Navigating the Intersection of the DSA and GDPR: What Businesses Need to Know

The European Data Protection Board (EDPB) has adopted the final version of its Guidelines 3/2025 on the interplay between the Digital Services Act (DSA) and the GDPR, following a public consultation on the 2025 draft. Version 2.0 was adopted on 17 September 2026. For any business that runs an online platform, a marketplace, a hosting service or a social feature, the guidelines say how two sets of rules that both touch personal data are meant to fit together.

The starting point: both apply, in full

The DSA introduces obligations for intermediary services — transparency, accountability and the protection of users’ rights. The GDPR governs the personal data those services process. The EDPB’s first and most important point is that the DSA “does not derogate, as lex specialis, from the general rules on the processing of personal data under the GDPR”: a DSA obligation is not a licence to process data in a way the GDPR would not allow, and where neither act takes priority the two must be applied together.

What the guidelines say in practice

• Notices about illegal content (Articles 16 and 17 DSA). Let people identify themselves when they report content, but do not make a notice depend on it. Where content decisions are automated, the GDPR’s Article 22 limits on solely automated decisions apply.
• Recommender systems (Articles 27 and 38 DSA). Present the options for how content is ranked on an equal footing; do not nudge users towards the option based on profiling.
• Advertising on special category data (Article 26(3) DSA). The DSA’s ban on advertising based on profiling with special category data complements the GDPR’s Article 9 and Article 22(4) prohibitions, and applies even where a GDPR lawful basis and an Article 9 derogation would otherwise exist.
• Minors (Article 28 DSA). Avoid age assurance that identifies a user unambiguously, and do not keep age estimates permanently on the strength of Article 28 alone.
• Systemic risk (Articles 34 and 35 DSA). Data minimisation and data protection by design help address systemic risks, and where such risks are identified “a data protection impact assessment is likely to be mandatory under the GDPR”.
• Regulators. Digital Services Coordinators, the Commission and data protection authorities are expected to consult each other to avoid inconsistent outcomes and double punishment for the same conduct.

Access to platform data for researchers under Article 40 DSA is not covered; the EDPB says it will address that separately.

What businesses should do

Companies should evaluate their current practices to ensure they meet the requirements of both regulations. This includes reviewing data processing activities, transparency measures and user consent mechanisms, and considering the implications of the DSA for their digital services. Practical steps include a review of digital services to identify where the DSA and GDPR overlap — the notice form, the recommender settings page, the advertising stack, any age gate — and staying informed about ongoing regulatory developments. Appointing a Data Protection Officer (DPO) can provide valuable support in managing compliance with both regulations.

Our outsourced Data Protection Officer appointments can provide the expertise needed to manage these compliance challenges effectively.