EU Data Act Vehicle Data Guidance

The Commission guidance, published in the Official Journal on 15 September 2025, is sector-specific and non-binding. It explains how Chapter II applies to vehicle data for automotive stakeholders such as vehicle manufacturers, suppliers, aftermarket service providers, and insurance providers. It does not extend or modify the Data Act, bind the Court of Justice, or replace sector-specific law.

Keep the timing rules separate. Chapter II access duties have applied since 12 September 2025. The Article 3(1) design duty to make product and related-service data directly accessible where relevant and technically feasible applies only to connected products and related services placed on the market after 12 September 2026. Indirect access to readily available data under Articles 4 and 5 is a different route.

A useful vehicle-data review should therefore start with a narrow scope statement: the vehicle, the user, the data holder, the requested data, the requesting third party, the intended use, and the technical route by which the data is or could be made available. User status can follow from ownership, contractual temporary use such as a lease or rental, or receipt of a related service; a vehicle manufacturer or supplier is a data holder only for a flow where it has the relevant legal or contractual right or duty.

Not every automotive service around a connected vehicle is a vehicle-related service under the Data Act. The Commission guidance treats a vehicle-related service as a digital service connected with the vehicle that involves bidirectional data exchange and affects the vehicle's operation or behaviour.

This distinction matters for repair, maintenance, insurance, and mobility services. Regular offline repair or maintenance is generally not a vehicle-related service, while remote vehicle-control services, cloud preferences applied to the vehicle, dynamic route optimisation, and non-regular maintenance services that exchange data with the vehicle and adapt its functionality may be vehicle-related services.

The central data-scope question is whether the requested vehicle data is raw or pre-processed data, with the metadata needed to interpret and use it, or whether it is inferred or derived data that falls outside the Data Act access obligation unless otherwise agreed.

Product data are data generated by the use of a connected product that the manufacturer designed to be retrievable. Data processed only inside the vehicle and immediately deleted, with no party able to retrieve it, fall outside that product-data boundary. If raw or pre-processed data are stored, externally transmitted, or otherwise retrievable, assess whether they are readily available even when the vehicle manufacturer does not routinely keep them.

For vehicles, raw data may include sensor signals, raw image or point-cloud data, radar signals before object detection, vehicle-network messages, direct user commands, and component status. Pre-processed data may include measured speed, acceleration, battery level, odometer value, fault codes, tyre pressure, liquid levels, brake-pad wear where not predictive, and other data that still describes vehicle operation or status.

The Data Act does not mandate one automotive technical route. Direct access under Article 3(1) applies where relevant and technically feasible and is subject to the 12 September 2026 market-placement rule. Where direct access is unavailable, Article 4(1) requires the data holder to provide the user with readily available data. Article 5(1) separately lets the user direct the data holder to make covered data available to an eligible third party in the Union, including where the user already has direct access. Remote backend access, onboard access, or a data intermediation service may support those routes.

For vehicle data, the practical control is quality parity. Data made available to the user or user-chosen third party must not be less accurate, complete, reliable, relevant, or up to date than the data available to the data holder through another route, unless a different arrangement is justified under the Data Act or other applicable law. Articles 4 and 5 require access without undue delay but do not set one fixed numeric response period for ordinary Chapter II vehicle-data requests.

The user receives access free of charge. When the data holder makes data available to a business data recipient under Article 5, Articles 8 and 9 can permit reasonable compensation from that recipient. The user cannot choose an undertaking designated as a gatekeeper under the Digital Markets Act as the Article 5 third party.

Vehicle data can be personal, commercially sensitive, safety-relevant, or tied to sector-specific automotive rules. The Data Act does not displace the GDPR, privacy law, trade secret protection, type-approval rules, or other sector law. Where personal data is involved, the GDPR boundary must be assessed before a user or third-party transfer is approved.

The Commission FAQ states that GDPR rules prevail in a conflict. A user who is not the data subject, or a data holder making personal data available, needs a valid GDPR basis for the relevant processing. The Data Act does not itself create a legal basis to collect or generate personal data.

Do not treat trade-secret status as an automatic refusal. The data holder or trade-secret holder must identify the protected data and seek proportionate technical and organisational measures before disclosure. It may withhold or suspend only the identified trade-secret data if measures are not agreed or implemented, or confidentiality is undermined. Refusal is exceptional and case-specific: the data holder must also be the trade-secret holder and objectively substantiate that serious economic damage is highly likely despite the safeguards.

A defensible vehicle-data decision should be traceable from the request to the data package, role map, access route, safeguards, delivery terms, and any refusal or exclusion. This is especially important where the same company may be a vehicle manufacturer in one flow, a supplier in another, a data recipient for a user-directed request, and a processor or platform operator in a separate service.

The evidence file should be useful to legal, product, security, engineering, customer operations, and partner teams. It should also be readable by a regulator or dispute body without relying on internal shorthand.