EU Data Act – Request Vehicle Data and Data Sharing for Connected Cars | Word/PDF/Excel

Do you want to request vehicle data from your connected car, get a response from the car manufacturer, or share data with an independent workshop? This document package is a practical working tool for rights under the EU Data Act (EU) 2023/2854, particularly Articles 4 and 5. It consists of five different Swedish letters, two guides, and a nine-tab Excel register. The letters help you request a clearly defined set of available vehicle data – not to demand unlimited access to all systems in the car.

Quick answer: Since 12 September 2025, users of connected products have access to data and metadata covered by the Data Act under certain conditions. If the data cannot be accessed directly, the data holder should, pursuant to Article 4.1, make the data that already exists or can be obtained without disproportionate effort available without undue delay, securely, in machine-readable format, and free of charge to the user. Article 5 gives the user the opportunity to designate a third party under certain conditions. Read the EU Regulation on EUR-Lex.

Who is the package for?

Car owners, lessees, and other authorized users in Sweden with a connected passenger car, electric car, or other car that meets the definition in the Regulation. It can also be used by small businesses that manage connected vehicles. A driver or passenger is not automatically a user within the meaning of the Data Act; check the ownership, rental, leasing, or service agreement.

This is not a general GDPR data subject access request template, not a hacking guide, and not a requirement for remote control of the car. You do not automatically get all vehicle diagnostics, the manufacturer's source code, previously unrecorded data, analyses derived by the manufacturer, or personal data about other drivers.

Which document should you use?

Example A – charging history from an electric car: You want access to actually available measurements, timestamps, and other relevant metadata about usage or charging. Use letter 01 and define a date period and specified data categories. No template guarantees that a particular car model stores exactly this data.

Example B – independent workshop: You want the data holder to make available vehicle data to a named, independent workshop for a concrete maintenance or troubleshooting need. Use letter 02. The request applies to data, not unlimited technical access to control units, vehicle functions, or safety-critical software.

Example C – unclear data response: The company has provided a file with abbreviations without explanations of units, timestamps, or source. Use letter 03 for a concrete request for supplementary metadata needed to understand the data covered by the Regulation.

Example D – denied request: The data holder refers to trade secrets, security, or that the data does not exist. Use letter 04 to request a specified factual and legal explanation and, where possible, a legally secure alternative. The letter does not promise that all exceptions are invalid.

Example E – continued disagreement: You have documented your request, the company's response, and a perceived violation of Data Act rights. Use letter 05 as a factual basis for PTS's own complaint service; the template itself does not submit a complaint.

Complete File List

Excel with nine tabs and traceability

START · Vehicle · Requests · Data fields · Sharing · Contacts · Deviations · Overview · READ ME. The register distinguishes between vehicle ID and full VIN, so that identifying information does not need to be copied to every tab. You document every request, contact method, contractual role, actually known data fields, date, response, and possible receiving workshop.

A built-in formula can count calendar days between an actually sent message on November 1 and an actual response on November 5: 4 calendar days. It is not a statutory maximum response time – the Regulation uses the wording without undue delay in Article 4.1. The overview only counts your own registered entries, statuses, and deviations and cannot establish violation, liability for compensation, or compliance. The workbook is delivered without example cases, macros, or external data links.

What changed in EU law in 2025 and 2026?

12 September 2025: The Data Act (Regulation (EU) 2023/2854) began to apply mainly within the EU. Chapter II deals, among other things, with the right to access and share data from connected products and related services. The European Commission's overview describes what this means for consumers and businesses.

12 September 2026: According to Article 50, the obligation in Article 3.1 begins to apply to connected products and related services placed on the market after this date. This is a special product design rule. It does not mean that older cars automatically lose the rights under Articles 4–5 or that older cars must be retrofitted with technology they lack.

What data is covered? Articles 2.15–17 define product data, related service data, and so-called readily available data. Article 4.1 applies to such data and relevant metadata that the data holder actually obtains or can legally obtain without disproportionate effort. The manufacturer does not need to create new data items, collect everything that was never stored, or disclose every advanced derived analysis.

Raw data and derived analyses are different: The European Commission's specific vehicle guidance (C/2025/5026) explains the difference between raw or pre-processed vehicle data and advanced derived data. It also clarifies that the Data Act does not give a general right to the car's control functions or resources.

Who gets the information? Article 4 regulates the user's own access. Article 5 regulates when a user can request that the data holder make information available to a selected third party. Personal access under Article 4.1 shall be free of charge to the user. When sharing data with a third party, special rules on compensation between the actors may become relevant under Articles 8–9; it is incorrect to describe everything as an unconditional free B2B service.

