DMA and GDPR in interaction: Joint guidelines from the EDPB and the EU Commission

New EU guidelines: How DMA and GDPR interact with each other.
Categories:
Picture of  Aristotelis Zervos

Aristotelis Zervos

Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protectionIT compliance and AI regulation.

With the increasing regulation of digital platforms, the relationship between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) at the heart of European digital policy. The common guidelines published in October 2025 Guidelines of the European Data Protection Board (EDPB) and the European Commission aim to create legal clarity for gatekeepers and supervisory authorities. They explain how both legal acts interact with each other and how potential conflicts can be avoided.

Target: DMA and GDPR Do not view in isolation

The DMA is intended to ensure fair competitive conditions in the digital market and limit the market power of so-called "gatekeepers", i.e. large online platforms. The GDPR on the other hand, protects the fundamental rights of natural persons with regard to the Processing of personal data. Both legal acts overlap where the DMA contains obligations that also affect the handling of personal data. For example, in the case of data combination, interoperability or data use across services.

The Guidelines are intended to ensure coherent and uniform application of the two sets of regulations. They emphasize that the provisions of the DMA and the GDPR must not be understood in isolation, but in a complementary way and implemented in a coordinated manner in practice.

The aim is to avoid potential conflicts between the regulatory obligations of the DMA and the data protection principles of the GDPR from the outset. To this end, it is emphasized that close coordination between the competent authorities (in particular the European Commission and the data protection supervisory authorities) is necessary to ensure consistent interpretations and coherent enforcement strategies.

The Guidelines should therefore serve as a frame of reference that provides orientation for gatekeepers and authorities alike.

No exception to the GDPR by the DMA

A central principle of the Guidelines is that the DMA is the application of the GDPR neither displaced nor restricted. Gatekeepers must therefore continue to fulfill all obligations arising from the GDPR fulfill. The DMA can therefore not create an independent legal basis for data processing, but must always be in accordance with the general principles of data protection law.

In the Guidelines it is emphasized that for each Processing of personal data not only has a valid legal basis in accordance with Art. 6 GDPR is necessary, but that the requirements of Art. 5 GDPR must be strictly observed: in particular legality, Transparency, Earmarking, Data minimizationaccuracy and storage limitation. According to the EDPB and the Commission, compliance with these principles is crucial to ensure that the data processing obligations provided for in the DMA do not lead to an erosion of data protection rights. In addition, the Guidelinesthat the DMA is in no way a lex specialis vis-à-vis the GDPR is to be understood. On the contrary, the DMA must be used in the context of the GDPR be implemented in order to guarantee a high level of data protection and the protection of fundamental rights.

Reciprocal effect between DMA and GDPR

Both legal acts are described as complementary. While the DMA primarily pursues competition law and market-oriented objectives, the GDPR ensure the protection of fundamental rights and, in particular, the right to data protection. In the Guidelines these different objectives are not seen as contradictory, but as mutually supportive. The DMA can only be fully effective if its obligations are in line with the data protection principles of the GDPR stand.

Ultimately, both sets of rules serve to strengthen trust, fairness and accountability in the digital ecosystem. The EDPB emphasizes that a consistent application of both standards is crucial to avoid double regulation, contradictory decisions and enforcement deficits. Therefore, coordination between competition and data protection authorities plays a central role.

Common enforcement architecture

The Guidelines provide for close and structured cooperation between the data protection supervisory authorities and the European Commission, which is responsible for enforcing the DMA. This cooperation should take place through formal and informal channels and ensure a continuous exchange of information, the coordination of procedures and the consistent application of the law. The EDPB therefore recommends the establishment of operational coordination mechanisms: 

  • joint working groups,
  • regular consultations and
  • early communication in the event of overlaps between DMA and GDPR.


Furthermore, the Guidelinesthat mutual assistance in accordance with Art. 61 GDPR and the possibility of joint measures pursuant to Art. 62 GDPR can serve as a model in order to create synergies in enforcement. This should ensure that data protection and competition law considerations are not considered in isolation, but in an integrated manner. The aim is for both levels of authority - the European Commission and the national data protection supervisory authorities - to establish a coherent and effective enforcement system. This should avoid legal inconsistencies and increase legal certainty for companies. In the long term, this approach aims to develop a uniform European governance framework for digital regulation.

Reading tip: DMA violations - EU imposes billions in fines on Apple and Meta

DMA and GDPR: Practical examples and case constellations

The Guidelines also describe specific situations in which the obligations arising from the DMA and the GDPR overlap. These scenarios highlight typical areas of conflict between competition law and data protection requirements. The case studies provide gatekeepers, supervisory authorities and affected third parties with practical guidance. They cover both technical and organizational challenges and show how Compliance can be implemented in complex digital ecosystems:

  • Combination of data from multiple services a gatekeeper (e.g. social media and search engine): Here, in addition to the DMA obligation, a valid Consent pursuant to Art. 6 para. 1 lit. a GDPR are available.
  • Interoperability obligations (e.g. messenger compatibility): Gatekeepers must ensure that data protection principles such as Data minimization and Earmarking are complied with.
  • Third-party access to dataIf the DMA allows third parties to access data, the gatekeeper is still responsible for ensuring data protection-compliant interfaces and control mechanisms.

Legal assessment DMA vs. GDPR

The Guidelines clarify: The DMA does not create its own justifications for the Processing personal data and does not act as a lex specialis towards the GDPR. Any data processing in the DMA context remains subject to Art. 5 GDPR (in particular legality, Earmarking, Data minimizationstorage limitation) and to a suitable legal basis in accordance with Art. 6 GDPR bound.

Overall, the DMA is only effective as a market-correcting regime if it is interpreted and implemented in accordance with fundamental rights. The Guidelines enshrine this through the requirement of compatible interpretation, through requirements for cooperation between the Commission and data protection supervisory authorities and by emphasizing the "ne bis in idem" principle. In practical terms, this means an integrated compliance design for gatekeepers with strict separation of purpose and data storage between services, documented consent flows, revocation and transparency dashboards (also with regard to recipient lists), robust AnonymizationDSFAs for high-risk scenarios and API governance, which technically enforces legal limits.

An interesting point concerns the legal basis check: if the DMA contains an obligation to release data, this does not automatically mean that the Processing according to the GDPR is permissible. It always requires an independent justification under data protection law.

Interaction between competition and data protection law

The Guidelines were opened to the public Consultation and are to be finally adopted once the consultation phase is complete. This is an important opportunity for companies to adapt their compliance structures. National data protection authorities will also be Guidelines more closely involved in DMA monitoring.

With the common Guidelines the European Data Protection Board and the European Commission have taken an important step to clarify the interaction between competition and data protection law.

Although the DMA creates new obligations for large platforms, the GDPR remains the central benchmark for the Processing of personal data. In future, companies must integrate both sets of regulations in order to avoid the risk of sanctions and legal conflicts.

Source: Guidelines on the interaction between DMA and GDPR

Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with profound expertise in data protection, GDPRIT compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR compliance and risk management. You can find out more about him on his Author profile page.

Tags:
Share this post :