What changed
On 21 September 2026 the European Data Protection Board (EDPB), the body that coordinates the EU’s 27 national data protection authorities, adopted the final version of Guidelines 3/2025 on the interplay between the Digital Services Act (DSA) and the GDPR. The board first published the guidelines as a draft on 12 September 2025 and ran a public consultation that closed on 31 October 2025, collecting feedback from companies, industry associations, civil society groups and national authorities across the EU. The final text answers a question that has sat unresolved on a lot of desks since the DSA took full effect: when the DSA tells an online platform to do something, does the GDPR still apply on top, and if so, how do the two fit together.
The guidelines work through five places where the two laws meet. Notice and action systems, the reporting tool every online platform must offer users to flag illegal content, count as processing of personal data whenever a report identifies someone, so ordinary GDPR rules on lawful basis, data minimisation and retention apply to the reports themselves, not only to the content being reported. Recommender systems, the algorithms deciding what a user sees first, trigger GDPR duties whenever they use personal data to personalise ranking, on top of the DSA’s separate duty to explain the main ranking parameters in plain language. Advertising transparency rules under the DSA do not replace GDPR rules on consent and legitimate interest for ad targeting; the two apply side by side. And the DSA’s ban on showing minors advertising based on profiling, together with its ban on using special categories of personal data such as health, religion or sexual orientation for targeting any user, both rely on GDPR’s own definitions of profiling and special category data to work at all.
Why it matters for more than the giants
This is not a rule written for a handful of household names. The obligations covered here, notice and action, recommender transparency and advertising rules, apply to every provider of an online platform in the EU, not only the very large platforms and search engines the European Commission designates one by one. A Swedish marketplace with a few thousand monthly users, a SaaS product with a public reviews or comments feature, or a subscription app with a personalised content feed already sits inside scope for at least the notice and action and recommender transparency duties. Until now, many smaller companies have run their DSA work and their GDPR work as two separate projects, often owned by different people, product on one side and legal on the other. The guidelines say plainly that this split does not hold up: a recommender system built without a proper GDPR lawful basis is now also a DSA problem, because the DSA’s transparency duty assumes the underlying data use was lawful to begin with.
Take a Swedish online marketplace connecting freelance tradespeople with homeowners. It already has a report button for fake listings, its notice and action system, and a “recommended for you” feed built by a contractor two years ago, before anyone was thinking about DSA compliance. Under the new guidance, whoever owns data protection there, often the same person who owns DSA compliance at a business this size, now has to document a lawful basis for the profiling behind that feed, not just describe in plain language how it ranks listings. If the feed uses location or purchase history without a clear legal basis, the required disclosure ends up describing an unlawful processing activity, which is worse than no disclosure at all.
A second, less settled development to watch
The same day, the EDPB also published a draft, Guidelines 04/2026 on administrative fines and other corrective powers under the GDPR, open for consultation until 13 November 2026 and not yet final. It sets out five steps a regulator works through: can this infringement be fined under GDPR or national law; which party, controller or processor, actually breached the provision; was the breach intentional or negligent, since culpability is a condition for any fine; how serious is it and what aggravating or mitigating factors apply, noting that minor infringements point to a reprimand while non-minor ones create what the EDPB calls “a strong presumption that a fine should be imposed”; and would a fine actually be effective, proportionate and dissuasive. The draft also covers softer tools available instead of a fine, warnings, reprimands, orders, processing limitations and certification withdrawal. EDPB Deputy Chair Jelena Virant Burnik called it “a major step in further aligning how Data Protection Authorities decide whether an administrative fine should be imposed.” It signals where the 27 authorities want enforcement to head, and is worth reading if your company has ever had a GDPR complaint on file, but nothing about it is binding yet.
From when
The DSA-GDPR interplay guidelines are formally adopted and are now going through the EDPB’s standard linguistic review before the finalised document is published in all EU languages, so the exact publication date on the board’s website may lag the adoption date by some weeks. There is no separate transition period attached to the guidelines themselves, because they interpret obligations that are already in force: the DSA’s general rules on notice and action, recommender transparency and advertising, the ones discussed here, have applied to online platforms since 17 February 2024. Guidelines 04/2026 on fines, by contrast, has no application date at all yet, since it remains open for comment until 13 November 2026.
What to do
Start by mapping which of the five overlap areas touch your platform. Check whether you run any user reporting or flagging tool, any personalised feed or ranking, or any targeted advertising, and treat each as a joint DSA-and-GDPR question rather than something owned by only one team. Where a recommender system or ad targeting runs on personal data, get a documented lawful basis in place, consent properly captured or a legitimate interest assessment with a real balancing test on file, before leaning on the DSA’s own transparency wording to describe it publicly. Check advertising against the two absolute bans: no profiling-based advertising shown to anyone under 18, and no advertising based on special category data shown to anyone at all, regardless of consent. Review who owns notice and action reports internally, because a report naming a person is personal data in its own right, so its retention and access controls need to match your general GDPR policy rather than sit outside it. Finally, read the Guidelines 04/2026 consultation even though it is not final, since understanding how a regulator’s reasoning is likely to work in a year is useful groundwork, without treating any of it as current law.
Conclusion
The headline DSA stories since the law arrived have mostly been about a handful of very large platforms. This week’s guidance is a reminder that most of the DSA’s day-to-day obligations were written for every online platform doing business in the EU, and that data protection authorities now intend to treat the DSA and the GDPR as one continuous compliance question rather than two separate ones. Lawgent helps businesses map their DSA and GDPR obligations together and build documentation that holds up under both regimes at once.
This is general information, not legal advice for your specific situation.
