Search every question across sub-FAQs

For indirect access under Article 4 and third-party sharing under Article 5, the Data Act requires readily available data to be made available without undue delay, in the same quality available to the data holder, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format, and where relevant and technically feasible continuously and in real time.

The vehicle-data guidance makes that practical for the automotive sector: access methods can vary, including remote backend access, onboard access, or data intermediation, but the chosen method must not give users or independent service providers lower-quality data than the data holder, subsidiaries, authorised partners, dealers, or authorised repairers receive in comparable circumstances.

A trade-secret label is not enough by itself to block access. The Data Act requires trade secrets to be preserved through proportionate technical and organisational measures, such as confidentiality agreements, strict access protocols, technical standards, model contractual terms, or codes of conduct. Withholding or suspension is possible where measures are not agreed or implemented, and refusal is reserved for exceptional case-by-case situations where serious economic damage is highly likely despite safeguards.

Safety and security are also limited grounds. Article 4 allows users and data holders to restrict or prohibit access or further sharing only where processing could undermine legally laid down security requirements of the connected product and result in a serious adverse effect on health, safety, or security. Decisions to refuse, withhold, or suspend should be reasoned, written, notified to the competent authority where required, and open to challenge through competent authorities, dispute settlement, or courts.

Article 6 limits third-party use to the purposes and conditions agreed with the user, subject to data-protection law where personal data is involved. The request should therefore state the service purpose: diagnosis, repair estimate, maintenance alert, fleet optimization, insurance product, charging support, leasing service, or another specific use.

The third party may not use the data for prohibited purposes such as developing a competing connected product, making the data available to a Digital Markets Act gatekeeper, using the data for profiling unless necessary to provide the requested service, undermining security, disregarding agreed trade-secret measures, or passing the data onward except on the permitted contractual basis.

The GDPR boundary is central. Article 1(5) says the Data Act is without prejudice to EU and national personal-data law, and the Commission FAQ states that GDPR rules prevail in a conflict. The Data Act can complement GDPR access and portability rights, but it is not a free-standing legal basis for giving personal data to a user who is not the data subject or to a third party.

In vehicle contexts, personal data can appear in location data, driving behaviour, user accounts, in-vehicle preferences, and multi-user or rental situations. If the user is not the data subject, the data holder must assess a valid GDPR legal basis, relevant special-category conditions where applicable, and ePrivacy limits where relevant, or provide anonymised data where that is the compliant route.

A useful request record should support a later complaint, dispute, authority question, or contract review. It should show who the user is, who the third party is, who the data holder is, which vehicle or related service is involved, which data fields and metadata were requested, which fields were delivered or excluded, and why.

For high-volume repair, fleet, insurance, and mobility workflows, maintain an access matrix rather than deciding from scratch each time. The matrix should identify common use cases, standard data categories, GDPR status, trade-secret or security safeguards, access route, expected latency, compensation position for B2B recipients where relevant, refusal or escalation triggers, and evidence owner.

For aftermarket repair and mobility services, the Data Act record should keep the cited Article 4, 5, 6, or 7 basis, the Commission vehicle-data guidance reference, the actor role, the data categories affected, the request or contract trigger, and the approver who signed off on the interpretation.

Keep the external source URL, decision date, reviewer, unresolved assumptions, and implementation artifact together so the answer stays auditable when the same repair or mobility case returns later.

For aftermarket repair and mobility services, the Data Act workflow should name a single accountable owner for each operational change, such as legal, product, procurement, cloud, support, or security.

That owner should coordinate the affected workflow and decision record, while consulting other teams as needed and keeping evidence dependencies separate so implementation can be updated without reopening the whole legal analysis.

For aftermarket repair and mobility services under the Data Act, the most useful evidence is the material that lets a later reviewer reconstruct the decision without guessing. That usually means the source article or guidance cited, the data inventory or request log, the contract clause or access rule, the security or trade-secret control used, and the approval record.

