{"id":3488,"date":"2026-10-06T11:18:56","date_gmt":"2026-10-06T11:18:56","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3488"},"modified":"2026-10-06T11:19:11","modified_gmt":"2026-10-06T11:19:11","slug":"dsa-obligations-online-stores-poland","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/dsa-obligations-online-stores-poland\/","title":{"rendered":"Your store sells only its own products."},"content":{"rendered":"

Your store sells only its own products. It has nothing to do with Facebook or TikTok. But it allows customers to post reviews under products \u2014 and under the DSA<\/strong> (Digital Services Act<\/a>, EU Regulation 2022\/2065), that already makes it an online platform. This single feature triggers more than a dozen obligations that are probably not mentioned anywhere in your terms and conditions. The DSA has applied in full since 17 February 2024<\/strong> \u2014 as an EU regulation, it applies directly, without the need for Polish legislation. Businesses that waited for national regulations are now more than two years behind, rather than starting with a clean slate. In May 2025, the European Commission referred Poland to the CJEU for failing to designate a Digital Services Coordinator (source: European Commission<\/a>). The Polish act implementing the DSA (Sejm paper No. 2694) was adopted on 4 September 2026 and designates the President of UKE as the Digital Services Coordinator \u2014 but this is not the beginning of the obligations; it is the beginning of enforcement.<\/p>\n

In this article, I will take you through seven steps that determine how much of the DSA applies specifically to your service \u2014 and what to do about it.<\/p>\n

Concepts you need to know before you begin<\/h2>\n

Before moving on to classification and implementation, establish a common vocabulary. The DSA introduces several concepts that sound technical but have very specific consequences.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Concept<\/th>\nWhat it means<\/th>\nWhy it applies to you<\/th>\n<\/tr>\n<\/thead>\n
Provider of an intermediary service<\/strong><\/td>\nAn entity providing a mere conduit, caching or hosting service<\/td>\nThe broadest category \u2014 if users can publish anything on your service, you are in the game<\/td>\n<\/tr>\n
Hosting<\/strong><\/td>\nStoring information provided by a recipient of the service at their request (Article 3(g) DSA<\/a>)<\/td>\nA store with just one comment field already meets this definition<\/td>\n<\/tr>\n
Online platform<\/strong><\/td>\nHosting that publicly disseminates such information (Article 3(i) DSA<\/a>)<\/td>\nReviews visible to all visitors = public dissemination<\/td>\n<\/tr>\n
Marketplace<\/strong><\/td>\nA platform that allows consumers to conclude distance contracts with traders<\/td>\nIf you sell third-party products, you have an additional layer of obligations (Articles 30\u201332 DSA)<\/td>\n<\/tr>\n
Notice and action mechanism<\/strong><\/td>\nA procedure for reporting illegal content and acting on notices (Article 16 DSA)<\/td>\nNo such mechanism = no exemption from liability for third-party content<\/td>\n<\/tr>\n
Exemption under Article 19 DSA<\/strong><\/td>\nExemption of micro and small enterprises from platform obligations (Section 3 of Chapter III)<\/td>\nIt does not exempt you from hosting or general obligations \u2014 and expires as the business grows<\/td>\n<\/tr>\n
Dark patterns<\/strong><\/td>\nInterface practices that manipulate user decisions (Article 25 DSA)<\/td>\nForced consent, difficult opt-outs, time pressure \u2014 all of these are subject to audit<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How to classify your service under the DSA<\/h2>\n

This is the foundation of the entire implementation. Incorrect classification means either overlooking more than a dozen obligations or implementing procedures that your business is not required to follow.<\/p>\n

