Digital Services Act: Research Compliance Guide

The Digital Services Act (DSA) (Regulation (EU) 2022/2065) is the European Union’s regulatory framework governing online intermediaries, search engines, hosting services, and social platforms. For academic researchers and research administrators in media and communication, the DSA provides a critical statutory mechanism under Article 40. This provision obligates Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) to provide vetted independent researchers with access to platform data to evaluate systemic societal risks and algorithmic accountability.

What It Is and Who Runs It

The Digital Services Act, officially designated as Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC, establishes harmonized rules for an open, safe, and accountable online environment across the EU single market.

Administrative oversight operates through a dual regulatory structure:

The European Commission: Through DG CONNECT, the Commission holds direct, exclusive authority for supervising, investigating, and enforcing systemic risk and due diligence obligations on VLOPs and VLOSEs.
Digital Services Coordinators (DSCs): Each EU Member State designates an independent national authority (such as Coimisiún na Meán in Ireland or Arcom in France) as its DSC. DSCs supervise local intermediaries, coordinate cross-border enforcement, handle complaints, and evaluate academic applications for vetted researcher status.
European Board for Digital Services: An independent advisory group of national DSCs, chaired by the Commission, providing regulatory consistency across member states.

Eligibility (Summary, with the Official Source)

As described on official European Commission regulatory portals on 2026-11-08, statutory obligations and participation criteria differentiate between regulated platform providers and qualified research institutions.

Covered Platform Tiers:

Intermediary Services: Internet access providers and domain registries providing network conduit.
Hosting Services: Cloud and web hosting services storing user-provided material.
Online Platforms: Social networks, app stores, and digital marketplaces connecting users and commercial sellers.
VLOPs and VLOSEs: Services with 45 million or more monthly active users in the EU (assessed under Article 33), subject to enhanced due diligence.

Researcher Eligibility Under Article 40(8):

To access non-public platform data, investigators must obtain official “vetted researcher” accreditation from a competent DSC by meeting seven cumulative statutory criteria under Article 40(8):

Institutional Affiliation: Affiliation with a research organisation defined in Article 2(1) of Directive (EU) 2019/790 (universities or non-profit research institutes).
Commercial Independence: Complete independence from commercial platform interests or commercial sponsors regarding study findings.
Funding Transparency: Full disclosure of all funding sources supporting the research project.
Data Security: Demonstrated capacity to meet technical and organizational security controls while protecting personal data and proprietary trade secrets, aligning with established evidence-based policymaking standards.
Proportionality: Proof that data access and requested timeframes are strictly necessary for and proportionate to the scientific objectives.
Systemic Risk Purpose: Research must focus on detecting, identifying, and understanding systemic risks under Article 34(1) or evaluating risk mitigation measures under Article 35.
Open Dissemination: A formal commitment to make research findings publicly available free of charge within a reasonable timeframe.

What It Funds or Requires

The Digital Services Act does not award grant funding; instead, it establishes legally binding platform duties and creates data access entitlements for qualified researchers.

Platform Due Diligence Obligations:

Notice-and-Action (Article 16): User-friendly mechanisms allowing fast reporting of illegal content, accompanied by reasoned moderation notices.
Dark Pattern Ban (Article 25): Prohibition of deceptive user interfaces that manipulate consumer choices.
Recommender Transparency (Articles 27 & 38): Disclosure of algorithmic ranking parameters, including a non-profiled recommendation option for VLOP users.
Ad Repositories (Article 39): Searchable public repositories providing real-time data on ads, targeting parameters, and sponsors on VLOPs and VLOSEs.
Minor Protection (Article 28): Safety standards for youth, including a ban on targeted profiling of minors.
Risk Assessments and Audits (Articles 34 & 37): Mandatory annual systemic risk assessments and independent compliance audits.

Statutory Research Data Access (Article 40):

Under Article 40(4), VLOPs and VLOSEs must provide vetted researchers access to internal non-public data (algorithmic logs, moderation records, and exposure metrics) through secure APIs or data enclaves. Additionally, Article 40(12) requires platforms to give researchers prompt programmatic access to publicly accessible data across their interfaces.

Application or Compliance Steps

Research teams and principal investigators seeking Article 40 vetted researcher access follow five procedural steps:

Institutional Affiliation Review: Verify that the applicant body satisfies the research organisation definition under Directive (EU) 2019/790 and document commercial independence.
Systemic Risk Research Design: Formulate research questions aligned directly with Article 34(1) systemic risk areas, such as the spread of illegal content, civic discourse, or youth well-being.
Security and Protocol Documentation: Complete a Data Protection Impact Assessment outlining Technical and Organisational Measures (TOMs) for handling sensitive research data compliant with GDPR standards.
DSC Application Submission: Submit the application dossier to the national DSC where the research organization is based. Upon approval, the DSC grants vetted researcher status and issues a reasoned data access request to the platform.
Platform Provisioning: The platform configures access via secure APIs or clean rooms. If the platform cites lack of access or trade-secret risks, it must submit an amendment request under Article 40(5) within 15 days, with the DSC mediating technical alternatives.