If the workflow changes, the evidence should show what changed and when. That makes it easier to compare a repair request, fleet request, or mobility-service request across versions instead of re-litigating the same scope question from scratch.

For aftermarket repair and mobility services, the Data Act answer should be reviewed whenever the product architecture, service model, dataset, customer role, or contract terms change in a way that could change who controls the data or how it is shared.

It should also be revisited when Commission guidance, the vehicle-data implementation approach, or the security and privacy setup changes, because those are the points most likely to affect repair, fleet, insurance, or mobility workflows.

No. The Data Act gives targeted size-based treatment, not a general exemption for startups or SMEs. The answer depends on the chapter, the actor's role, and whether the company is the manufacturer, designer, related-service provider, data holder, data recipient, user, or contracting party.

Startups should not rely on the word startup alone. The binding Chapter II carve-out is framed around microenterprises, small enterprises, and a limited transition for medium-sized enterprises by reference to Commission Recommendation 2003/361/EC, not around venture stage, funding round, age of incorporation, or headcount labels used in sales systems.

Apply both the staff and financial tests to the relevant enterprise data. A microenterprise has fewer than 10 staff and turnover or balance-sheet total of no more than EUR 2 million; a small enterprise has fewer than 50 staff and turnover or balance-sheet total of no more than EUR 10 million; the SME ceiling is fewer than 250 staff and turnover of no more than EUR 50 million or balance-sheet total of no more than EUR 43 million. Then include partner and linked-enterprise data as the Recommendation requires before deciding the category.

Article 7 says Chapter II business-to-consumer and business-to-business access obligations do not apply to data generated through connected products manufactured or designed by a microenterprise or small enterprise, or related services provided by one, when the Article 7 conditions are met.

The carve-out is narrow. It is lost if the micro or small enterprise has a partner or linked enterprise that does not itself qualify as a microenterprise or small enterprise. It also does not apply where the micro or small enterprise is subcontracted to manufacture or design the connected product or provide the related service.

Article 7 also gives limited treatment to data generated through connected products manufactured by, or related services provided by, an enterprise that has qualified as medium-sized for less than one year. For connected products, the same treatment applies for one year after the product was placed on the market by the medium-sized enterprise.

This should be managed as a dated transition record, not as a permanent SME exception. The record should show when the enterprise first qualified as medium-sized, which connected products or related services are affected, and when the transition ends for each product or service.

Yes. The Chapter II carve-out is not a whole-Regulation exclusion. Recital 41 states that a microenterprise or small enterprise may still be subject to Data Act requirements as a data holder where it is not the manufacturer of the connected product or the provider of related services.

For implementation, avoid writing contract language that says a small supplier is exempt from the Data Act. Write the exact role: for example, small related-service provider for its own service, SME data recipient seeking data under Chapter III, or enterprise challenging a unilaterally imposed data clause under Chapter IV.

In mandatory B2B data sharing, Article 9 allows agreed compensation to be reasonable and non-discriminatory and to include a margin. The SME protection is on the data-recipient side: if the data recipient is an SME or a not-for-profit research organisation, and it does not have partner or linked enterprises that do not qualify as SMEs, compensation must not exceed the Article 9(2)(a) costs.

The Commission FAQ explains the practical effect: there is no general upper or lower compensation number, but reasonable compensation cannot include a profit margin when the recipient is an SME or a non-profit research organisation. Data holders must also provide enough calculation information for the recipient to assess whether Article 9 is met.

No. Article 13 applies to covered terms unilaterally imposed by one enterprise on another enterprise. The Commission FAQ says Chapter IV does not specifically address SMEs, even though it is expected to particularly support SMEs because they often have weaker negotiating positions.

The rule is about the term and how it was imposed. It covers terms concerning access to and use of data, or liability and remedies for breach or termination of data-related obligations. It does not turn every unfavorable commercial term into a Data Act issue.