Decision tree: what type of provider are you?<\/h3>\n

Review each feature of your service and answer three questions:<\/p>\n

    \n
  1. Can a user submit any content (a review, comment, photo, question or offer)?<\/li>\n
  2. Is that content stored on your service?<\/li>\n
  3. Is that content publicly visible to other users?<\/li>\n<\/ol>\n\n\n\n\n\n\n\n\n
    Answers<\/th>\nClassification<\/th>\nLayer of DSA obligations<\/th>\n<\/tr>\n<\/thead>\n
    No to question 1<\/td>\nNot an intermediary<\/td>\nDSA obligations do not apply<\/td>\n<\/tr>\n
    Yes, yes, no<\/td>\nHosting<\/strong><\/td>\nGeneral obligations (Articles 11\u201315) + hosting obligations (Articles 16\u201318)<\/td>\n<\/tr>\n
    Yes, yes, yes<\/td>\nOnline platform<\/strong><\/td>\nGeneral + hosting + platform obligations (Articles 20\u201328)<\/td>\n<\/tr>\n
    Yes, yes, yes + consumer\u2013trader contracts<\/td>\nMarketplace<\/strong><\/td>\nAll of the above + marketplace obligations (Articles 30\u201332)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    A store with product reviews, a Q&A section, a gallery of customer photos or user profiles is an online platform, even if it sells only its own products. Classification depends on the service\u2019s features, not on how you think of your business (Article 3(g) and (i) DSA<\/a>).<\/p>\n

    Record the classification result, together with your reasoning and the date. Revisit it whenever you change your service\u2019s functionality \u2014 adding a new module may change your category.<\/p>\n

    Check your enterprise status and the Article 19 exemption<\/h3>\n

    Article 19 DSA removes the layer of platform obligations for micro and small enterprises. The thresholds are set out in Recommendation 2003\/361\/EC<\/a>:<\/p>\n\n\n\n\n\n\n
    Status<\/th>\nHeadcount<\/th>\nAnnual turnover or balance sheet total<\/th>\n<\/tr>\n<\/thead>\n
    Microenterprise<\/td>\nFewer than 10 people<\/td>\nUp to EUR 2 million<\/td>\n<\/tr>\n
    Small enterprise<\/td>\nFewer than 50 people<\/td>\nUp to EUR 10 million<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    The exemption expires once the thresholds have been exceeded for two consecutive accounting periods<\/strong>. After losing this status, you have an additional 12 months<\/strong> to implement the platform obligations (Article 19 DSA<\/a>). These are two separate, consecutive periods \u2014 do not treat them as one.<\/p>\n

    Add a status review to your calendar whenever the scale of your business changes. If you are growing quickly, the exemption may expire sooner than you expect.<\/p>\n

    Note:<\/strong> If you are a micro or small enterprise, do not copy platform obligations that you do not have to meet into your terms and conditions<\/a>. Promising procedures that no one in the company actually handles creates an easier basis for a claim than the absence of a statutory obligation \u2014 with risks under consumer law and unfair contract terms rules.<\/p>\n

    Contact us<\/a> \u2014 we will help you determine your service\u2019s classification and the scope of your DSA obligations.<\/p>\n

    Obligations accumulate in layers \u2014 exactly what you need to implement<\/h2>\n

    The DSA structures obligations like a pyramid: each successive layer is added to the previous one. Below is a definitive list of tasks for each category of provider.<\/p>\n

    General obligations \u2014 for all providers of intermediary services<\/h3>\n

    Regardless of whether you are a hosting provider, platform or marketplace, you must meet these requirements:<\/p>\n

      \n
    1. Point of contact for authorities<\/strong> (Article 11) \u2014 for Member State authorities, the European Commission and the European Board for Digital Services. Specify the language of communication and appoint a named person to manage the inbox.<\/li>\n
    2. Point of contact for users<\/strong> (Article 12) \u2014 separate from the point of contact for authorities. It must allow electronic communication and be easily accessible.<\/li>\n
    3. Legal representative in the EU<\/strong> (Article 13) \u2014 if the provider is not established in the Union but offers services on the EU market.<\/li>\n
    4. Terms and conditions<\/strong> (Article 14) \u2014 expanded to describe content moderation policies and tools, restrictions on the use of the service, the procedure for amending the terms and conditions, the right to terminate use of the service, and the complaints system. If the service is accessible to minors, use language that minors can understand.<\/li>\n
    5. Annual content moderation report<\/strong> (Article 15) \u2014 published at least once a year. Reports for 2026 onwards must use the templates set out in Implementing Regulation (EU) 2024\/2835<\/a>. Publication deadline for the 2026 report: 28 February 2027<\/strong>.<\/li>\n
    6. Compliance with orders from authorities<\/strong> (Articles 9\u201310) \u2014 orders concerning illegal content and information about recipients of the service.<\/li>\n<\/ol>\n

