EDPB issues guidelines on the interplay between the DSA and the GDPR
The EDPB adopted Guidelines 3/2025 on the interplay between the DSA and the GDPR, clarifying how intermediary service providers should apply the GDPR when processing personal data in DSA contexts.
- Framework
- GDPR
- Who it concerns
- Intermediary service providers under the DSA that process personal data and are subject to the GDPR.
What changed?
Each point with the sentence from the source that says it.
Automated decisions to remove content based solely on automated processing may be prohibited under Article 22(1) GDPR unless an exception applies.
Depending on the level of automation involved in the processing, as well as the consequences it entails for data subjects, activities captured by Article 7 DSA may qualify as decisions based solely on automated processing, including profiling, that are prohibited under Article 22(1) GDPR.
Providers of online platforms should avoid age assurance mechanisms that enable unambiguous identification of users and should not permanently store age or age range based solely on Article 28 DSA.
Therefore, the EDPB considers that providers of online platforms should in particular avoid age assurance mechanisms that enable unambiguous online identification of their users, and should not estimate or verify and permanently store the age or age range of the recipient of the service as a result of their age estimation process on the basis of Article 28 DSA alone.
If systemic risks are identified under Articles 34 and 35 DSA, a data protection impact assessment is likely to be mandatory under the GDPR.
If systemic risks are identified, a data protection impact assessment is likely to be mandatory under the GDPR.
When providing different options for recommender systems, providers should present options equally, not nudge users towards profiling-based options, and honour users' choices.
When providing different options for recommender systems to users, providers of online platforms should present options equally, should not nudge users to select the option for a recommender system that is based on profiling and should honour the users’ choices.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Data Protection Policy
Review the policy to ensure it addresses the legal basis for voluntary own-initiative investigations and automated decision-making in content moderation, as clarified by the EDPB guidelines.
- Data Protection Impact Assessment
Update the DPIA procedure to require a DPIA when systemic risks are identified under Articles 34 and 35 DSA, as stated in the guidelines.
- Privacy Notice
Review the privacy notice to include information about processing for voluntary own-initiative investigations, automated decision-making, and recommender system options, as required by the guidelines.