Securiti leads GigaOm's DSPM Vendor Evaluation with top ratings across technical capabilities & business value.

View

European Union DMA

Operationalize DMA compliance with the most comprehensive PrivacyOps platform

Last Updated on November 14, 2023

Schedule Your
Personal Demo

Learn how you can leverage Securiti’s Data Command Center to address data security, privacy, governance, and compliance.

See a demo
Schedule your demo today

The EU Digital Markets Act (DMA) is part of the EU Digital Services Package that aims to create a safer online space along with the EU Digital Services Act (DSA). The DMA aims to ensure a contestable, fair, and competitive digital market and to ban unfair business practices by large online platforms.

The DMA regulates designated gatekeeper organizations that provide core platform services (CPS) in at least three member states of the EU. Core platform services that can fall under the scope of the DMA includes online intermediation services, online search engines, online social networking services, video-sharing platform services, number-independent interpersonal communications services, operating systems, web browsers, virtual assistants, cloud computing services, and online advertising services.

For an organization to come under the scope of the Act, it must meet one of the following thresholds:

  • It has an annual EEA turnover equal to or above EUR 7.5 billion in the last three financial years, or the equivalent fair market value of the undertaking to which it belongs amounts to at least EUR 75 billion in the last financial years and provides a CPS in at least three member states.
  • It has more than 45 million monthly active end users established or located in the EU and more than 10,000 yearly active business users established in the EU in the last financial year.

The DMA was published in the Official Journal of the European Union on 12 October 2022. It enters into force on 1 November 2022, and the notification process by which the European Commission designates companies as “gatekeepers” under the Act starts six months later, i.e., on 1 May 2023. Once an organization has received notification by the European Commission that it has been designated as a gatekeeper, it will have six months to comply with the requirements of the DMA at the latest by 6 March 2024.

All designated gatekeepers must comply with DMA's list of dos and don'ts. The DMA is one of the first measures to thoroughly restrict the power of the biggest internet businesses as gatekeepers.

Once put into effect, it will create a set of requirements for chosen gatekeepers and enforce penalties, including fines of up to 10% of the global turnover, in the event of non-compliance.


The Solution

Securiti enables organizations to comply with the EU’s Digital Markets Act (DMA) through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities, and AI-driven process automation.

Securiti supports enterprises in their journey toward compliance with the EU’s Digital Markets Act (DMA) through automation, enhanced data visibility, and identity linking.

See how our comprehensive PrivacyOps platform helps you comply with various sections of the EU’s Digital Markets Act (DMA).

EU Digital Markets Act Compliance Solution

With its state-of-the-art artificial intelligence and machine-learning-based tools, Securiti is a market leader in providing data governance and compliance solutions.

Request a demo today to learn how Securiti can aid you and your organization's compliance efforts.


Map Data Flows

DMA Article 5(1)(a), DMA Recital 46

Securiti allows organizations to discover and protect large datasets via automated data mapping. Effective and automated data mapping helps match personal data with its correct owners in all structured and unstructured data systems. This ultimately allows gatekeeper organizations to ensure purpose limitation in relation to aggregated and non-aggregated data.

EU act Data Flow Mapping
EU act Universal Cookie Consent Management

Monitor and Track Consent

DMA Article 5(2), DMA Recital 36, Recital 37, Recital 60

Securiti's Consent Management Platform enables organizations to obtain end-user's consent for data access, retrieval, and advertising purposes. It allows consent management as per the requirements of the GDPR and e-Privacy Directive. Moreover, accurate consent status is recorded to demonstrate compliance.

Privacy Notice Creation & Management

DMA Recital 72

Securiti's Privacy Notice Creation and Management Solution allows organizations to transparently inform their users about any access or use of their personal data. Gatekeeper organizations can describe the basis upon which profiling is performed, including whether personal data is relied on and the purposes for which the profile is prepared.

EU act Privacy Notice Management
EU act Data Security Configuration Dashboard

Implement Security Controls

DMA Recital 9, Recital 10

Securiti's Data Intelligence enables organizations to identify emerging risk areas and implement security controls. This ultimately enables gatekeeper organizations to facilitate access to data in real-time utilizing appropriate technical measures.

