Your questions on the DSA, TCOR & e-Evidence Package, answered

The Digital Services Act (DSA) is an EU regulation that, alongside the Digital Markets Act (DMA), aims to create a safer digital space. It sets rules for digital services acting as intermediaries between consumers and goods, services or content, fostering a safe, predictable and trusted online environment in which fundamental rights are protected.

Pursuant to Article 13 of the DSA, the legal representative of intermediary service providers ensures effective communication with Member States' competent authorities, the European Commission and the European Board for Digital Services, including receiving, complying with and enforcing decisions related to the DSA. The provider must equip its representative with the powers and resources necessary for efficient cooperation.

The legal representative must be designated in writing. Providers must communicate their representative's contact details to the Digital Services Coordinator in the relevant Member State, and this information must be public, accessible, accurate and kept up to date.

The legal representative may be held liable for non-compliance with obligations under the DSA, without prejudice to the liability and legal actions that could be initiated against the provider itself.

The DSA applies to intermediary service providers offering services to users established or located in the EU, irrespective of where the provider itself is established.

Intermediary services fall into three categories: a 'mere conduit' service (ISPs, wireless networks, domain name registries, VPNs, DNS, VoIP, communication services); a 'caching' service (e.g. content delivery networks); and a 'hosting' service (storage of information at the request of a recipient, e.g. web or cloud hosting, file storage and sharing). Note: online platforms are a specific category of hosting services (e.g. online marketplaces, social media platforms and app stores).

Yes. Micro enterprises (fewer than 10 employees and an annual turnover or balance sheet not exceeding EUR 2 million) and small enterprises (fewer than 50 employees and an annual turnover or balance not exceeding EUR 10 million), per Commission Recommendation 2003/361/EC, benefit from exceptions, including transparency reporting (Art. 15(2)), several online-platform obligations (Art. 19-28, except 24(3)), and distance-contract provisions (Art. 29-32).

In-scope providers must implement mechanisms to flag illegal content, trace sellers to combat scams, allow users to challenge content removal or restriction, meet transparency obligations on terms and recommender systems, protect minors, and — for VLOPs/VLOSEs — comply with additional systemic-risk obligations, a crisis-response mechanism and restrictions on targeted advertising based on profiling of minors or special categories of data.

Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) are services with more than 45 million monthly users in the EU (10% of the EU population), subject to stricter obligations due to their potential societal impact.

Each Member State appoints a Digital Services Coordinator responsible for supervision and enforcement, with fines of up to 6% of the provider's global annual turnover. VLOPs and VLOSEs are directly supervised by the European Commission, and courts can, as a last resort, order the suspension of a service.

No. The DSA complements sector-specific rules such as the Audiovisual Media Services Directive, the Copyright in the Digital Single Market Directive, EU consumer protection law, and the Regulation on preventing the dissemination of terrorist content online (TCOR).

The Regulation on addressing the dissemination of terrorist content online (TCOR, also known as the TCO Regulation) tackles the misuse of hosting services for terrorist purposes. It requires identified terrorist content to be removed within one hour on platforms serving the EU, while safeguarding freedom of expression and information.

The legal representative of hosting service providers ensures effective communication with Member States' competent authorities, including receiving, complying with and enforcing removal orders and other TCOR decisions. Designating a representative confers jurisdiction on the Member State where that representative is located; absent a representative, jurisdiction lies with all Member States.

The legal representative must be designated in writing. Hosting service providers must notify the competent authority in the relevant Member State, and this information must be publicly available.

The TCOR applies to hosting service providers offering services in the Union and disseminating information to the public, irrespective of where their main establishment is located.

A hosting service provider stores information provided by, and at the request of, a content provider — a user who has supplied information stored and made available to the public. This follows the definition of 'service' in Article 1(b) of Directive (EU) 2015/1535.

Yes. Content disseminated for educational, journalistic, artistic or research purposes, or explicitly to counter terrorism — including polemical or controversial views within public debate — is not classified as terrorist content, subject to an assessment of genuine intent and alignment with these purposes.

Fines can reach up to 4% of the hosting service provider's global turnover for the preceding business year, in addition to reputational damage.

The e-Evidence Package consists of Regulation (EU) 2023/1543 and Directive (EU) 2023/1544, adopted on 12 July 2023. Together, they let judicial and law enforcement authorities directly order service providers to hand over or preserve electronic evidence. Since 18 August 2026, these orders must be executed within 10 days, or just 8 hours in case of emergencies.

Service providers that offer any services within these three categories of services fall under the scope: electronic communications services (internet access, messaging, telecom); internet domain name and IP numbering services (registries, registrars, privacy/proxy services); and other information society services that enable user-to-user communication or store/process data on behalf of users (cloud, SaaS, hosting, social media, marketplaces). Financial services are explicitly excluded.

Two conditions must both be met: you actively enable EU users to access your service (not merely that it is technically reachable), and you have a substantial connection to an EU Member State — through an establishment, a significant EU user base, or deliberate EU-facing activities such as local-language support, EU currency, or EU customer service.

Yes. If you already have a branch or subsidiary established in a participating EU Member State, you can designate that entity as your addressee, provided it has been formally granted the necessary powers and resources. Without an EU establishment, appointing an external legal representative such as EDSR is the required path.

A European Production Order must be answered within 10 days, or 8 hours in emergencies. A European Preservation Order requires preservation without undue delay for a 60-day period.

Yes — both the legal representative and the service provider can be held jointly and severally liable for non-compliance. The legal text expressly provides that a lack of internal procedures is not a valid defence.

The Regulation sets a ceiling of 2% of the service provider's total worldwide annual turnover for the preceding financial year. Member States may also impose their own national sanctions for failure to appoint a representative.

Orders are submitted in an official EU language accepted by the addressee. Absent a stated preference, translation defaults to the official language of the Member State where the legal representative is located. EDSR, based in Belgium, can accept orders in French, Dutch and English.