      Hosting obligations \u2014 when you store third-party content<\/h3>\n
        \n
      1. Notice and action mechanism<\/strong> (Article 16) \u2014 a form with mandatory fields: the reason for the notice, the location or URL of the content, the reporting person\u2019s full name or business name and email address, and a statement confirming a good-faith belief that the notice is accurate. Automatic acknowledgment of receipt where contact details have been provided. Notices must be processed in a timely, diligent, non-arbitrary and objective manner. The DSA does not specify a fixed number of days \u2014 the requirement to act \u201cwithout undue delay" is assessed in light of the specific circumstances.<\/li>\n
      2. Statement of reasons for moderation decisions<\/strong> (Article 17) \u2014 a template with fields covering: the scope of the restriction, the facts and legal grounds relied on, information on the use of automated means, and guidance on available remedies. This applies to content removal, restrictions on visibility, account suspension or termination, and demonetisation.<\/li>\n
      3. Notification of law enforcement authorities<\/strong> (Article 18) \u2014 where there is suspicion of a criminal offence involving a threat to life or safety.<\/li>\n<\/ol>\n

        A valid Article 16 notice gives you, as a hosting provider, actual knowledge of the illegal content<\/strong> (Article 16(3) DSA<\/a>). From that point onward, inaction means losing the exemption from liability for third-party content under Article 6 DSA<\/a>. The absence of a reporting mechanism does not protect you \u2014 if you acquire knowledge from another source (email, telephone or social media), liability may still arise.<\/p>\n

        Platform obligations \u2014 when content is publicly visible<\/h3>\n

        If your service is an online platform and you do not benefit from the Article 19 exemption:<\/p>\n

          \n
        1. Internal complaint-handling system<\/strong> (Article 20) \u2014 free of charge, electronic, available for 6 months following the decision, and supervised by appropriately qualified staff (rather than exclusively by an algorithm). It covers complaints concerning content removal, restrictions on visibility, account suspension, termination of the service and restrictions on monetisation.<\/li>\n
        2. Out-of-court dispute settlement<\/strong> (Article 21) \u2014 reference to certified ADR bodies designated by the Coordinator. In your terms and conditions, use a dynamic reference to the European Commission\u2019s list rather than a closed list of entities.<\/li>\n
        3. Priority for trusted flaggers<\/strong> (Article 22) \u2014 notices submitted by entities certified by the Coordinator must be processed as a priority. The list is published by the European Commission<\/a>.<\/li>\n
        4. Measures against misuse<\/strong> (Article 23) \u2014 in both directions: against users who publish manifestly illegal content and against users who flood the service with manifestly unfounded notices. Set thresholds and always issue a warning before suspension.<\/li>\n
        5. Enhanced reporting<\/strong> (Article 24) \u2014 submission of statements of reasons to the Commission\u2019s database.<\/li>\n
        6. Prohibition of dark patterns<\/strong> (Article 25) \u2014 forced consent, difficult opt-outs, time pressure, unequal prominence of options and repeated prompts.<\/li>\n
        7. Advertising disclosures<\/strong> (Article 26) \u2014 clear information that the content is an advertisement, on whose behalf it is presented and why it is being shown to the particular recipient. Advertising based on profiling using special categories of personal data is prohibited (Article 9(1) GDPR<\/a>).<\/li>\n
        8. Transparency of recommender systems<\/strong> (Article 27) \u2014 a description of the main parameters used in recommendation systems in the terms and conditions, written in plain and intelligible language. Users must be able to select and change their preferred recommendation option.<\/li>\n
        9. Protection of minors<\/strong> (Article 28) \u2014 proportionate measures to protect privacy and safety. Advertising based on profiling using minors\u2019 data is prohibited where the provider is aware with reasonable certainty that the recipient is a minor. The provider is not required to process additional personal data solely to determine whether the recipient is a minor. The European Commission\u2019s July 2025 guidelines (source: UKE<\/a>) recommend, among other things, private accounts by default and limiting the influence of recommender systems.<\/li>\n<\/ol>\n

          Marketplace obligations \u2014 when you enable consumer\u2013trader contracts<\/h3>\n

          If consumers use your platform to conclude contracts with third-party sellers (and you do not benefit from the Article 29 DSA exemption):<\/p>\n

