DSA & GDPR: content moderation, transparency and reporting

DSA & GDPR: two frameworks, different responsibilities

The Digital Services Act (DSA) governs how intermediary services handle illegal content, explain moderation decisions and provide accountability. The General Data Protection Regulation (GDPR) governs the processing of personal data, including information used to moderate content. A service can fall under both frameworks. Applying a community rule does not, by itself, establish a lawful basis for processing personal data.

This guide is for product, community, trust-and-safety and privacy teams planning moderation workflows. It is general information, reviewed on 30 October 2026, rather than advice on a particular service. Confirm your classification and obligations with your legal adviser or data protection officer.

How Utopia can support your team

Utopia AI Moderator applies your publishing policy to content and supports human review of uncertain cases. The Utopia platform’s moderation oversight, reports and audit history can form part of the operational evidence your team uses to prepare transparency reporting.

Utopia provides you with the reporting categories and the moderation data available in your implementation. Scope how moderation decisions, review outcomes and quality measurements could feed your reporting workflow alongside data held in your own systems.

Align policy categories and moderation workflows with the evidence you need.
Plan review and feedback processes so human decisions inform ongoing moderation quality.
Assess available reports, data access and integration requirements against the official reporting template.
Identify information that must come from your organisation, such as authority orders, legal grounds, complaint outcomes or staffing records.

The exact report fields, export formats, automation and integrations must be confirmed for your service. Once confirmed, Utopia facilitates all data and reports in downloadable formats for DSA filing and submission. Your organisation remains responsible for legal classification, lawful processing, validation and publication. Using Utopia does not by itself certify DSA or GDPR compliance.

Discuss DSA report generation and GDPR requirements with our team →

Who does the DSA apply to?

The DSA applies to intermediary services offered to recipients in the EU, including providers established elsewhere where the required EU connection exists. Obligations build on the type of service, its size and its activities; not every website has the same duties.

Intermediary services: services such as transmission, caching and hosting have baseline duties, including contact arrangements and transparency about their terms.
Hosting services: storing information supplied by users adds notice-and-action and decision-explanation duties.
Online platforms: hosting that also disseminates user information to the public carries additional obligations, subject to exemptions. Social networks and many marketplaces are examples.
Consumer marketplaces: platforms enabling consumers to conclude distance contracts with traders have additional trader-traceability and consumer-information duties.
Very large services: Commission-designated platforms and search engines reaching the relevant EU user threshold—currently 45 million average monthly active recipients—face additional systemic-risk duties.

Micro and small businesses have exemptions from certain obligations, not a blanket exemption from the DSA. Article 15(2) exempts qualifying micro and small providers from the annual reporting duty unless designated as very large online platforms. Separate exemptions apply to additional online-platform rules.

A news publisher’s comments may be a minor, purely ancillary feature rather than an online platform in their own right. That does not automatically remove all hosting obligations. Assess comments, public reviews, private chat and marketplace functions separately.

Moderation obligations and user protections

Terms should explain content restrictions and moderation procedures, including automated tools and human review. Applying restrictions requires attention to users’ fundamental rights, including freedom of expression. The DSA does not impose a general obligation to monitor every item of content, nor does it make all harmful or unwanted content illegal.

Hosting services need an accessible electronic mechanism for notices of allegedly illegal content. Notices should be processed diligently and objectively, with appropriate acknowledgements and decisions. Where Article 17 applies, affected users must receive clear, specific reasons for restrictions based on illegality or terms-of-service breaches.

For online platforms subject to the relevant provisions, protections include free internal complaints, access to certified out-of-court dispute settlement and priority handling of trusted-flagger notices. Complaint decisions must be supervised by appropriately qualified staff and cannot rely solely on automation. Users may also complain to a Digital Services Coordinator and seek judicial remedies.

Additional platform duties address deceptive interface design, advertising transparency, recommender-system explanations and protection of minors. Very large services must assess and mitigate systemic risks, undergo independent audits and meet further transparency and data-access obligations. A moderation tool is only one part of this wider operational responsibility.

DSA transparency reports: what to prepare

Where the reporting obligation applies, publish an accessible, machine-readable report covering the required categories for your service. The report is an account of moderation activity, not simply a dashboard screenshot or a count of deleted posts.

Orders from authorities and how they were handled.
Notices about allegedly illegal content and the resulting action, including relevant timing information.
Moderation undertaken on the provider’s own initiative, with grounds, types of restriction and use of automation.
Complaints, outcomes and reversals, where applicable.
Automated moderation tools: purposes, accuracy indicators, possible error rates and safeguards.
Additional platform-specific information, including applicable disputes and suspensions; very large services have further staffing and language-related disclosures.

The Commission’s harmonised templates have applied since 1 July 2025. For providers reporting annually, the full annual cycle is January–December, with publication within two months after year-end. For the 2026 calendar-year period, this means the end of February 2027. Very large platforms and search engines report at least every six months, with corresponding end-of-August and end-of-February deadlines. Check transitional and designation-specific requirements where relevant.

