The EU Data Act and Connected Cars: Who Gets Your Vehicle's Data?

A modern car is a connected product wearing wheels. It logs location, speed, braking, battery health, component wear, charging sessions and driver behaviour, and until recently, almost all of that data flowed one way: to the manufacturer. The EU Data Act redirects the flow, and the automotive sector is where the change is expected to be felt first and hardest.

Cars are squarely in scope

The Data Act's definition of a connected product, an item that generates data about its use or environment and can communicate it, fits a modern vehicle with room to spare. The companion app, the navigation subscription, the fleet-telematics platform and the charging service around the car are related services under the same regulation. The rules have applied since 12 September 2025, and vehicles placed on the EU market from 12 September 2026 are expected to meet the access-by-design requirement: usage data accessible to the user by default, easily, securely and, where technically feasible, directly.

The driver's new position

The user of the vehicle, the owner, the lessee, the fleet that operates it, has the right to access the data the car generates through its use, free of charge and without a support-ticket obstacle course. More consequentially, the user can direct that data to a third party of their choice. That third party can be an insurer offering usage-based pricing, a leasing company managing residual value, or, the scenario the industry has watched most closely, an independent repair shop.

Repair and the aftermarket: the quiet battleground

Independent garages have long argued that without live vehicle data they cannot compete with franchised dealers for diagnostics and maintenance. Under the Data Act, a driver can route their car's data to the workshop they choose, and the manufacturer, as data holder, is expected to make that sharing possible on fair, reasonable and non-discriminatory terms. Trade secrets get procedural protection, calibration details and model internals can be shielded with confidentiality measures, but a blanket refusal to share usage data with the aftermarket is unlikely to be a defensible position. For carmakers whose service revenue depends on data exclusivity, that is a business-model question, not just a compliance one.

Fleets are users too

The rights are not consumer-only. A logistics company running 400 vans is a user for every one of them, and can demand the telematics data those vehicles generate, or have it delivered to the fleet-management platform of its choosing rather than the manufacturer's own offering. Fleet contracts drafted before the Data Act, especially clauses that lock telematics data to the maker's ecosystem, deserve a screen against Article 13, which can render unfair unilaterally imposed data terms simply not binding. From 12 September 2027, that regime is set to reach certain long-running legacy contracts as well.

What automotive companies should be doing now

Manufacturers: confirm which model years and market-placement dates trigger access by design, build or document the data access path, prepare the pre-contractual transparency notice, and write the trade-secret procedure before the first aftermarket request arrives. Software and telematics providers: work out whether you are a related service, and agree with your OEM partners who answers user requests. Fleets and mobility startups: inventory the vehicle data you are entitled to, it may be worth more than your procurement team assumed.

Enforcement is assembling

Penalties are set at member-state level. Germany, the EU's largest car market, enforces through the Bundesnetzagentur under an implementation act in force since May 2026, with tiered fines of up to EUR 500,000 and GDPR-level fines of up to 4% of global annual turnover where personal data is involved, numbers that concentrate minds in an industry with automotive-scale revenues. The likelier early pressure, though, is commercial: access requests from fleets and repair chains that know exactly what the regulation says.

Whether you build vehicles, ship automotive software or operate a fleet, our free readiness assessment takes about three minutes and shows which Data Act obligations apply to your role in the chain.