DATA PROTECTION | EDPB on the interplay between DSA and DMA and GDPR

On 12 September 2025, the European Data Protection Board (EDPB) released draft  guidelines 3/2025 (DSA Guidelines) on the interplay between the Regulation (EU) 2022/2065 (DSA) and the GDPR. The DSA Guidelines are open for public consultation until 31 October 2025. Shortly after, on 9 October 2025, the EDPB and the EU Commission jointly published draft guidelines (DMA Guidelines) on the interaction between the Regulation (EU) 2022/1925 (DMA) and the GDPR. The DMA Guidelines are open for public consultation until 4 December 2025.

The DSA and DMA Guidelines aim to clarify how the GDPR applies to obligations imposed respectively on intermediary service providers under the DSA and on gatekeepers under the DMA.

The DSA Guidelines focus on breaking down provisions of the DSA that might relate to the GDPR. These include the processing of personal data for  voluntary investigations to detect illegal content (Article 7 DSA) and reporting mechanisms, the use of deceptive design patterns in interfaces (Article 25 DSA), prohibitions on using special categories of personal data for targeted advertising (Article 26 DSA), the protection of minors online (Article 28 DSA), personalised content ranking and prominence and systemic risk management (Articles 34 and 35 DSA). Conversely, the DMA Guidelines do not aim to cover all possible interactions between the GDPR and the DMA but focus on those DMA provisions that most significantly overlap with substantive GDPR requirements and therefore require harmonised interpretation by competent authorities.

Newsletter n. 112 – November 2025