Use the official templates and instructions, publish the required machine-readable CSV format and retain published reports for at least five years. An exemption from one report must not be assumed to remove other information duties.

Statements of reasons are a separate workflow

A periodic transparency report does not replace a notice to an affected user. A statement of reasons should explain the restriction, relevant facts, legal or policy grounds, any use of automated means and available redress as required by Article 17.

Online platforms covered by Article 24(5) must also submit statements of reasons to the Commission’s DSA Transparency Database without undue delay. Qualifying micro and small platforms are generally exempt from that additional platform obligation, but may still owe explanations to users as hosting services.

Public database submissions must not contain personal data. Build separate records for internal case handling, user notifications and public submissions; do not export raw comments, email addresses or user identifiers into public reporting by default.

Comments, images, audio, account identifiers, IP addresses and moderation histories can contain personal data. Publicly posted information is not automatically outside GDPR. Pseudonymised data may remain personal data where a person can still be identified.

GDPR applies to processing in the context of an EU establishment and, in specified circumstances, to non-EU organisations offering goods or services to people in the EU or monitoring their behaviour there. Business size does not create a general exemption.

Identify who determines the purposes and means of processing (the controller), who acts on documented instructions (a processor), and whether any joint-control arrangements exist. Where a processor is engaged, put the required processing agreement in place. Assess subcontractors and any international transfers, including the applicable transfer mechanism and safeguards.

Privacy obligations to build into the workflow

Lawful basis: identify an Article 6 basis for each processing purpose. Do not assume that consent is always required or that legitimate interests always suffice. Special-category data needs an additional Article 9 condition where applicable.
Purpose and minimisation: collect only the content and context needed for the agreed purpose. Evaluate any separate use of moderation data for training.
Transparency: explain purposes, legal bases, recipients, retention, transfers, rights and relevant automated processing in clear privacy information.
Retention: set justified periods for raw content, decisions, appeals and training data. A duty to retain a published report is not a duty to retain all underlying personal data indefinitely.
Security: use appropriate access controls, protection in transit and storage, and procedures for incident response.
Risk assessment: assess whether processing requires a data protection impact assessment and whether a data protection officer is required. Consult the supervisory authority where unmitigated high risk requires it.

Controllers must notify qualifying personal-data breaches to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches may also require notifying affected individuals. Processors must notify their controller without undue delay.

Individual rights and meaningful human review

Individuals have rights to information, access and correction, and—subject to the relevant conditions—to erasure, restriction, portability and objection. They can withdraw consent where processing relies on it and complain to a data protection authority. Rights are not absolute; for example, legal duties or freedom of expression may affect an erasure request.

Plan how to locate relevant moderation records, verify the requester proportionately, protect other people’s information and respond without undue delay, normally within one month. Extensions require the applicable conditions and timely notice.

GDPR Article 22 concerns decisions based solely on automated processing that have legal or similarly significant effects. It is not a blanket ban on automated moderation. Assess the effects of the particular decision, especially account restrictions or decisions affecting livelihoods. Where an exception permits such automated decisions, the required safeguards still apply, including meaningful human intervention and a way to express a view and contest the decision where required.

A practical reporting workflow

Define scope: list services, EU audiences, applicable exemptions, reporting owners and periods.
Map events: agree categories for notices, policy breaches, illegal-content grounds, automated decisions, reviews, restrictions and appeals. Distinguish decisions from unique pieces of content.
Plan the evidence: specify timestamps, policy versions, relevant language information, decision sources, outcomes and reversal records, subject to data minimisation.
Measure quality: document sample selection and accuracy methodology. Automation rate, detection rate and accuracy are different measures. Segment results where useful and avoid presenting one customer’s performance as a universal result.
Reconcile systems: compare moderation records with your complaints, legal-notice and publishing systems. Prevent duplicates and identify missing records.
Review and publish: map validated aggregates into the official template, check personal-data exposure, obtain accountable sign-off and publish on time.
Maintain: keep a reporting calendar, preserve published versions and review changes to policy, models and legal guidance.

This workflow is an implementation checklist, not a substitute for the applicable reporting instructions.

Common questions

Does every website with comments need a DSA transparency report?

No. Determine the service category and applicable exemptions. Ancillary comments and the micro/small-enterprise rules require a specific assessment; do not assume all publisher or gaming features are identical.

Does GDPR require a public annual transparency report?

GDPR does not impose the same general public content-moderation reporting framework as the DSA. Privacy notices, records of processing, rights handling and other accountability duties are separate obligations.

Can an AI label establish that content is illegal?

A model output is an input into a workflow, not an authoritative legal determination. Distinguish policy violations from illegality, provide appropriate review and document the relevant basis for restrictions.

Can reports include user comments?

Prefer validated aggregate information. Assess any proposed disclosure of personal data separately. DSA Transparency Database submissions must exclude personal data.

Who enforces these rules?

The DSA is supervised by national Digital Services Coordinators and the European Commission, with additional Commission responsibilities for very large services. GDPR is enforced by data protection supervisory authorities and courts. The competent authority depends on the service and processing arrangements.

Sources and further reading

Back to company Talk to our team