Who can access your fleet's telematics and vehicle data under the Data Act

The Data Act attaches its rights to a "connected product": an item that obtains, generates or collects data about its use or environment, can communicate that data, and whose primary function is not the storage or processing of data (Article 2(5)). A tractor unit's on-board telematics unit, a trailer's telematics gateway and a reefer's temperature and door sensors all fit that description; the readings they produce are "product data", and the records generated by any linked telematics service are "related service data" (Article 2(15)-(16)). The rights belong to the "user", defined as the person that owns the connected product, or to whom temporary rights to use it have been contractually transferred, or that receives the related service (Article 2(12)). The Regulation deliberately allows more than one user of the same asset: its recitals give "fleet management for a leasing enterprise" as a legitimate user interest sitting alongside the operator that actually runs the vehicle. The substantive obligations have applied since 12 September 2025; a further "accessible by default" design obligation (Article 3(1)) applies to connected products placed on the market after 12 September 2026 (Article 50).

Where the user cannot read the data directly from the vehicle, the data holder must make the readily available data — with the metadata needed to interpret it — accessible to the user without undue delay, in the same quality it holds itself, securely, free of charge, and in a structured, commonly used, machine-readable format, on a simple electronic request (Article 4(1)). The user may also direct the data holder to make that data available to a third party such as a maintenance firm, an insurer or a fleet-management provider, and that onward sharing is likewise free of charge to the user (Article 5(1)). The Regulation draws a distinction worth grasping: exercising the right costs the operator nothing, but where the recipient is a business the data holder may agree compensation with that third party on fair, reasonable and non-discriminatory (FRAND) terms (Articles 8 and 9). Such compensation must be reasonable and non-discriminatory and may include a margin, yet where the recipient is an SME or a not-for-profit research body it may not exceed the data holder's costs (Article 9(4)). In other words, a provider cannot bill the fleet for releasing the fleet's own data; any charge falls on the receiving service, and only within those limits.

For a vehicle on an operating lease, or a financed trailer, both the lessor that owns the asset and the operator that runs it can in principle qualify as users, because the definition reaches both ownership and contractually transferred use rights (Article 2(12), read with the recitals contemplating several users of one product). The Regulation does not award the data to one party alone: where more than one person is a user, the product must be designed so each can access the data it generates. Two things follow for leasing practice. First, before a purchase, rent or lease is concluded, the seller, rentor or lessor must tell the user in clear terms what data the product generates, whether it does so in real time, where it is stored, and how the user can access or erase it (Article 3(2)). Second, the split of access between lessor and lessee can be arranged by contract, but only so far: a term that, to the user's detriment, excludes, derogates from or varies the user's statutory access rights does not bind that user (Article 7(2)). If you operate a vehicle you lease, you therefore most likely hold user rights in the data it generates whoever owns the hardware, and a lease clause purporting to remove those rights would likely be unenforceable against you.

The Data Act does not only give the user a right to request data; it constrains the data holder that sits on it. A data holder may not make the data available to another business unless the user has asked it to (Article 8(4)). It may use non-personal readily available data only on the basis of a contract with the user, and may not use that data to derive insights about the user's economic situation, assets or operating methods in a way that could undermine the user's position in the markets where it competes (Article 4(13)). Nor may it hand non-personal product data to third parties for any purpose other than performing its contract with the user, and where it does share, it must bind those recipients against passing the data on (Article 4(14)). For a fleet operator this reframes a familiar arrangement: by default, the telematics or OEM data describing your vehicles is not the provider's to resell, to aggregate for competitive insight, or to route to its other customers without your agreement.

Much vehicle data is simultaneously personal data: location traces, driving-time and behaviour readings can identify a driver. Here the Data Act works alongside data-protection law rather than displacing it — it states expressly that it is without prejudice to the GDPR and that, in any conflict, the data-protection rules prevail (Article 1(5)). Where the user is an enterprise rather than the driver whose data is in play, the data holder may release that personal data only if there is a valid legal basis for processing under Article 6 GDPR; the Data Act does not itself supply one (Articles 4(12) and 5(7)). A carrier requesting or redirecting driver-linked telematics data is thus acting as a controller and needs its own lawful basis and transparency toward drivers, independently of its Data Act access right. The practical course is to treat the two regimes as a single exercise and identify which telematics fields are personal before requesting or sharing them.

Get an email whenever something changes here. No account needed; confirm by email (double opt-in).