Key Obligations for Gatekeepers Under Digital Markets Act

  • To refrain from combining personal data gained through the CPS with personal data from any other service of the gatekeeper or with personal data from third-party services.
  • To refrain from automatically signing in end-users to other services of the gatekeeper in order to combine personal data unless the user has consented as per the requirements of the GDPR.
  • To allow end-users effective data portability.
  • To refrain from preventing business users to offer different terms (lower prices) through different channels.
  • To allow end users to easily uninstall pre-installed apps or change default settings on operating systems.
  • To allow end users to unsubscribe from core platform services of the gatekeeper as easily as they subscribe to them.

Quick Facts about Digital Markets Act

1

Gatekeeper organizations that are subject to the DMA include online intermediation services, search engines, social networking services, video-sharing platforms, advertising services, and cloud computing services.

2

The DMA aims to guarantee that the European Digital Markets are more competitive by allowing new competitors to enter the market and prohibiting big businesses from misusing their market dominance.

3

The largest digital platforms operating in the European Union that have strong economic positions and significant impact on the internal market are DMA’s focus.

4

The DMA complements the GDPR’s right to data portability in relation to the obligation of the CSP to ensure effective portability and continuous and real-time access to data provided or generated by end-users.

5

The DMA deals with both personal and non-personal data. Personal data must be protected as per the requirements of the GDPR.

6

A gatekeeper risks a fine of up to 10% of its annual global turnover if it violates the DMA. A fine of up to 20% of its global turnover may be applied for a repeat offense.

7

Those who are harmed by the conduct of non-complying gatekeepers have the right to direct action for damages (through collective actions) in national courts.

Analyze this article with AI

Prompts open in third-party AI tools.
IDC MarketScape

Securiti named a Leader in the IDC MarketScape for Data Privacy Compliance Software

Read the Report
Videos
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...
AWS Startup Showcase Cybersecurity Governance With Generative AI View More
AWS Startup Showcase Cybersecurity Governance With Generative AI
Balancing Innovation and Governance with Generative AI Generative AI has the potential to disrupt all aspects of business, with powerful new capabilities. However, with...

Spotlight Talks

Spotlight 50:52
From Data to Deployment: Safeguarding Enterprise AI with Security and Governance
Watch Now View
Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Latest
View More
Securiti and Databricks: Putting Sensitive Data Intelligence at the Heart of Modern Cybersecurity
Securiti is thrilled to partner with Databricks to extend Databricks Data Intelligence for Cybersecurity. This collaboration marks a pivotal moment for enterprise security, bringing...
Shrink The Blast Radius: Automate Data Minimization with DSPM View More
Shrink The Blast Radius
Recently, DaVita disclosed a ransomware incident that ultimately impacted about 2.7 million people, and it’s already booked $13.5M in related costs this quarter. Healthcare...
View More
Navigating China’s AI Regulatory Landscape in 2025: What Businesses Need to Know
A 2025 guide to China’s AI rules - generative-AI measures, algorithm & deep-synthesis filings, PIPL data exports, CAC security reviews with a practical compliance...
View More
All You Need to Know About Ontario’s Personal Health Information Protection Act 2004
Here’s what you need to know about Ontario’s Personal Health Information Protection Act of 2004 to ensure effective compliance with it.
Maryland Online Data Privacy Act (MODPA) View More
Maryland Online Data Privacy Act (MODPA): Compliance Requirements Beginning October 1, 2025
Access the whitepaper to discover the compliance requirements under the Maryland Online Data Privacy Act (MODPA). Learn how Securiti helps ensure swift compliance.
Retail Data & AI: A DSPM Playbook for Secure Innovation View More
Retail Data & AI: A DSPM Playbook for Secure Innovation
The resource guide discusses the data security challenges in the Retail sector, the real-world risk scenarios retail businesses face and how DSPM can play...
DSPM vs Legacy Security Tools: Filling the Data Security Gap View More
DSPM vs Legacy Security Tools: Filling the Data Security Gap
The infographic discusses why and where legacy security tools fall short, and how a DSPM tool can make organizations’ investments smarter and more secure.
Operationalizing DSPM: 12 Must-Dos for Data & AI Security View More
Operationalizing DSPM: 12 Must-Dos for Data & AI Security
A practical checklist to operationalize DSPM—12 must-dos covering discovery, classification, lineage, least-privilege, DLP, encryption/keys, policy-as-code, monitoring, and automated remediation.
The DSPM Architect’s Handbook View More
The DSPM Architect’s Handbook: Building an Enterprise-Ready Data+AI Security Program
Get certified in DSPM. Learn to architect a DSPM solution, operationalize data and AI security, apply enterprise best practices, and enable secure AI adoption...
Gencore AI and Amazon Bedrock View More
Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock
Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...
What's
New