Check whether you are a hosting service provider and what obligations the DSA imposes on you

Among them are hosting service providers, on whom the DSA imposes several important obligations related to combating illegal content online.

In this article, you will learn what you need to do to meet the DSA requirements as a hosting service provider and ensure that your activities comply with the law.

Who exactly is a hosting service provider?

For most of us, hosting first brings to mind services for making resources available on servers.

While accurate, this association unfortunately does not fully capture the substance of the new regulations.

The DSA definition of hosting services is in fact very broad and covers all services consisting of the storage of information provided by, and at the request of, a recipient of the service.

It does not matter whether the stored information is publicly available or accessible only to the recipient of the service, nor to what extent the recipient is able to shape the content of the stored information.

Hosting service providers will therefore include not only entities offering services for making resources available on servers or in the cloud (e.g. data center services), but providers of any services that involve storing information online (e.g. supplying enterprise resource management software, storing saves in a computer game, running a service that allows job postings to be published), provided of course that certain conditions are met, which you can read about in our previous article.

In the linked article, we described in detail who is subject to the DSA, so read through it if you want to find out whether the upcoming changes also apply to you.

Under the DSA, hosting service providers have been made subject to a range of new obligations and standards aimed at increasing transparency, security, and protection against illegal content online.

From the table below, you will learn what these obligations are and how you can fulfill them.

Obligations of hosting service providers under the DSA. Type of obligation. How to fulfill this obligation? Designating a point of contact for the authorities of EU Member States, the Commission, and the European Board for Digital Services (Article 11 DSA) and for the recipients of services (Article 12 DSA). You can do this, for example, by including in your product (on the website, in the service, or in the app) information about the email address that should be used for contact in connection with combating illegal content.

The point of contact could be, for example, the legal department or customer service office.

The same point of contact may be designated for the authorities and for the recipients of services. Including the appropriate information in the terms and conditions of the services (Article 14 DSA). You can fulfill this obligation in the following way: make sure that the terms and conditions of your services are clearly defined and contain detailed information about any restrictions on the use of the services; include in the terms and conditions of your services information about content moderation (including information about any policies, procedures, measures, and tools used for content moderation), both those carried out algorithmically and by humans; prepare rules for the internal complaint-handling system for complaints from the recipients of your services and include information about it in the terms and conditions; present all information in a simple, comprehensible, and accessible manner, in a machine-readable format, and regularly inform users of any changes to the terms and conditions.

If your services are aimed primarily at minors or this is the group that mainly uses them, then adapt the communication about the terms and restrictions to their level of understanding in order to ensure clarity and accessibility of information. Annual publication of a report on the transparency of the hosting service provider's activities (Article 15 DSA). To fulfill this obligation, you must prepare and make available, at least once a year, a report that contains all the information required by Article 15 DSA.

The report may be published, for example, on your website.

Although publishing the report may seem a distant matter at this point, it is worth taking action in advance to make it easier to meet this requirement.

It is worth informing your colleagues about the need to gather information for the report and preparing a report template.

On this second point, it is also worth knowing that work is currently underway in the European Commission on an implementing regulation to the DSA, which is intended to contain report templates to be used for the purpose of fulfilling the obligation under Article 15 DSA. Implementing a mechanism for reporting illegal content (Article 16 DSA). You can do this by preparing a dedicated form for reporting illegal content (e.g. in the "help" tab in the app or the "compliance" section on the website).

The form should allow the collection of the information specified in Article 16 DSA. Other obligations (Articles 9, 10, and 18 DSA). In addition to the obligations listed above, the DSA also imposes on the hosting service provider a number of obligations regarding actions that should be taken in specific situations, namely: the obligation to take action against illegal content, which consists in the fact that, after receiving an order to remove illegal content from national judicial or administrative authorities, you should promptly inform the authority of the actions taken; the obligation to provide information, which consists in the fact that, after receiving an order to provide specific information about a specific recipient of your service, issued by the relevant national judicial or administrative authorities, you should, without undue delay, inform the authority of any actions taken in response to the order; the obligation to notify of a suspected criminal offense, which relates to the fact that if any information you receive gives rise to a suspicion that a criminal offense threatening life or safety has been or may be committed, you are obliged to immediately inform the law enforcement or judicial authorities and provide them with all the information you have.

What consequences await hosting providers that ignore the DSA requirements?

Hosting service providers that do not adapt their activities to the DSA requirements may face severe financial penalties.

Fines for non-compliance with the DSA are linked to the annual worldwide turnover of the given intermediary service provider (including hosting) for the previous financial year.

The maximum amount of the fine can reach as much as 6% of the provider's annual worldwide turnover.

To avoid the risk of serious financial consequences, it is worth adapting your activities to the latest legal requirements.

If you have any questions about the provisions of the DSA regulation or are wondering how to introduce the required changes within a digital service, get in touch with us.

We will be happy to answer your questions!

Authors: Olga Dąbrowska and Aleksandra Woźniak. Have a question?

Let's talk. 20 minutes of conversation.

No briefs, no forms.

We will answer directly.

Book a call → See more articles