What happened
On 17 September 2026 the European Data Protection Board adopted Guidelines 3/2025 addressing how the Digital Services Act interacts with the EU General Data Protection Regulation. The guidance clarifies the application of GDPR obligations for services covered by the DSA.
Why it matters for trust and compliance
- Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
- The new EDPB guidance helps platforms align DSA duties with GDPR privacy requirements.
- Takes effect September 17, 2026.
- It relates to GDPR. The regulations library explains what that law requires.
Who is affected
technology controller processor platform
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Revisit retention schedules and data minimisation for the data involved.
- Review the transfer mechanisms relied on for affected data flows.
- Inventory AI or automated decision systems in scope and their assessments.