In brief
- Regulation: Data Act.
- Manufacturers and connected service providers are directly concerned.
- Making data accessible.
- Enable sharing.
- Design 'by design'.
- Penalties set by each Member State, effective, proportionate and dissuasive.
Regulatory deadlines
The key dates of this regulation.
January 2024
Entry into force
In forceSeptember 2025
Application
In forceWhat is the Data Act about?
The Data Act governs access to data from connected products and associated services. The connected vehicle is a prime example, continuously generating usage, diagnostic and location data.
It complements GDPR: the latter protects personal data, while the Data Act opens access to all generated data, personal or otherwise.
Is the 'Automotive' sector affected?
Manufacturers and connected service providers are directly concerned. Data access benefits users and, at their designation, third parties such as independent repairers and insurers.
The competitive stakes are high: the Data Act aims to break situations of exclusive access to vehicle data.
Detailed obligations
Make data accessible
Enable the user to easily access data generated by the vehicle and associated services.
Enable sharing
Making data available to third parties designated by the user, such as an independent repairer.
Design by design
Integrate data access into vehicle and service design from the outset.
Ban abusive clauses
Review connected services contracts to remove unbalanced clauses.
Inform
Document, before the sale, the data generated and the access terms.
Sanctions & risks
Penalties set by each Member State, effective, proportionate and dissuasive. Beyond that, denial of access deprives the user of an enforceable right and exposes organisations to disputes with after-sales stakeholders.
The Data Act redistributes the value of automotive data — a strategic issue for aftersales and insurance.
Application timeline
- 1Entry into force. Early 2024.
- 2Application. Majority of obligations applicable from 12 September 2025.
Common mistakes in the sector
- 1Locked access. Preventing the user from accessing their vehicle's data.
- 2Sharing refused. Blocking access for designated independent repairers.
- 3Abusive clauses. Retaining unbalanced clauses in connected services.
- 4GDPR confusion. Believing GDPR compliance is sufficient.
Practical case
A manufacturer was restricting certain diagnostic data to its authorised network. A customer designates an independent repairer and invokes the Data Act. The manufacturer implements compliant access and sharing and revises its connected services contracts, opening up the aftersales market while securing the technical arrangements.
Compliance roadmap
- 1
Inventorying data. Mapping data generated by the vehicle and its associated services.
- 2
Tooling access. Implementing secure access and sharing.
- 3
Adapt the design. Integrate data access into new vehicles.
- 4
Revising contracts. Remove unfair clauses from connected service agreements.
- 5
Inform. Documenting data and access terms for customers.
Frequently asked questions
Yes: the Data Act guarantees the user access to the data generated and the ability to share it with designated third parties.
Take action on Data Act
Free assessment or a chat with an expert dedicated to automotive.
They already trust us
See how organisations in the automotive sector secured their compliance with DCO.