EU Digital Services Act (DSA) for Non-EU Companies
How the EU Digital Services Act (DSA) interacts with GDPR for non-EU companies. Dual compliance requirements explained.
The EU Digital Services Act (DSA), effective 2024, adds another layer of regulation for non-EU companies serving EU users. While the DSA focuses on platform accountability and content moderation, it intersects with GDPR in important ways.
Who Does the DSA Apply To?
The DSA applies to intermediary services, hosting services, online platforms, and marketplaces — including very large online platforms (VLOPs). If your non-EU company offers any of these services to EU users, the DSA may apply alongside GDPR.
DSA vs GDPR — Key Intersections
Tracing Requirements (Article 30 DSA)
The DSA requires online marketplaces to collect and verify trader information. This includes name, address, contact details, and business registration — all of which is personal data under GDPR. The DSA mandates collection; GDPR requires you to process this data lawfully and with appropriate safeguards.
Transparency Reporting (Article 42 DSA)
Both the DSA and GDPR require transparency. The DSA demands content moderation reports; GDPR requires transparent data processing notices. Combined, they create comprehensive disclosure requirements.
Legal Representative Requirement
The DSA, like GDPR Article 27, requires non-EU companies to appoint a legal representative in the EU (Article 13 DSA). The DSA representative handles DSA-related matters; the GDPR representative handles GDPR matters. You may need both representatives or a single entity that can fulfil both roles.
DSA Representative vs GDPR Article 27 Representative
While a single legal entity could theoretically serve as both, the obligations differ:
- GDPR Representative: Handles data protection inquiries, accepts DPA correspondence, maintains processing records
- DSA Representative: Handles content moderation inquiries, accepts DSA-related legal correspondence, maintains transparency records
Compliance Steps
- Assess DSA applicability — are you an intermediary, hosting service, or platform?
- Appoint GDPR EU Representative if not already in place
- Appoint DSA legal representative if required
- Update policies to reflect both DSA and GDPR obligations
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.