EU Data Act Aftermarket Repair and Mobility Services FAQ

Usually, the route is user-driven. Article 5 requires the data holder, on request by a user or by a party acting on behalf of a user, to make readily available product data and related service data available to a third party. In vehicle workflows, that third party may be an independent repair shop, fleet service provider, insurer, leasing provider, mobility platform, or other service provider chosen by the user.

The third party does not get a general entitlement to all vehicle systems or functions. The request must be anchored to a user, a connected product or related service, and data that the data holder lawfully obtains or can lawfully obtain without disproportionate effort going beyond a simple operation. A Digital Markets Act gatekeeper cannot use this mandatory Article 5 route.

The Commission's 2025 vehicle-data communication is non-binding guidance for automotive stakeholders. It does not alter the Data Act, replace the Court of Justice's authority to interpret EU law, or displace sector-specific rules such as vehicle type-approval and competition rules, GDPR, or other applicable legislation.

The Commission's vehicle-data guidance treats raw and pre-processed vehicle data as the core Chapter II access category. Examples include wheel speed, tyre pressure, brake pressure, yaw rate, oxygen sensor readings, CAN bus messages, component status, vehicle speed, acceleration, GNSS-based location, odometer value, battery level, fault codes, malfunction indicators, brake-pad wear, and time or distance to next service when those data are not predictions outside the guidance boundary.

That makes the Data Act highly relevant for diagnostic, maintenance, fleet-management, charging, routing, leasing, insurance, and mobility workflows. But it does not turn every analytics output into shareable vehicle data: inferred or derived information created through additional investment, such as driving scores, risk assessments, object classification, trajectory predictions, or certain optimal-route outputs, can fall outside the mandatory access scope.

Not usually. The Commission's vehicle-data guidance says traditional aftermarket services such as auxiliary consulting, analytics, financial services, and regular repair and maintenance are generally not vehicle-related services where they do not affect vehicle operation and do not transmit data or commands to the vehicle. Manual brake replacement or oil changes, for example, are not treated as related services just because they concern a connected vehicle.

The distinction matters because a provider of a vehicle-related service can itself become a data holder for data generated during that service. A digital repair, predictive maintenance, remote control, charging, cloud preference, or route optimization service may be different if it involves bidirectional data exchange and adds to, adapts, or affects vehicle functionality.

For indirect access under Article 4 and third-party sharing under Article 5, the Data Act requires readily available data to be made available without undue delay, in the same quality available to the data holder, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format, and where relevant and technically feasible continuously and in real time.

The vehicle-data guidance makes that practical for the automotive sector: access methods can vary, including remote backend access, onboard access, or data intermediation, but the chosen method must not give users or independent service providers lower-quality data than the data holder, subsidiaries, authorised partners, dealers, or authorised repairers receive in comparable circumstances.

A trade-secret label is not enough by itself to block access. The Data Act requires trade secrets to be preserved through proportionate technical and organisational measures, such as confidentiality agreements, strict access protocols, technical standards, model contractual terms, or codes of conduct. Withholding or suspension is possible where measures are not agreed or implemented, and refusal is reserved for exceptional case-by-case situations where serious economic damage is highly likely despite safeguards.

Safety and security are also limited grounds. Article 4 allows users and data holders to restrict or prohibit access or further sharing only where processing could undermine legally laid down security requirements of the connected product and result in a serious adverse effect on health, safety, or security. Decisions to refuse, withhold, or suspend should be reasoned, written, notified to the competent authority where required, and open to challenge through competent authorities, dispute settlement, or courts.

Article 6 limits third-party use to the purposes and conditions agreed with the user, subject to data-protection law where personal data is involved. The request should therefore state the service purpose: diagnosis, repair estimate, maintenance alert, fleet optimization, insurance product, charging support, leasing service, or another specific use.

The third party may not use the data for prohibited purposes such as developing a competing connected product, making the data available to a Digital Markets Act gatekeeper, using the data for profiling unless necessary to provide the requested service, undermining security, disregarding agreed trade-secret measures, or passing the data onward except on the permitted contractual basis.

The GDPR boundary is central. Article 1(5) says the Data Act is without prejudice to EU and national personal-data law, and the Commission FAQ states that GDPR rules prevail in a conflict. The Data Act can complement GDPR access and portability rights, but it is not a free-standing legal basis for giving personal data to a user who is not the data subject or to a third party.

In vehicle contexts, personal data can appear in location data, driving behaviour, user accounts, in-vehicle preferences, and multi-user or rental situations. If the user is not the data subject, the data holder must assess a valid GDPR legal basis, relevant special-category conditions where applicable, and ePrivacy limits where relevant, or provide anonymised data where that is the compliant route.

A useful request record should support a later complaint, dispute, authority question, or contract review. It should show who the user is, who the third party is, who the data holder is, which vehicle or related service is involved, which data fields and metadata were requested, which fields were delivered or excluded, and why.

For high-volume repair, fleet, insurance, and mobility workflows, maintain an access matrix rather than deciding from scratch each time. The matrix should identify common use cases, standard data categories, GDPR status, trade-secret or security safeguards, access route, expected latency, compensation position for B2B recipients where relevant, refusal or escalation triggers, and evidence owner.