission to adopt implementing acts on how the digital credentials of economic operators and other actors with access rights are issued and verified.

The Batteries Regulation

The battery passport has its own structure. Under Article 77(2) of the Batteries Regulation there is information accessible to the general public, information accessible only to notified bodies, market surveillance authorities and the Commission, and information for persons with a legitimate interest, such as repairers and recyclers. The split is set out in Annex XIII. Article 77(9) required the Commission to adopt implementing acts by 18 August 2026 on who has a legitimate interest and what they may download, share, publish and reuse. Article 78(b) and (f) tie access and the right to change data to Annex XIII and that implementing act.

The other standards

In CEN and CENELEC's description of the workflow, EN 18239 is step 6: managing access and access rights. Its close neighbour is EN 18246 on data authentication and integrity, which has the same status: approved, not cited. EN 18222 describes the passport life-cycle API, whose methods may be access-controlled, and EN 18221 requires archived versions to be retrieved by authenticated and authorised actors.

Common misunderstandings

"All eight standards give a presumption of conformity"

They do not. Six are cited in the Official Journal. EN 18239 and EN 18246 are not. Anyone claiming harmonised conformity across all eight is claiming something that does not exist today.

"Access control means the passport needs a login"

The opposite. The public part must be readable without authentication. Access control applies to the data the law does not make public.

"The standard decides who sees what"

It does not. It provides the framework. Which actors are entitled to which data is set in the delegated act for each product group, and for batteries in Annex XIII and the implementing act under Article 77(9).

"Blocking bots and foreign visitors is the safe option"

Geo-blocking the public part goes against clause 5.2, item 2 and its note, and for controlled data item 3 rules out refusing access on location alone. Protection against scraping has to be built so that ordinary readers, wherever they are, can still reach the public part.

How this looks in practice

DPP Agent, built by Blippa, is being built to EN 18239 without claiming that this gives a presumption of conformity. Access is separated per customer at row level in the database, signed-in services use short-lived tokens rather than shared keys, and the passport resolver has a rate limit written against clause 5.2, item 11. The limit counts requests per time window using a salted hash of the address that is held only in memory and never written down. The open validator does not test EN 18239, because almost nothing in it can be checked from outside with a single request. See also the overview of the DPP standards and the DPP standards page.