Typical Timeline Phases

The lifecycle of an Article 40 research access engagement proceeds across five operational phases:

Phase 1: Project Preparation: Scoping requested variables, securing institutional ethics approval, and drafting data protection protocols.
Phase 2: DSC Evaluation: The national coordinator assesses researcher eligibility, funding transparency, and systemic risk alignment.
Phase 3: Reasoned Request and Platform Review: The DSC issues the formal data request; the platform evaluates technical feasibility during its 15-day review period.
Phase 4: Data Ingestion and Analysis: The platform provisions credentials or enclaves, and researchers execute analytical workflows within secure environments.
Phase 5: Public Reporting and Data Decommissioning: Research findings are published free of charge in open-access venues, followed by secure data disposal or archiving per the project’s data plan.

Common Mistakes

Institutions navigating DSA compliance and data access commonly encounter several pitfalls:

Confusing the DSA with the DMA: Conflating the DSA’s content moderation and systemic risk focus with the economic gatekeeper rules of the Digital Markets Act.
Ineligible Affiliations: Submitting applications through commercial consultancies or industry trade associations that lack recognized research organisation status under Directive (EU) 2019/790.
Disproportionate Data Requests: Requesting broad platform datasets rather than targeting variables strictly necessary for systemic risk hypotheses.
Inadequate Security Controls: Failing to detail robust encryption and access boundaries, leading to DSC rejections or platform objections.
Commercial Paywall Restrictions: Attempting to publish findings behind proprietary paywalls, violating mandatory open-access terms under Article 40(8)(g).

Related Programs

The Digital Services Act operates alongside several key European digital regulations:

Regulation / Program	Regulatory Scope	Primary Oversight Authority	Interaction with Digital Services Act
Digital Markets Act (DMA, Regulation (EU) 2022/1925)	Market contestability and fair commercial practices for designated digital gatekeepers.	European Commission (DG COMP)	Complements DSA by addressing economic market dominance, while DSA focuses on content safety and systemic risks.
EU AI Act (Regulation (EU) 2024/1689)	Safety and transparency requirements across artificial intelligence applications and models.	European AI Office & National Competent Authorities	Intersects with DSA obligations on algorithmic recommenders, coordinated through the national competent authorities framework under the EU AI Act.
General Data Protection Regulation (GDPR, Regulation (EU) 2016/679)	Data protection and privacy rights across automated personal data processing.	National DPAs & European Data Protection Board	Establishes mandatory privacy standards governing all researcher data access environments and platform disclosures under Article 40.
European Media Freedom Act (EMFA, Regulation (EU) 2024/1083)	Protection of editorial independence and transparent media ownership.	European Board for Media Services & National Regulators	Reinforces DSA systemic risk provisions on media pluralism and connects with emerging content provenance frameworks.

FAQ

What is the difference between the DSA and the DMA?

The Digital Services Act (DSA) focuses on platform accountability, user safety, illegal content mitigation, and systemic societal risks. The Digital Markets Act (DMA) regulates economic contestability and prevents anti-competitive conduct by large digital gatekeepers.

What platforms qualify as Very Large Online Platforms (VLOPs)?

Platforms and search engines reaching an average of 45 million or more monthly active users in the EU (assessed under Article 33) are designated by the Commission as VLOPs or VLOSEs.

Can researchers outside the EU access data under Article 40?

Non-EU researchers may participate in Article 40 projects by collaborating with an EU-affiliated research organisation serving as the lead applicant before a national DSC, provided GDPR requirements are met.

What are the four systemic risk categories under Article 34(1)?

The four categories are: (1) dissemination of illegal content; (2) negative effects on fundamental rights; (3) negative effects on civic discourse, elections, and public security; and (4) adverse impacts on gender-based violence, public health, and minor protection.

Can a platform refuse an Article 40 request based on trade secrets?

Platforms cannot issue an outright refusal. Under Article 40(5), if a request presents severe trade-secret risks, the platform must submit an amendment request within 15 days proposing alternative technical means to meet the research objective.

Sources

EUR-Lex: Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act). Official Journal of the European Union L 277, 27.10.2022, p. 1–102. URL: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065 (Read 2026-11-08).
European Commission: The Digital Services Act Package — Regulatory Overview and Implementation. URL: https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package (Read 2026-11-08).
European Commission: Very Large Online Platforms and Search Engines under the DSA. URL: https://digital-strategy.ec.europa.eu/en/policies/dsa-vlops (Read 2026-11-08).
European Commission: Digital Services Coordinators — Governance and National Competent Authorities. URL: https://digital-strategy.ec.europa.eu/en/policies/dsa-dscs (Read 2026-11-08).