European Commission adopted Delegated Regulation on data access under Digital Services Act

On 1 July 2025, the European Commission adopted a delegated regulation that sets out how very large online platforms and search engines must share their data with vetted researchers. This measure builds on the Digital Services Act (DSA), which requires these companies to grant researchers access to certain data for studying online risks and assessing the effectiveness of risk mitigation measures.

The regulation introduces a structured process for this data sharing. A key element is the creation of the DSA data access portal, operated by the Commission, which serves as a central hub for handling applications and communications between researchers, companies, and national authorities.

Researchers seeking data must apply through this portal, providing proof of their academic affiliation, independence from commercial interests, and plans to publish their findings. They must also explain the purpose of their research and how they will handle sensitive data responsibly.

National authorities, known as Digital Services Coordinators, review these applications and, if justified, issue formal requests to platforms. Platforms are then required to provide access to the requested data, along with technical documentation needed for analysis.

The regulation also sets out procedures for dispute resolution and allows for mediation if disagreements arise. Platforms must regularly publish information about available data to ensure transparency.

This regulation becomes legally binding across the EU 20 days after its publication in the Official Journal of the European Union.