Three plausible claims to the same trip. Pick one model.

Fleet telematics hardware already logs GPS, mileage, diagnostics and fuel data. What makes this category harder than most is that the registered keeper, the leasing/fleet-financing company, and the individual driver can all have a legitimate claim to the same data — and your entitlement model has to resolve that before a request lands, not during it.

See what applies now Scope your fleet API

The right is live. The entitlement question isn't optional.

The Data Act has applied generally since 12 September 2025. For fleet hardware specifically, the harder implementation question usually isn't whether the right exists — it's who exercises it on a vehicle with three or more people who could claim to.

Requirement	Status on review date	What it means for a fleet hardware vendor
Operator/keeper access-on-request	Binding since 12 September 2025	Provide an authenticated request path for GPS, mileage, diagnostics and fuel data already logged
User-directed third-party sharing	Binding since 12 September 2025	Support routing trip and diagnostic data to an insurer or maintenance workshop the user names
Pre-contract data transparency	Binding since 12 September 2025	Disclose what the hardware records and how it can be exported, before the fleet contract is signed
Accessible by-design architecture	Applies to hardware placed after 12 September 2026	New fleet platforms should ship the access API with entitlement roles designed in from the start

Three roles, one dataset — resolve it upfront

Design the entitlement model around these three roles explicitly, rather than assuming whichever party set up the telematics account automatically holds the whole access right.

Registered keeper / owner

Holds a claim to the vehicle's operational data as the asset owner, especially outside a lease arrangement.

Leasing / fleet-financing company

Holds an interest in the vehicle asset and often the primary fleet-management contract, especially during the lease term.

Individual driver

Generates the trip, retains GDPR-protected personal data inside it, and has a distinct interest in personal-use segments.

Usually in scope

GPS location and trip history
Mileage / odometer readings
Vehicle diagnostics: fault codes, engine data via OBD/CAN
Fuel or energy consumption
Driving-behavior events (harsh braking, idling)

Usually outside Chapter II

Proprietary driver-scoring/risk-model algorithms
Cross-fleet aggregate benchmarking analytics
Firmware and embedded control logic
Data never captured or retained by the fleet platform

Field group	Typical source	Delivery format
GPS location & trip history	Telematics tracker / OBD dongle	Trip export, GeoJSON, CSV/JSON
Mileage / odometer	Vehicle ECU via OBD/CAN	Interval or per-trip export
Vehicle diagnostics	OBD/CAN fault-code stream	Structured export with code, timestamp and severity
Fuel/energy consumption	Fuel-rate or EV energy telemetry	Interval export per trip or per period

Same access layer, entitlement logic does the hard part

The fleet platform already has the trip and diagnostic data. What makes this category distinct is that the entitlement layer has to arbitrate between roles before the API and export layers can safely answer a request.

Today: a closed loop

Product

Fleet telematics hardware

Backend

Fleet management cloud

GPS location & trip history
Mileage/odometer
Vehicle diagnostics (OBD/CAN)
Fuel/energy consumption

Only exit

Manufacturer's own app

No user-facing export or API
No route for the user to authorize a third party
No permissions model, so every request is a one-off exception
No audit trail if a user or regulator asks what was shared

With a Data Act access layer

Product

Fleet telematics hardware

Backend

Fleet management cloud

GPS location & trip history
Mileage/odometer
Vehicle diagnostics (OBD/CAN)
Fuel/energy consumption

New layer

Data Act access layer

Field catalog
User & device entitlements
Consent & grant registry

Customer export & portal

CSV/JSON, self-service, same quality as the manufacturer sees

Third-party API (OAuth)

Purpose-bound grant to a repairer, analytics or energy provider

Audit & compliance log

Request, decision, recipient and delivery evidence for review

What we implement, concretely

GPS, mileage, diagnostics, fuel/energy data and trip export/API, plus a role-aware entitlement and audit layer.

Capability	What it does
Trip & diagnostics API	Authenticated access to GPS, mileage and diagnostic data per vehicle
Fuel/energy consumption export	Scheduled or on-demand export sized for fleet billing and reporting
Third-party sharing & OAuth grants	Purpose-bound, revocable access for an insurer or maintenance workshop the fleet operator or driver names
Role-aware entitlement engine	Keeper/lessor/operator/driver-resolved access control, reset on reassignment
Audit layer	A reviewable decision log covering requests, grants, deliveries and revocations

Fleet & telematics hardware Data Act FAQ

Who actually holds the access right on a leased fleet vehicle — the leasing company, the operator, or the driver?

All three can have a plausible claim, which is exactly the problem this page exists to flag. In practice, the fleet operator typically holds the primary user relationship for operational data such as mileage and diagnostics, the leasing company's interest is closer to the vehicle asset itself, and the driver's personal data inside those trips carries its own GDPR protections regardless of who holds the Data Act relationship. Resolve this explicitly in your entitlement model before a request arrives — not while triaging one.

Is an insurance telematics provider an eligible third-party recipient?

Yes, generally, provided the fleet operator or driver is the one directing the sharing and the insurer isn't a Digital Markets Act gatekeeper. Usage-based insurance depends on exactly this kind of data flow — driving-behavior and trip data routed from the fleet hardware to the insurer the policyholder has chosen.

Does personal-use driving on a company vehicle need separate GDPR handling from work trips?

Yes. Evening and weekend personal trips on a company vehicle are a stronger privacy concern than logged work trips, since they can reveal a driver's private movements with no operational justification for the employer to see them in detail. Build a personal/work trip distinction into the catalog, with tighter access controls and minimization for personal-use segments.

Are driver-scoring algorithms protected trade secrets?

The scoring model itself can be, through the Act's structured trade-secret process. The underlying trip, braking, speed and diagnostic readings that feed the score are not automatically covered — those are the operational data a fleet operator or driver is entitled to, independent of how the vendor's proprietary risk model interprets them.

How should vehicle resale or reassignment to a new driver affect access entitlements?

Entitlements should reset at reassignment, not persist with the previous driver or silently transfer without review. Build the entitlement model to trigger explicitly on vehicle handoff — closing the previous driver's access to historical trip data and establishing a clean baseline for the new one, rather than treating the hardware's identity as a permanent proxy for one person's access rights.

Is real-time GPS streaming required, or is periodic trip export sufficient?

Only where continuous delivery is both relevant to the request and technically feasible, matching the quality already available to the data holder. A fleet management platform that already tracks vehicles in near-real-time internally should offer that same access externally; one that only logs completed trips can offer periodic trip export as a compliant alternative.

Primary sources and status

Reviewed 9 September 2026. The Data Act and GDPR are binding EU regulations. The Commission FAQs and explainer are non-binding implementation guidance. Yarify's entitlement model, API contract and delivery sequence are engineering recommendations, not legal advice.