DSA Researcher Data Access

Researcher data access under Article 40 applies to services the Commission has designated as VLOPs or VLOSEs. Article 33 uses an average-monthly-active-recipient threshold equal to or higher than 45 million in the Union. The Commission designation and its application date trigger the enhanced duties.

For non-public data, the provider acts on a reasoned request from its Digital Services Coordinator of establishment for a specific project by vetted researchers. The project must contribute to detecting, identifying, and understanding systemic risks in the Union or assessing the adequacy, efficiency, and effects of mitigation measures. Article 40(12) separately covers direct access to publicly accessible interface data for researchers who meet its stated conditions; that route does not require DSC intermediation.

The vetted researcher route runs through a Digital Services Coordinator. An applicant researcher needs an account on the DSA data access portal and submits information for one research project. The DSC of establishment decides whether it can formulate a reasoned request and, when the Article 40 conditions are met, awards vetted status for that project.

Researchers may apply through the DSC in the Member State of the research organisation to which the principal researcher is affiliated. That DSC performs an initial assessment and sends the application and supporting documents to the DSC of establishment, which makes the final decision. Under Regulation (EU) 2025/2050, the DSC of establishment must decide within 80 working days after submission whether to formulate a reasoned request or explain why it cannot, unless a duly justified delay is notified with reasons and a new date.

Regulation (EU) 2025/2050 requires each data provider to maintain a DSA data access portal account and a dedicated contact. On its own online interface, the provider must make that contact, a portal link, a DSA data catalogue, and suggested access methods easy to find. The catalogue must describe potentially accessible data assets, structures, and metadata; the provider must update the catalogue and suggested methods regularly, including to reflect Article 34 risk assessments and Article 37 audits.

The reasoned request controls the access deadline, termination date, requested data, and technical, legal, and organisational access measures. The provider must give access within the reasonable period stated in the request.

Within 15 days after receiving the request, the provider may ask the DSC of establishment to amend it only because the provider cannot access the requested data or because access would create significant vulnerabilities for service security or confidential information, especially trade secrets. The provider must propose one or more alternative means of access that are appropriate and sufficient for the research purpose.

Article 40 does not override every confidentiality or security concern. DSCs and the Commission must use data accessed under Article 40 only for monitoring and assessing DSA compliance, while taking account of personal data protection, confidential information including trade secrets, and service security.

For vetted researchers, the application must address request-specific confidentiality, data-security, and personal-data risks and describe the technical, legal, and organisational safeguards. The DSC of establishment determines the access measures after considering those safeguards, the rights and interests of the provider and recipients, trade secrets, service security, storage and deletion, training, contracts, and whether a secure processing environment is needed.

An evidence file should let a reviewer reconstruct the Article 40 path from the portal application through termination. It should show the research purpose, DSC route, requested and provided data, access decision, security review, amendment or mediation record, and final access state.

Keep public-data access separate from vetted researcher access. Article 40 also requires access without undue delay to publicly accessible interface data, including real-time data where technically possible, for researchers who meet specified independence, funding, security, proportionality, and research-purpose conditions.