            \n
          1. Traceability of traders \u2014 know your business customer<\/strong> (Article 30) \u2014 before admitting a seller, collect and verify: their name, address, telephone number, email address, a copy of their identity document, payment account details, registration number and self-certification that the products or services offered comply with EU law. If the seller fails to provide the information, suspend the provision of services. Make the seller\u2019s details available to consumers on the product page. Retain them for 6 months after the relationship ends.<\/li>\n
          2. Compliance by design in the interface<\/strong> (Article 31) \u2014 design the interface so that sellers can provide legally required information (entity details, labelling, product safety information and identifying marks). Make efforts to assess whether the information is complete before allowing the offer to be published, and then randomly check the legality of products in official databases.<\/li>\n
          3. Informing consumers about an illegal product<\/strong> (Article 32) \u2014 when you become aware of an illegal product or service, inform consumers who purchased it within the previous 6 months about its illegality, the seller\u2019s identity and available remedies. If you do not have consumers\u2019 contact details, make the information publicly available.<\/li>\n<\/ol>\n

            What to write and what to build \u2014 dividing the work between terms and conditions, product and operations<\/h2>\n

            DSA implementation is 80% a product and operational task, not a drafting exercise. The terms and conditions merely describe processes that must actually exist. If you describe procedures that no one in the company handles, you create risk instead of reducing it.<\/p>\n\n\n\n\n\n\n\n
            Layer<\/th>\nWhat it covers<\/th>\nWho is responsible<\/th>\n<\/tr>\n<\/thead>\n
            Terms and conditions and documentation<\/strong><\/td>\nTerms and conditions under Article 14, description of moderation policies, information about recommendations (Article 27), illegal content reporting policy<\/td>\nLawyer + product owner<\/td>\n<\/tr>\n
            Product (interface and features)<\/strong><\/td>\nReporting form with mandatory fields, appeal pathway, decision notifications, advertising disclosures, recommendation settings, compliance by design (Article 31)<\/td>\nProduct owner + UX + dev<\/td>\n<\/tr>\n
            Operations<\/strong><\/td>\nHandling notices and complaints, point of contact, event register, team training, annual reporting, seller verification<\/td>\nOperations \/ customer care + compliance<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            Practical tips<\/h3>\n
              \n
            1. Create a separate illegal content reporting policy<\/strong> \u2014 linked from the form. It is easier to update independently of the terms and conditions and is clearer during an inspection.<\/li>\n
            2. Prepare an Article 17 statement of reasons template<\/strong> with fields to complete. Do not draft each statement from scratch.<\/li>\n
            3. Design a single reporting channel with separate branches<\/strong> \u2014 for DSA notices, consumer complaints and copyright infringement reports. Three independent pathways multiply deadlines and registers and increase the burden on your team.<\/li>\n
            4. Take an inventory of automated filters<\/strong> \u2014 profanity filters, anti-spam tools and automatic blocking of specific phrases. If an algorithm can prevent content from being published, that is automated moderation. Users must be informed about it and have access to human review of the decision. This is the most frequently overlooked obligation in the entire implementation process.<\/li>\n
            5. Align Article 27 DSA with the Omnibus Directive<\/a><\/strong> \u2014 the DSA obligation to describe recommendation parameters overlaps with the Omnibus Directive obligation to provide information about the ranking of offers. Expand your existing document in the relevant areas instead of maintaining two separate documents.<\/li>\n<\/ol>\n

              Event register \u2014 start collecting data from day one<\/h2>\n

              The annual content moderation report (Article 15, extended by Article 24 for platforms) must follow the template structure set out in Implementing Regulation (EU) 2024\/2835<\/a>. The first full cycle under these templates covers the period from 1 January to 31 December 2026. Publication deadline: 28 February 2027<\/strong>.<\/p>\n

              If you do not maintain a register from day one, you will have to reconstruct historical data from emails, Slack and spreadsheets. This is costly, time-consuming and carries a risk that the data will be incomplete.<\/p>\n

              What to record in the register<\/h3>\n
                \n
              1. Orders from authorities (Articles 9\u201310) \u2014 date, content, action taken<\/li>\n
              2. Illegal content notices \u2014 date, content of the notice, outcome of the assessment, decision taken<\/li>\n
              3. Statements of reasons for moderation decisions \u2014 scope, grounds, use of automation<\/li>\n
              4. Complaints about moderation decisions \u2014 date, content, outcome<\/li>\n
              5. Out-of-court disputes (Article 21) \u2014 date, ADR body, outcome<\/li>\n
              6. User warnings and suspensions (Article 23) \u2014 date, reason, threshold<\/li>\n
              7. Trusted flagger data \u2014 number of notices, response time<\/li>\n<\/ol>\n