Data protection and security: Information about travel routes, drivers, and other persons may be personal data. GDPR and other applicable regulations apply in parallel. The Data Act also has rules on security and trade secrets that may justify individually assessed limitations. Do not send a full VIN, detailed driving history, or identifying passenger information in an open email thread.

PTS – Swedish contact point for problems

The Swedish Post and Telecom Authority is the competent Swedish authority for the Data Act and has a special complaint service. Article 38 provides an opportunity to submit complaints about alleged violations of rights. PTS informs that the authority's ability to take action may be limited while complementary national provisions are being processed. Check the updated status before each submission. None of our files is a submitted complaint or an automatic authority decision.

How to use the package – six steps

1. Check the vehicle's connectivity, agreement, and whether you qualify as a user under the Data Act. Identify the correct data holder.
2. Make a fact-based list of data categories, relevant metadata, desired period, and a secure way to get a response.
3. Choose letter 01 for personal access, letter 02 for sharing, or letter 03 for metadata clarification. Legally distinguish between data access and vehicle functions.
4. Fill in only verified facts in Word, remove the information page and all unused bracketed checkboxes. Send personal data via a secure channel.
5. Record the actual request, contact, data holder's response, and any limitations in Excel. Request concrete justification with letter 04 in case of unclear information.
6. If you believe your rights have been violated, use letter 05 as a basis and check PTS's official complaint process.

Frequently Asked Questions about Vehicle Data under the Data Act

Can I request data from a connected car in Sweden?

Yes, when you are a user of a connected product within the meaning of the Regulation and the requested information is covered by Article 4. Request specific data that actually exists or can be retrieved under the conditions of the article.

Does the EU Data Act also apply to cars manufactured before September 2026?

User rights under Articles 4 and 5 generally began to apply on 12 September 2025. The separate obligation for product design under Article 3.1, however, applies to products placed on the EU market after 12 September 2026. Technically unavailable data does not need to be created retroactively.

Can I give an independent workshop access to the car's data?

Article 5 gives the right under certain conditions to request sharing of covered data with a named third party. It is not the same as the right to the car's control system, spare parts, or safety-critical software.

Must the manufacturer disclose all data for free?

No. According to Article 4.1, relevant user access shall be free of charge to the user, but it only applies to certain data and metadata covered by the law. For third-party sharing, there are separate conditions and possibly compensation between companies.

Does every diagnostic report and the manufacturer's AI analysis fall under the scope?

No. The Data Act and the vehicle guidance distinguish raw data and pre-processed data from advanced derived analyses. A single data item needs to be classified; you cannot assume that every summary or algorithmic conclusion must be disclosed.

Can I demand real-time data and unlimited API access?

According to Article 4, data shall be made available continuously and in real time when this is relevant and technically possible. The Regulation does not automatically give the right to open all the car's interfaces or control functions.

How long can the car manufacturer take to respond?

Article 4.1 speaks of making data available without undue delay. The package does not state any general invented deadline of, for example, seven or thirty days. Excel only counts actually elapsed calendar days.

What do I do if the manufacturer refers to trade secrets or security?

Ask for a concrete description of which data items are limited, the relevant legal basis, and whether secure alternative forms exist. Trade secrets, personal data, and security risks may justify special limitations.

Where do I complain if I do not get data?

PTS is the competent Swedish authority and has a complaint service under the Data Act. Letter 05 helps to collect the basis, but the complaint must be submitted in the manner instructed by the authority.

Are the letters in English and the PDFs interactively fillable?

No. Five working letters and one guide are in Swedish; a separate English User Guide explains the usage in English. The PDFs are searchable and printable, not interactive forms. Edit in Word.

Related Mallbutiken Products

For overall company requirements and agreements on data sharing, there is Data Act – Agreements and Compliance. For regular service and maintenance documentation, there is The Car's Service Journal and Maintenance Register as well as Vehicle Register and Service Planning. These products have other main uses than this package with five specific vehicle data requests.

Official Legal Sources and Review Status

EUR-Lex – Regulation (EU) 2023/2854, Articles 2–5, 38, and 50 · European Commission – Vehicle Data Guidance C/2025/5026 · European Commission – Data Act · PTS – Data Act.

Version 1.0 · Sweden/EU · AI-assisted legal source check 2026-11-08. No independent lawyer has reviewed the documents and no authority has approved them. The templates do not guarantee disclosure or results. Digital ZIP is linked separately before possible publication. The product is a DRAFT.