On 31 March 2025, the European Commission adopted a decision establishing internal rules relating to the Commission’s processing of personal data for purposes such as supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065, known as the Digital Services Act (DSA).
The decision applies to data subjects such as suspects, victims, whistleblowers, informants, witnesses, and staff of undertakings. According to the decision, the Commission may limit data subjects’ rights, such as the right to access or rectify personal data, in the course of its enforcement and supervisory tasks under the DSA.
The decision also requires the Commission to publish a privacy notice informing data subjects of the restrictions, record and register the reasons for the restrictions, as well as implement safeguards to prevent abuse and unlawful access to or transfer of personal data.
The decision reflects the Commission’s commitment to upholding data protection standards while effectively carrying out its enforcement duties under the DSA.
Click here to read the decision.
