Digital Services Act Enforcement, penalties, and investigations

The Member State of the provider's main establishment has exclusive national powers unless an Article 56 exception applies. Its Digital Services Coordinator coordinates national supervision, although the Member State may assign specific tasks or sectors to other competent authorities. For a provider without an EU establishment, competence can follow the Member State where its Article 13 legal representative resides or is established. If a provider required to appoint a representative fails to do so, all Member States, and the Commission for a VLOP or VLOSE within its competence, may act subject to safeguards against duplicate proceedings.

For designated VLOPs and VLOSEs, the Commission has exclusive powers over the Section 5 enhanced obligations. It also has powers over the service's other DSA obligations. The main-establishment Member State may enforce those other obligations only while the Commission has not initiated proceedings for the same infringement; initiation of Commission proceedings relieves the national authority of those powers for that infringement.

The Commission may investigate a VLOP or VLOSE before formally initiating proceedings. It can act on its own initiative or after a reasoned request from a Digital Services Coordinator and may use information requests, consent-based interviews, inspections, and other powers to test a suspected infringement.

Formal proceedings are a separate procedural step. If the Commission intends to adopt a non-compliance decision, a fine, or a periodic penalty payment, Article 79 requires it to communicate preliminary findings and allow observations for a reasonable period of at least 14 days. The final decision may rely only on objections on which the parties could comment.

The Commission can request information by simple request or decision. A simple request states the legal basis, purpose, requested information, period, and possible fines for incorrect, incomplete, or misleading information. A decision also indicates or imposes possible periodic penalty payments and states the right to EU court review. The addressee remains responsible for the completeness and accuracy of an answer submitted by an authorised representative or lawyer.

Commission interviews require consent. During premises inspections, authorised officials may enter relevant premises and transport, examine and copy records, obtain access to and explanations about IT systems, algorithms, data handling, and business practices, seal premises or records where necessary, and question representatives or staff. An inspection decision must identify the subject matter, purpose, start date, penalties, and review right; national judicial authorisation may be required when the provider opposes the inspection.

For a VLOP or VLOSE, Article 74 allows a Commission fine of up to 6% of total worldwide annual turnover in the preceding financial year when the provider intentionally or negligently infringes the DSA, disobeys an interim-measures decision, or breaches a commitment made binding by decision. The Commission must consider the infringement's nature, gravity, duration, and recurrence.

Article 74 separately allows a fine of up to 1% of total annual income or worldwide turnover in the preceding financial year for listed intentional or negligent procedural failures. These include incorrect, incomplete, or misleading information; failure to reply, rectify, or provide complete information; refusal of an inspection; failure to comply with Article 72 monitoring measures; and breach of access-to-file conditions.

Article 76 periodic penalty payments compel performance rather than punish the underlying infringement. The statutory ceiling is 5% of the average daily income or worldwide annual turnover in the preceding financial year per day from the date set in the decision. They can compel a complete information response, an inspection, interim measures, binding commitments, or a non-compliance decision. Once the obligation is satisfied, the Commission may set a lower definitive amount.

Temporary access restriction is a last-resort judicial route, not a fine. It requires exhausted powers, a persistent infringement, serious unavoidable harm, and, for the national restriction request, a criminal offence involving a threat to life or safety. The Commission must first allow at least 14 working days for written observations, then ask the Digital Services Coordinator of establishment to seek a national judicial order.

An enforcement file should let a reviewer reconstruct the service classification, competent authority, alleged obligation, procedural stage, evidence source, response owner, and submitted answer. Keep the original evidence, the reproducible extraction method, and the narrative prepared for the regulator.

For a VLOP or VLOSE, state whether the matter concerns a Section 5 obligation and whether the Commission has initiated proceedings for the same infringement. Those facts control the authority route.