28 January 2026 is Data Privacy Day. Once a concern mainly for policymakers and tech companies, it has now become a moment of reckoning for everyone in the automotive chain. Since the EU Data Act came into force on 12 September 2025, the question is no longer whether you are responsible for vehicle data, but how far that responsibility extends.
For dealers and fleet owners, this represents a fundamental shift: vehicle data is formally under their control, yet access often remains complex in practice. Those responsible for the data must also be equipped to manage it. This article outlines exactly what has changed with the Data Act, what impact it has on dealers and fleet owners, and what specific situations will arise in 2026 regarding data rights, liability and cooperation in the chain.
What exactly is the EU Data Act?
The Data Act is European legislation that gives users of connected products, such as cars, greater control over the data these products generate. These are the key points:
- Access to data: Users, such as drivers, fleet owners and dealers, have the right to access data generated by their vehicles.
- Mandatory data sharing: Manufacturers are obliged, under certain conditions, to share data with third parties such as maintenance companies, insurers and mobility apps.
- Security requirements: Both personal and non-personal data are subject to strict security standards such as encryption and access management.
- Interoperability: Data must be available in a standard format, suitable for reuse and transferability.
These rules are not optional. Anyone who wants to use or pass on data must be able to demonstrate that this is done securely, transparently and in line with the law.
Vehicle data: you are responsible for it
The Data Act makes users the formal owners of vehicle data. That may sound abstract, but the consequences are very concrete.
A dealer with demo cars or stock models is often a temporary user and therefore the legal owner of the vehicle data.
A fleet owner is responsible for managing data such as trip data, error codes and maintenance records.
Example: A dealer who receives battery status or error codes for a used EV must now be able to demonstrate on what grounds that data is processed and shared. For example, with a universal maintenance network.
The data is yours, but you don’t (yet) have control over it
Much of this data is still locked away in closed OEM platforms. But the Data Act breaks this monopoly.
Now users can:
- Require vehicle data to be forwarded to a service provider of their choice.
- Expect data to be available in a usable and transferable format, for example via an API or a standard data structure such as ISO ExVe or COVESA VSS.
Example: A fleet owner with vehicles from multiple brands wants to switch to a single fleet management system. Thanks to the Data Act, they can demand that data from different OEM systems be merged into a single interface.
Sharing vehicle data: you bear the responsibility
The Data Act enables data sharing, but this comes with clear obligations. Dealers and fleet owners must be able to demonstrate:
- What data is shared, with whom and why.
- That sensitive data, such as location or driving style, is only shared with explicit consent.
Example: A fleet owner connects his vehicles to an external maintenance partner who proactively performs maintenance based on live vehicle data. If this third party uses data for other purposes, such as commercial profiling, or a data breach occurs, the fleet owner may be held jointly liable unless audit trails, contracts and logging show that appropriate arrangements have been made and control mechanisms are in place.
Control over data, without it becoming complex
The reflex response to new rules is often to introduce yet another tool, portal or form. But the Data Act calls for governance, not more bureaucracy.
Consider:
- Clear roles: who is allowed to see and do what with the data?
- Transparent workflows: for example, digital transfer of vehicle information upon delivery.
- Controlled access: for example, giving transporters temporary access to charging status or location.
Example: A car transporter delivering a load of new electric cars to a dealer is given temporary access to the battery charge status of each vehicle. This prevents surprises when unloading the EVs and increases transparency in the chain.
And what about shared and rental cars?
Not every user is an owner. With shared mobility and rental cars, the responsibility lies elsewhere:
- Short-term rental (car rental): The rental company is the formal user of the vehicle and therefore responsible for the data. The renter only has the right to access or use the data if this is stipulated in the contract.
- Operational lease or long-term rental: The fleet owner or driver is the actual user. This party may request data and share it with third parties under the Data Act.
- Shared cars (car sharing): The operator of the sharing platform is the legal user. Individual users, who book a ride via an app, have no ownership rights to the vehicle data. However, they do have rights under the GDPR, such as access to or correction of personal data, for example ride history or location.
Please note: The Data Act and the GDPR coexist. This means that even if you are not the owner of the data, you can still claim your personal data under the GDPR.
Why all this matters
The Data Act is not an IT law, but an economic one. Its aim is to promote fairer competition, transparent access to data and innovation. In the automotive sector, this means that:
- Dealers can offer cross-brand maintenance.
- Fleet owners gain better control over their data flows and compliance.
- Thanks to data sharing, car transporters gain real-time insight into vehicle status, which reduces errors during transfer. The result is a smoother process and more transparent communication.
Those who are already investing in data governance, interoperability and clear agreements have a head start. Tomorrow’s car will not only be connected, but also part of a data chain in which trust, control and cooperation make all the difference.
