Data Act and leased vehicles: who is the "user" of the data?

Short answer: Under the Data Act (Regulation (EU) 2023/2854) the "user" is whoever owns, rents or leases the connected product. For a leased vehicle this is typically the lessee — the party that actually uses the vehicle — and not necessarily the leasing company that owns it.

The Data Act has applied since 12 September 2025 and governs access to and sharing of data from connected products and related services. A modern vehicle with telematics is such a connected product. Who counts as the "user" determines who is entitled to the vehicle data and who may have that data shared with third parties.

Who is the user?

The Data Act defines the user as the natural or legal person that owns, rents or leases the connected product, or that receives the related service. With a leased vehicle there are therefore two candidates: the leasing company as legal owner, and the lessee who has the vehicle in use. The regulation ties the concept of user to the actual use of the product. The lessee who drives or deploys the vehicle day to day is, as a rule, the user with the right to access the data.

What this means in leasing practice

The user has the right to access the data the vehicle generates, and may request that this data be shared with a third party of their choice — think of a maintenance provider, an insurer or a fleet-management service. The data holder (often the manufacturer or the provider of the telematics service) must make that data available on request on FRAND terms (fair, reasonable and non-discriminatory).

In leasing arrangements the picture is not always clear-cut. One party may hold several roles, and the allocation of user rights can be specified further in the contract — within the limits the Data Act sets, such as the prohibition on unfair contractual terms. It is therefore advisable to set out explicitly in the leasing contract who counts as the user and who has which access.

Points of attention for transport and logistics

For transport operators that lease vehicles, this means the right to vehicle data can in principle rest with them as the actual user. At the same time: if the data contains personal data (for example about an individual driver), the GDPR applies alongside the Data Act. For new connected products there is, from 12 September 2026, also a design obligation: products must be designed so that the data is accessible. Anyone now concluding or renewing leasing contracts is well advised to arrange the data rights in them carefully.

Read more: Transport & Logistics. Take the scan.