                From the outset, the register structure should correspond to the fields in Annex I to Regulation 2024\/2835. This will make generating the report a matter of exporting data rather than spending weeks reconstructing it retrospectively.<\/p>\n

                The national layer \u2014 enforcement, not obligations<\/h2>\n

                The absence of Polish legislation never suspended the substantive obligations. As an EU regulation, the DSA has applied directly since 17 February 2024. National legislation concerns the authority, procedure and penalties \u2014 it does not create new obligations but enables their enforcement.<\/p>\n

                Status as of September 2026<\/h3>\n\n\n\n\n\n\n\n\n\n
                Event<\/th>\nDate<\/th>\nStatus<\/th>\n<\/tr>\n<\/thead>\n
                Full application of the DSA<\/td>\n17.02.2024<\/td>\nIn force<\/td>\n<\/tr>\n
                Commission referral of Poland to the CJEU (INFR(2024)2041)<\/td>\n07.05.2025<\/td>\nProceedings pending \u2014 no confirmed judgment or discontinuance (source: European Commission<\/a>)<\/td>\n<\/tr>\n
                Temporary designation of the President of UKE as Coordinator<\/td>\n15.05.2025<\/td>\nIn force under Council of Ministers Resolution No. 67<\/a><\/td>\n<\/tr>\n
                Adoption of the act implementing the DSA (paper 2694)<\/td>\n04.09.2026<\/td>\nAdopted; the President\u2019s decision was announced on 25.09.2026<\/a><\/td>\n<\/tr>\n
                Entry into force of the national act<\/td>\n30 days after publication in the Journal of Laws<\/td>\nRequires verification<\/strong> \u2014 as of the date this article was prepared, no confirmed item number was available in the Journal of Laws<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                Penalties<\/h3>\n

                Article 52 DSA requires Member States to provide for effective, proportionate and dissuasive penalties. The maximum fines under the Regulation are up to 6% of annual worldwide turnover<\/strong> (for breaches of obligations) or up to 1%<\/strong> (for supplying incorrect information). The complete national catalogue of penalties, procedural rules and rules applicable to corporate groups have not been fully confirmed on the basis of available sources \u2014 they will need to be verified after the act is published in the Journal of Laws.<\/p>\n

                User\u2019s right to lodge a complaint<\/h3>\n

                Article 53 DSA gives users the right to lodge a complaint with the Coordinator of the Member State where they are located (source: UKE \u2014 Digital Services Coordinator<\/a>). A complaint does not automatically initiate formal administrative proceedings \u2014 the Coordinator assesses whether the matter warrants further action.<\/p>\n

                Interface and advertising audit \u2014 what to check before an inspection<\/h2>\n

                Two areas are most frequently overlooked by product teams: dark patterns and the advertising layer.<\/p>\n

                Dark patterns (Article 25 DSA)<\/h3>\n

                Audit your interface for:<\/p>\n

                  \n
                1. Forced consent<\/a> \u2014 does the user have to accept terms in order to use a feature unrelated to those terms?<\/li>\n
                2. Difficult opt-outs \u2014 is cancelling the service more difficult than signing up?<\/li>\n
                3. Time pressure \u2014 does the interface pressure the user into making a decision (countdowns, \u201coffer expires")?<\/li>\n
                4. Unequal prominence of options \u2014 is the option that benefits the service visually dominant?<\/li>\n
                5. Repeated prompts \u2014 does the interface repeatedly ask the same question after the user has refused?<\/li>\n<\/ol>\n

                  Advertising and recommendations<\/h3>\n
                    \n
                  1. Check advertising disclosures (Article 26) \u2014 whether the recipient knows that the content is an advertisement, on whose behalf it is presented and why they are seeing it.<\/li>\n
                  2. Verify compliance with the prohibition on profiling based on sensitive data (Article 26(3) refers to Article 9(1) GDPR<\/a>).<\/li>\n
                  3. Describe recommendation parameters (Article 27) \u2014 in plain language, allowing users to change their preferences.<\/li>\n
                  4. Assess whether the service is \u201caccessible to minors" within the meaning of Article 28 \u2014 Recital 71 DSA indicates that a platform is accessible to minors, among other circumstances, where its terms and conditions allow minors to use it or the provider is aware that some recipients are minors. Simply not targeting the service at children does not disapply this obligation.<\/li>\n<\/ol>\n

