DSA notice and action plus statements of reasons

Providers of hosting services need an electronic notice mechanism that is easy to access and user-friendly. The intake form should capture the elements Article 16 expects before the case is routed: why the notifier alleges the item is illegal, the exact electronic location such as a URL, contact details unless a child sexual abuse exception applies, and a good-faith accuracy statement.

Treat each notice as a case record. Article 16 links sufficiently precise and substantiated notices to actual knowledge or awareness when they let a diligent hosting provider identify illegality for the specific item without detailed legal examination. The DSA sets no universal number of hours for the merits decision; the provider must process notices and decide in a timely, diligent, non-arbitrary, and objective manner, then notify the notifier of the decision and redress options without undue delay.

A statement of reasons is required for affected recipients when a hosting provider restricts content, payments, service access, or an account because user-provided information is illegal content or incompatible with the provider's terms and conditions. It applies at the latest when the restriction is imposed if the provider knows the relevant electronic contact details.

The statement should be written from the decision record. It must explain the restriction, the facts and circumstances relied on, whether the decision followed an Article 16 notice or own-initiative investigation, any automation used, the legal or contractual ground, and the available redress routes.

The DSA Transparency Database is narrower than the user-facing statement duty. Article 17 applies to hosting services, including online platforms, but Article 24(5) requires providers of online platforms covered by that provision to submit their Article 17 decisions and statements of reasons to the Commission's publicly accessible machine-readable database. Check Article 19 before assigning the database workflow to a qualifying micro or small provider.

Before submission, online platforms must remove personal data. Redress options are relevant to the affected recipient and are not included in the public database. The Commission FAQ also explains the database lifecycle: statements become available from the following day, search data is retained for six months, daily dumps are retained for 18 months, and aggregated dashboard statistics are available for five years.

For online platforms, the decision is not complete when the statement of reasons is sent. Article 20 requires a free electronic internal complaint-handling system for at least six months after the recipient or notifier is informed of covered decisions. Covered decisions include action or inaction on a notice, content visibility restrictions, service suspension or termination, account suspension or termination, and monetisation restrictions.

Complaint outcomes need human supervision. Article 20 requires timely, non-discriminatory, diligent, and non-arbitrary handling, reversal without undue delay where the complaint shows the original decision was unfounded, reasoned decisions to complainants, and decisions not taken solely by automated means.

Trusted flaggers are certified by the Digital Services Coordinator in the Member State where the applicant is established. For online platforms, Article 22 requires technical and organisational measures so notices submitted by trusted flaggers within their designated area of expertise through Article 16 mechanisms are prioritised and processed and decided without undue delay.

Priority is not automatic removal. The Commission trusted-flagger page explains that trusted flaggers notify online platforms of content they consider illegal, while providers remain responsible for deciding on notices and removing content where justified.

Keep one joined case history for notice intake, moderation review, statement of reasons, database submission, complaint, appeal, and reporting metrics. Disconnected logs make it difficult to show that the provider sent the right user notice, submitted the matching public database fields, and reported consistent aggregate counts.

Use the checklist below as a minimum record structure. Add product-specific fields only when they help evidence a DSA requirement or explain a decision to a user, auditor, Digital Services Coordinator, or the Commission.