DMA & GDPR: EDPB, EU Commission endorse joint guidelines for clarity

Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives, the EDPB cooperated with the European Commission. This aims to make GDPR compliance easier and strengthen consistency. They worked within their respective mandates. Their cooperation facilitates the coherent application of the DMA and GDPR. It also increases legal certainty for gatekeepers, business users, beneficiaries, and individuals. EDPB Chair Anu Talus stated that these joint guidelines are the result of fruitful cooperation. It is the first time EDPB and the European Commission prepare guidelines jointly. This approach maximizes usefulness by simplifying compliance for businesses. It also brings enhanced legal certainty to them. The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law.” The DMA and the GDPR both protect individuals in the digital landscape , but their goals are complementary as they address interconnected challenges: individual rights and privacy in case of the GDPR and fairness and contestability of digital markets under the DMA. Several activities regulated by the DMA involve processing personal data by gatekeepers. Many DMA provisions explicitly refer to definitions and concepts from the GDPR. The joint guidelines clarify how gatekeepers can implement these DMA provisions. This ensures compliance with EU data protection law. For example, the EDPB and Commission specify elements gatekeepers should consider. This ensures compliance with specific choice and valid consent requirements. These are under Art. 5(2) DMA and the GDPR. This allows lawful combination or cross-use of personal data in core platform services. The EDPB and the Commission also address other provisions including those related to the distribution of third party apps and stores, data portability, data access requests and interoperability of messaging services. The Board and the Commission have just launched a joint public consultation on the first version of the guidelines which will be open until 4 December 2025 .  This will be an opportunity for stakeholders to comment and provide feedback. All submissions will be published on the DMA website to which a link will be included on the EDPB website, after the consultation period has closed. The final text, incorporating input received during the consultation, will be prepared jointly by the Board and the Commission, and will be adopted by the EDPB and European Commission. Following these first joint guidelines, further work is underway. The aim is to clarify the new cross-regulatory landscape. It also seeks to maintain coherent and consistent safeguards for personal data protection. The EDPB is working with the Commission. Specifically, the EDPB is collaborating with the AI Office. They are developing joint guidelines on the interplay between the AI Act and EU data protection laws. The Digital Markets Act is a key regulatory tool. It aims to tackle unfair practices of gatekeepers in digital markets. Gatekeepers are large digital platforms. They provide core platform services like online search engines, app stores, and messenger services. The main objective of the DMA is to make markets in the digital sector fairer and more contestable.