                    The DSA and GDPR \u2014 handling data in connection with a notice<\/h2>\n

                    A single illegal content notice engages both the DSA and GDPR. Article 16 DSA does not establish an autonomous legal basis for processing personal data<\/a> \u2014 you must identify a legal basis under Article 6(1) GDPR (source: Regulation 2022\/2065<\/a>).<\/p>\n\n\n\n\n\n\n\n\n
                    Activity<\/th>\nPossible GDPR legal basis<\/th>\n<\/tr>\n<\/thead>\n
                    Receiving and processing a notice<\/td>\nArticle 6(1)(c) (legal obligation under Article 16 DSA)<\/td>\n<\/tr>\n
                    Providing the statement of reasons to the content author<\/td>\nArticle 6(1)(c) (obligation under Article 17 DSA)<\/td>\n<\/tr>\n
                    Acknowledging receipt of a notice<\/td>\nArticle 6(1)(c) (Article 16(4) DSA)<\/td>\n<\/tr>\n
                    Disclosing the reporting person\u2019s identity to the content author<\/td>\nRequires a separate legal basis \u2014 Article 17 DSA does not require<\/strong> disclosure of the reporting person\u2019s personal data<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                    The data minimisation principle<\/a> (Article 5(1)(c) GDPR) and purpose limitation principle (Article 5(1)(b) GDPR) apply to each of these activities. There is no Polish DPA position or court judgment concerning the combined DSA\u2013GDPR classification of content moderation by an online store \u2014 so it is worth conducting a separate analysis for your business model.<\/p>\n

                    Recurring tasks \u2014 what to put in your calendar<\/h2>\n

                    DSA implementation is not a one-off exercise. Add the following to your calendar:<\/p>\n\n\n\n\n\n\n\n\n\n\n
                    Activity<\/th>\nFrequency<\/th>\n<\/tr>\n<\/thead>\n
                    Annual moderation report (Articles 15\/24)<\/td>\nOnce a year, published by 28 February for the previous year<\/td>\n<\/tr>\n
                    Review of service classification<\/td>\nWhenever the service\u2019s functionality changes<\/td>\n<\/tr>\n
                    Review of enterprise status (Article 19)<\/td>\nWhenever the scale of the business changes<\/td>\n<\/tr>\n
                    Update of terms and conditions (Article 14)<\/td>\nWhenever moderation policies change<\/td>\n<\/tr>\n
                    Customer service team training<\/td>\nAt least once a year<\/td>\n<\/tr>\n
                    Interface audit for dark patterns<\/td>\nWhenever a major UX change is made<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                    How we can help your business implement the DSA<\/h2>\n

                    DSA implementation involves a lawyer, product owner, UX team and operations \u2014 it cannot be completed with a single document. We help e-commerce businesses<\/a>, marketplaces and SaaS providers through the entire process: from service classification and designing reporting mechanisms to launching an event register and preparing the first report.<\/p>\n

                    Our support is available at three levels:<\/p>\n

                      \n
                    1. Operational minimum<\/strong> \u2014 service classification, determination of enterprise status, points of contact, Article 16 reporting mechanism, Article 14 terms and conditions.<\/li>\n
                    2. Solid foundation<\/strong> \u2014 plus a complaint-handling system (Article 20), an Article 17 statement of reasons template, an event register structured for reporting, an automated moderation audit and a specification of form fields for the product team.<\/li>\n
                    3. Full protection<\/strong> \u2014 plus a dark patterns audit, advertising and recommendation layer, protection of minors in line with Commission guidelines, marketplace obligations under Articles 30\u201332 and management of the reporting cycle.<\/li>\n<\/ol>\n

                      We work with real scenarios from your service \u2014 we do not create documents \u201cjust in case"; we design rules where risks actually arise.<\/p>\n

                      Contact us<\/a> \u2014 we will determine the scope of your service\u2019s DSA obligations and divide the tasks between the terms and conditions, product and operational layers.<\/p>\n

                      Implementing the DSA in e-commerce \u2014 where to start<\/h2>\n

                      The DSA has applied for more than two years. The Polish implementing act activates supervision by the President of UKE \u2014 but the substantive obligations exist independently of it. If your service allows users to publish any content, the DSA applies to you.<\/p>\n

