Internal Rules on Data Subject Rights under DSA

Commission Decision (EU) 2025/628 laying down internal rules concerning the provision of information to data subjects and the restrictions of certain data-subjects’ rights in relation to the processing of personal data by the Commission for the purpose of the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065

This decision outlines internal rules governing how the European Commission provides information to data subjects and applies restrictions to certain data protection rights under Regulation (EU) 2018/1725. It applies in the context of processing personal data for supervision, investigation, enforcement, and monitoring tasks under the Digital Services Act (Regulation (EU) 2022/2065). The rules define when and how rights such as access, rectification, restriction, and notification may be limited to protect investigations or the rights of others.