EDPB adopts Guidelines 3/2025 on DSA‑GDPR interplay

Ce qui s’est passé

On 17 September 2026 the European Data Protection Board adopted Guidelines 3/2025 addressing how the Digital Services Act interacts with the EU General Data Protection Regulation. The guidance clarifies the application of GDPR obligations for services covered by the DSA.

Pourquoi c’est important pour la confiance et la conformité

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The new EDPB guidance helps platforms align DSA duties with GDPR privacy requirements.
• Takes effect September 17, 2026.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Revisit retention schedules and data minimisation for the data involved.
3. Review the transfer mechanisms relied on for affected data flows.
4. Inventory AI or automated decision systems in scope and their assessments.