                      Three things to do first:<\/p>\n

                        \n
                      1. Classify the service \u2014 review it feature by feature and record the result with your reasoning.<\/li>\n
                      2. Launch an event register structured according to the reporting templates \u2014 every day without a register means more historical data to reconstruct.<\/li>\n
                      3. Build a reporting form with the mandatory Article 16 fields and appoint someone to handle notices.<\/li>\n<\/ol>\n

                        If you need support with classifying your service, designing reporting mechanisms or preparing DSA-compliant terms and conditions \u2014 contact us<\/a>.<\/p>\n

                        Frequently asked questions<\/h2>\n

                        Does a product review module really make my store an online platform within the meaning of the DSA?<\/strong><\/p>\n

                        Yes, if the reviews are publicly visible. Article 3(i) DSA defines an online platform as a hosting service that publicly disseminates information provided by a recipient of the service. A review visible to all visitors meets this condition. Classification depends on the service\u2019s features, not on how you think of it. Q&A sections, galleries of customer photos and user profiles are treated in the same way.<\/p>\n

                        I am a small enterprise \u2014 what can I postpone under Article 19 DSA?<\/strong><\/p>\n

                        Article 19 excludes the obligations in Section 3 of Chapter III DSA \u2014 in other words, the platform obligations: an internal complaint-handling system, out-of-court dispute settlement, priority for trusted flaggers, measures against misuse, enhanced reporting, the prohibition of dark patterns, advertising disclosures, transparency of recommendations and protection of minors. You cannot postpone the general obligations (points of contact, terms and conditions and moderation report) or hosting obligations (reporting mechanism and statements of reasons for decisions). The exemption expires after the thresholds have been exceeded for two consecutive accounting periods, followed by an additional 12-month transitional period.<\/p>\n

                        How long do I have to process an illegal content notice?<\/strong><\/p>\n

                        The DSA does not specify a fixed number of days. Article 16(6) requires notices to be processed \u201cin a timely, diligent, non-arbitrary and objective manner". The requirement to act without undue delay is assessed in light of the specific circumstances. Remember, however, that a valid notice gives you actual knowledge of the content \u2014 from that point onward, inaction means losing the exemption from liability for third-party content (Articles 6 and 16(3) DSA).<\/p>\n

                        Is a profanity filter subject to the DSA?<\/strong><\/p>\n

                        Yes. If an algorithm can prevent user content from being published, this constitutes automated content moderation. You must inform users about it in the terms and conditions (Article 14) and provide a pathway for human review of the decision. This also applies to anti-spam filters and all automatic blocking mechanisms.<\/p>\n

                        Since the Polish act is only now entering into force, do I still have time to implement the requirements?<\/strong><\/p>\n

                        No. As an EU regulation, the DSA has applied directly since 17 February 2024. The Polish act concerns the supervisory authority, procedure and penalties \u2014 it does not create new obligations but enables their enforcement. Non-compliance dates back to February 2024, and the President of UKE has temporarily served as the Digital Services Coordinator since May 2025 under a Council of Ministers resolution.<\/p>\n

                        What do I need to record in the register so that I can submit the report without reconstructing historical data?<\/strong><\/p>\n

                        From the outset, the register should correspond to the fields in Annex I to Implementing Regulation (EU) 2024\/2835. Record: orders from authorities, illegal content notices, moderation decisions and their statements of reasons, complaints about decisions, out-of-court disputes, user warnings and suspensions, and data on notices from trusted flaggers. The first report using this structure covers the period from 1 January to 31 December 2026 and must be published by 28 February 2027.<\/p>\n","protected":false},"excerpt":{"rendered":"

                        Learn how to classify your online store under the DSA, check small-business exemptions, and build notice, moderation and reporting processes.<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"50bcca49-1f79-41cd-8fa6-667c5d227e0d","sip_pair_state":"verified"},"categories":[1],"tags":[1552,1551,1446,1540,1531],"specialization":[1210],"practice_area":[],"class_list":["post-3488","post","type-post","status-publish","format-standard","hentry","category-bez-kategorii","tag-dsa-en","tag-e-commerce-en","tag-gdpr","tag-internal-procedure","tag-personal-data-protection","specialization-digital-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3488"}],"version-history":[{"count":2,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3488\/revisions"}],"predecessor-version":[{"id":3491,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3488\/revisions\/3491"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3488"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3488"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}