Product passport: what your supplier keeps to itself

A T-shirt of your brand is sewn in Gazipur, north of Dhaka. The garment factory has bought the fabric from the same knitting mill for years, and the yarn comes from a spinning mill further inland.

For this T-shirt you are building the Digital Product Passport that clothing sold in the EU is expected to carry from 2029. Your buying team sends the garment factory a questionnaire for it: fibre composition, origin of the cotton and, right below, the name and address of the knitting mill and the spinning mill.

The garment factory answers in its own way. It rings the knitting mill, has the yarn certificate sent over as a PDF, reads off the shares and types them into your form. It leaves the fields for the names empty. Weeks later the answer arrives, copied out by someone who did not establish the values themselves, and these are the values your passport is meant to carry.

You pay for your data, and your name is on the passport. Wanting to know where your goods come from is understandable. We have already described how you can ask your suppliers directly from Transpareo. This article is about an apparent contradiction: why we withhold information from our customers so that their product passports get better data.

Your supplier passes your questions on to its knitting mill without telling you whom it asks, and the answer comes from whoever knows it.

What the product passport needs from the supply chain

Your brand issues the passport. What it has to contain for textiles is set by a delegated act under the Ecodesign Regulation, which the Commission has not adopted yet. Expected are data such as the fibre composition, the origin of the fibres, the dyes used and recyclability.

Most of these values are known to a business you hold no contract with. The spinning mill knows where the cotton came from, the knitting mill knows the dyeing, and you know the garment factory you placed the order with. A question about the cotton therefore travels through the garment factory and the knitting mill to the spinning mill, and the answer takes the same route back before it reaches the passport.

Once the data is at hand, the passports are published in Transpareo within a few minutes. The time goes into gathering it, and that route also decides how accurate your passport turns out.

Every value in the passport is as good as the route it took to reach you.

How well that route works depends on a question your questionnaire asked along the way: whether your supplier has to name its sources.

Business relationships are a trade secret

A garment factory that names its knitting mill makes itself replaceable. With the name, the brand could order the fabric itself next season and give the sewing to a cheaper factory. When the garment factory keeps quiet, it is protecting its business.

Research on corporate strategy describes such relationships as an asset in their own right. According to a widely cited paper, a firm’s critical resources can extend beyond its boundaries, and the relationship between two firms becomes a source of competitive advantage of its own.

Case studies show how well suppliers know this. When a Swedish jeans brand set out to publish its supply chain, one supplier released the names of its sub-suppliers for internal use only, and the brand explained why in a case study: “They are afraid that we will go straight to the sub-supplier to get a better price”. In a study of five multi-tier supply chains, a maker of bakery products says of its own suppliers: “Our suppliers are quite unwilling to reveal the names of their suppliers.”

For a supplier of the jeans brand that made most of the product itself, that risk did not arise. The worry mainly concerns businesses in the middle of the chain that buy in, such as agents and traders. A question for the passport often passes through such businesses before it reaches the spinning mill.

The law treats sources of supply as typical trade secrets. The European Trade Secrets Directive expressly names “commercial data such as information on customers and suppliers”. The German legislator lists “customer and supplier lists” among them in its explanatory memorandum to the Trade Secrets Act (in German), and the Federal Constitutional Court (in German) names “sources of supply” and “terms” in the same breath as turnover and account books.

What the supply chain laws change

The German Supply Chain Act obliges large companies to identify risks to human rights and the environment in their supply chains and to prevent them. Since autumn 2025 the supervisory authority no longer checks their reports on it. The Federal Office for Economic Affairs and Export Control (BAFA) stopped checking them on the federal government’s instruction, and the reports (in German) can no longer be submitted either. It imposed no fines even in 2024, with 18 proceedings opened and 9 warnings issued (annual report 2024, in German). Since October 2025 it has imposed them only for serious allegations (in German), and it drops proceedings on the remaining offences. The checks go on: from October 2025 to June 2026 BAFA completed 331 of them, according to the federal government (in German).

