European UnionDigital Services Act (DSA) Delegated Regulation (EU) 2025/2050 (Technical conditions and procedures for data access by vetted researchers)
Delegated Regulation (EU) 2025/2050
In force since .
A transparency and process rule binding public and private bodies.
As of .
What it requires
- If the Commission has designated your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4) of the Digital Services Act, you are a data provider and the duties below apply to you (Article 2(5)).
- Open an account on the Digital Services Act (DSA) data access portal that the Commission hosts (Article 3(4)).
- Establish a dedicated point of contact to provide information and support on the data access process, and communicate it to the Commission as soon as possible (Article 6(1) and (2)).
- Make available and easily findable on your online interfaces the details of that point of contact, a link to the DSA data access portal, a DSA data catalogue describing the data assets that may be accessed for the purposes of Article 40(4) of the Digital Services Act together with their data structure and metadata, and suggested access modalities for the data in the catalogue that are adequate to the level of sensitivity of the different data assets (Article 6(4)).
- Keep the catalogue and the suggested access modalities regularly updated, in particular to reflect data related to your risk assessments under Article 34 and your audits under Article 37 of the Digital Services Act (Article 6(5)).
- Give vetted researchers access to the data requested by the date stated in the reasoned request, under the access modalities it sets, until the date on which it states that access ends (Article 10(1)).
- Notify the Digital Services Coordinator of establishment within three working days that access has been provided to the vetted researchers in accordance with the reasoned request, and within three working days that their access has been terminated (Article 15(1)).
- Give vetted researchers any additional information needed to access and understand the requested data, such as codebooks, changelogs and architectural documentation. Where providing it may result in a significant vulnerability of your services, notify the Digital Services Coordinator of establishment of that risk and, where possible, propose alternative information (Article 15(2)).
- Do not impose on vetted researchers data management requirements such as archiving, storage, refresh and deletion requirements, or limits on the use of standard analytical tools, that may hinder their research, unless the reasoned request explicitly mentions them. Where personal data are processed, impose no conditions on the processing of the shared personal data other than those the reasoned request specifies (Article 15(3) and (4)).
- If you request mediation after disagreeing with the decision of the Digital Services Coordinator of establishment on an amendment request, make the request in writing within five working days of the Coordinator's communication of that decision, and bear all costs of the mediation (Article 13(1) and (6)).
What it reaches
Obligation class
Disclosure, Reporting
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- a provider of a very large online platform or of a very large online search engine
- designated as such in accordance with Article 33(4) of Regulation (EU) 2022/2065
What this law does
Article 1 lays down the procedures and technical conditions for providing vetted researchers with access to data held by providers of very large online platforms and of very large online search engines, pursuant to Article 40(4) of the Digital Services Act. Article 40(13) of the Digital Services Act requires the Commission, after consulting the European Board for Digital Services, to adopt delegated acts laying down the technical conditions under which those providers share data.
Article 2(5) defines a data provider as a provider of a very large online platform or of a very large online search engine designated under Article 33(4) of the Digital Services Act, to which a reasoned request might be addressed. Article 3(4) requires data providers to have an account on the Digital Services Act (DSA) data access portal that the Commission establishes and hosts.
Article 6(1) requires each Digital Services Coordinator and each data provider to establish a dedicated point of contact to provide information and support on the data access process.
Article 6(4) requires data providers to make available and easily findable on their online interfaces the details of their point of contact, a link to the DSA data access portal, a DSA data catalogue of the data assets that may be accessed under Article 40(4) of the Digital Services Act with their data structure and metadata, and suggested access modalities for the data in the catalogue.
Article 6(5) requires the catalogue and the suggested access modalities to be regularly updated, in particular to reflect data related to the risk assessments under Article 34 and the audits under Article 37 of the Digital Services Act. Article 7(1) has the Digital Services Coordinator of establishment decide, within 80 working days of the submission of a data access application, whether a reasoned request can be formulated.
Article 10(1) requires a reasoned request to contain at least the date by which the data provider is to give access and the date on which that access ends, the access modalities determined under Article 9, and the summary of the data access application. Article 13(1) lets a data provider that disagrees with the decision of the Digital Services Coordinator of establishment on an amendment request ask it in writing, within five working days, to participate in mediation.
Article 13(6) makes the data provider bear all costs of the mediation. Article 15(1) requires a data provider to notify the Digital Services Coordinator of establishment within three working days that access has been provided to vetted researchers and within three working days that their access has been terminated.
Article 15(2) requires a data provider to give vetted researchers any additional information needed to access and understand the requested data, such as codebooks, changelogs and architectural documentation.
Article 15(3) bars a data provider from imposing on vetted researchers data management requirements such as archiving, storage, refresh and deletion requirements, or limits on the use of standard analytical tools, that may hinder the research, unless the reasoned request explicitly mentions them.
Where personal data are processed, Article 15(4) bars a data provider from imposing on vetted researchers any conditions on the processing of the shared personal data other than those specified in the reasoned request. Article 16 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.
The Commission's press release of states that data access is now possible following the entry into force of the delegated act on data access.
When LexLint raises it
When your app profile says your app reuses other publishers' content or operates a social platform.