The Commission Decision (EU) 2025/628 of 31 March 2025 clarifying the internal rules on data rights in the course of investigations under the Data Services Act (DSA) was published in the OJ today.

This Decision applies to the processing of personal data by the Commission of the following categories of data subjects: (i) suspects, (ii) victims, (iii) whistleblowers, (iv) informants, (v) witnesses, and (vi) staff of an undertaking, and (vii) natural persons whose personal data is contained in the documents or other media collected as part of supervision, investigation, enforcement and monitoring pursuant to the DSA. The Decision applies to the processing of personal data of the following categories of personal data: (i) identification data, (ii) contact details, (iii) case involvement data, (iv) case-related data.

In addition, the Decision prescribes rules on the right of access by the data subject, right to rectification, right of erasure and right to restriction of processing, communication of personal data breaches to data subjects, recording and registering of restrictions, duration of restrictions, safeguards and retention, and the involvement of the Data Protection Coordinator and the Data Protection Officer of the Commission