The law is also due to change. In September 2025 the federal government adopted a bill (in German) that removes the reporting duty retroactively and limits fines to serious breaches; by July 2026 it had still not been passed. The due diligence duties themselves still apply. In our conversations with buyers we often hear why the Supply Chain Act might nonetheless be called a failure: hardly any supplier discloses its sources.

European lawmakers have recognised the problem of suppliers who are reluctant to share details of their business, and have shaped their supply chain directive accordingly. The Corporate Sustainability Due Diligence Directive sets due diligence duties similar to the German law’s for companies across the EU, and every member state has to turn it into national law, Germany included. In its amended version of February 2026, which applies from July 2029, the companies it covers may request information from business partners only where it is necessary, and from partners with fewer than 5,000 employees only where it “cannot reasonably be obtained by other means”. So at most tiers of a supply chain no law forces a supplier to name its sources. It names them when doing so does it no harm.

By email or through Transpareo: two routes to the knitting mill

If a tool forces the garment factory to give a name, it asks its knitting mill by email instead, and the tool goes unused. That round has three drawbacks:

1. Every tier waits for the next. It asks for a data sheet, a certificate or a Word document and replies only once that has arrived. That is how the weeks add up.
2. Every copy makes the data less accurate. A unit gets overlooked, a Bengali term loosely translated.
3. Where a value came from gets lost. In the end nobody knows which document it was taken from, and the passport receives whatever the last person in line understood.

When the garment factory passes your questions on in Transpareo, that changes:

1. The answer comes faster. The question is with the knitting mill as soon as the garment factory sends it the link, and nobody waits for a PDF to copy out. Every request has a deadline, which you set and can extend when needed. Your supplier sees by when its answer is due, and if it passes the question on, it gives the knitting mill a deadline that ends on or before its own.
2. The answer is more accurate. Every tier enters its own values, with its own unit, and whatever it takes from below goes into its answer without being retyped. The passport holds the value the spinning mill entered, reviewed at every tier in between.
3. Everyone answers in their own language. The spinning mill reads your questions in Bengali, provided Bengali is one of your workspace’s languages. The knitting mill reads what it writes in its own language, with the original beside it, and so it goes tier by tier until the answer reaches you in your language. Any business can take part, even where nobody writes German or English.

How Transpareo protects your supplier

Your supplier decides with every request whether its knitting mill may see whom the question is for. If it hides that, three things protect it:

• No brand. Your logo and your name appear on none of these pages, and neither does the product. The knitting mill sees your supplier’s name, a few words of its own and the questions. Should a question still give away whom it is for, the form tells your supplier so.
• A neutral address. These requests open at a randomly chosen Transpareo address that does not name your workspace.
• Our legal framework. Every commercial website in the EU needs an imprint. So that no business a request reaches has to provide one first, Transpareo operates these pages and takes responsibility for them: our terms of use and Transpareo’s privacy policy apply, and the footer of every page shows our imprint.

If your supplier hides nothing, the knitting mill sees the request as your supplier does: under your logo, on your website and with the product.

Beside your request you see one number: how many requests were passed on below it, counted across every tier. Who received them and what the businesses below answered, Transpareo does not show you. That costs you some overview, and we understand anyone who would like to have it. We still think the price is right.

Your supplier passes your question on because doing so gives nothing away.

You receive a single answer, under the name of your supplier, who stands behind it. It changes your record only once you have reviewed it field by field and accepted it.

What ends up in the passport

For the T-shirt this means: the fibre composition and the origin of the cotton are in the passport, entered by the spinning mill, reviewed by the knitting mill and the garment factory, and delivered to you in your language. With the next publication the passport carries them in a signed version that any reader can check in their browser.

If the delegated act for textiles requires a production site, your supplier names it in its answer, and the site appears in the passport. Sources the passport does not need stay with your supplier. Whom you hold the contract with, you know anyway.

Whether a supplier hands the data over is still a matter for your supply contract, and for the textile industry we recommend obliging the garment factory by contract. The request makes sure it need disclose nothing the passport does not need.

Try it from the other side: open the sample request to a supplier in the demo account with the PIN 123456 and answer as the garment factory. You see the page your supplier sees.