EU Data Act Vehicle Data Guidance

The Commission guidance is sector-specific. It addresses how Chapter II of the Data Act applies to vehicle data for automotive stakeholders such as OEMs, suppliers, aftermarket service providers, and insurance providers. It does not extend or modify the Data Act, and it should not be extrapolated automatically to other industries or public-sector access scenarios.

A useful vehicle-data review should therefore start with a narrow scope statement: the vehicle, the user, the data holder, the requested data, the requesting third party, the intended use, and the technical route by which the data is or could be made available.

Not every automotive service around a connected vehicle is a vehicle-related service under the Data Act. The Commission guidance treats a vehicle-related service as a digital service connected with the vehicle that involves bidirectional data exchange and affects the vehicle's operation or behaviour.

This distinction matters for repair, maintenance, insurance, and mobility services. Regular offline repair or maintenance is generally not a vehicle-related service, while remote vehicle-control services, cloud preferences applied to the vehicle, dynamic route optimisation, and non-regular maintenance services that exchange data with the vehicle and adapt its functionality may be vehicle-related services.

The central data-scope question is whether the requested vehicle data is raw or pre-processed data, with the metadata needed to interpret and use it, or whether it is inferred or derived information that falls outside the Data Act access obligation unless otherwise agreed.

For vehicles, raw data may include sensor signals, raw image or point-cloud data, radar signals before object detection, CAN bus messages, direct user commands, and component status. Pre-processed data may include measured speed, acceleration, battery level, odometer value, fault codes, tyre pressure, liquid levels, brake-pad wear where not predictive, and other data that still describes vehicle operation or status.

The Data Act does not mandate a single automotive technical route. The Commission guidance says access may be direct where relevant and technically feasible, or indirect through a data holder, and may use remote backend access, onboard access, or a data intermediation service. The route still has to satisfy the Data Act conditions.

For vehicle data, the practical control is quality parity. Data made available to the user or user-chosen third party should not be less accurate, complete, reliable, relevant, or up to date than the data available to the data holder through another route, unless a different arrangement is justified under the Data Act or other applicable law.

Vehicle data can be personal, commercially sensitive, safety-relevant, or tied to sector-specific automotive rules. The Data Act does not displace the GDPR, privacy law, trade secret protection, type-approval rules, or other sector law. Where personal data is involved, the GDPR boundary must be assessed before a user or third-party transfer is approved.

The GDPR point is not a footnote. The Commission FAQ states that GDPR rules prevail in a conflict and that a user who is not the data subject, or a data holder making personal data available, needs a valid GDPR basis for the relevant processing. The Data Act does not itself create a legal basis to collect or generate personal data.

A defensible vehicle-data decision should be traceable from the request to the data package, role map, access route, safeguards, delivery terms, and any refusal or exclusion. This is especially important where the same company may be an OEM in one flow, a supplier in another, a data recipient for a user-directed request, and a processor or platform operator in a separate service.

The evidence file should be useful to legal, product, security, engineering, customer operations, and partner teams. It should also be readable by a regulator or dispute body without relying on internal shorthand.