Digital Digital Services Act Vetted researchers

Vetted researchers

What are vetted researchers? 

One of the objectives of the Digital Services Act (DSA) is to better understand and identify the risks that online services may entail for society. Researchers who wish to contribute to this can apply to become “vetted researchers” via the BIPT. This will enable them to access non-public data from very large online platforms (VLOPs) and very large online search engines (VLOSEs) for a specific research project.  

These platforms are specifically designated by the European Commission and can be found in this list.  

Once the application is approved, the platform concerned is required to grant the researchers access to the data necessary for and proportionate to their investigations. Such research should focus on: 

  • the detection, identification and understanding of systemic risks that may arise from the design, functioning and use of the VLOP or VLOSE services and systems; or  
  • the assessment of measures taken by the VLOP or VLOSE to mitigate those risks.  

The application must be submitted via the Data Access Portal to a Digital Services Coordinator (DSC). Researchers affiliated to a Belgian research organisation can have their application sent in two ways: 

  • Option 1: Either directly to the DSC of the country where the VLOP or VLOSE is established; 
  • Option 2: Either first to the BIPT, after which the BIPT or another Belgian competent authority (VRM, CSA or Medienrat) carries out an initial assessment. The application is then forwarded to the DSC of the country where the VLOP or VLOSE is established.   

At present, there are no VLOPs or VLOSEs established in Belgium. Therefore, the BIPT can only receive applications from researchers affiliated to Belgian research organisations. The final decision on the application lies with the DSC of the Member State where the VLOP or VLOSE is established. Often this is the Irish DSC as many platforms are based in Ireland.  

On this page you will find out what systemic risks are, what conditions the research must meet and how the procedure to access the data works.

For what kind of research can you as a researcher request access to data?  

Access to the data of the VLOP or VLOSE may only be imposed if the research: 

  • Contributes to detect, identify or understand the so-called systemic risks in the EU posed by the platform, or
  • Contributes to the assessment of the adequacy, efficiency and impacts of the risk mitigation measures taken by the platform.  

What are systemic risks? These are risks to European society arising from the design, functioning or use of the VLOP or VLOSE. Systemic risks include, according to Article 34 of the DSA, among others:  

  1. The dissemination of illegal content through the services of the VLOP or VLOSE; 
  2. Negative effects for the exercise of fundamental rights, in particular those enshrined in the Charter of Fundamental Rights of the European Union, such as:  
    • human dignity;  
    • the respect for private life and the protection of personal data;  
    • the freedom of expression, information and pluralism of the media;  
    • non-discrimination;  
    • the rights of the child;  
    • a high level of consumer protection. 
  3. Negative effects on civic discourse, electoral processes, and public security. 
  4. Negative effects in relation to gender-based violence, the protection of public health and minors. 
  5. Serious negative consequences to the person’s physical and mental well-being. 

These are negative effects that actually occur or are foreseeable. 

In order to mitigate these risks, the DSA requires platforms to take action. Article 35 DSA contains examples of risk mitigation measures, such as the adaptation of the platform's online interface, algorithms, etc.

What data can vetted researchers request access to?

Vetted researchers may request access to non-publicly accessible data from a VLOP or VLOSE. They must specify in their request the type of data they need for their investigation.  

The DSA does not contain a list of the data to which researchers can request access, but the European Commission's delegated act gives in recital 13 several examples, such as:  

  • user data such as profile information and relationship networks,  
  • interaction data such as reactions or comments,  
  • information on content recommendations and content personalisation, 
  • … 

VLOPs and VLOSEs are encouraged to publish on their website a catalogue of available data assets, including, for example, data relevant to systemic risks. 

⚠️In your application, please describe as specifically as possible the data requested, including the format, scope and, where possible, the specific attributes, relevant metadata and data documentation. 

If public data from the VLOP/VLOSE are sufficient for the research, an application to become a vetted researcher is not necessary. In that case, you can submit a request directly to the VLOP or VLOSE concerned (see Access to public data).

What conditions do you have to meet in order to become a vetted researcher? 

An application must be well-founded and at least demonstrate: 

  1. that any researcher applying for vetting is a member of a university or a research organisation as defined in Article 2(1) of Directive (EU) 2019/790;  
  2. that any researcher seeking vetting is independent from commercial interests; 
  3. where the funding of the research comes from; 
  4. that the researchers are capable of fulfilling the specific data security and confidentiality requirements for each request and to protect personal data. They describe the appropriate technical and organisational measures taken to this end; 
  5. that access to the data and the time frames requested are necessary for and proportionate to the purposes of the research, and that the results of the research will contribute to the assessment of systemic risks or risk mitigation measures;  
  6. that the sole purpose of the research activities, requested data and expected results is the detection, identification and/or understanding of one or more systemic risks, or that they relate to the adequacy, efficiency and impacts of the risk mitigation measures;  
  7. that all researchers requesting vetting commit to make the results of the research after its completion publicly available within a reasonable period of time and free of charge. 

These conditions are laid down in Article 40(4) and (8) DSA. In addition, the European Commission adopted a delegated act laying down the technical conditions and harmonising the procedure for issuing the reasoned request for access to the data.  

⚠️Be as precise as possible in your application. Clearly describe what data you need, the format, the scope of the data and, where possible, the specific attributes, relevant metadata and data documentation. Please also provide official documents and/or signed declarations where possible as evidence of compliance with the above conditions.

How do you apply to become a vetted researcher?

Researchers submit their application via the DSA Data Access Portal. This portal will guide you step by step as you submit your request. 

Preparing the application

Choose a principal researcher: this person must submit the application in their own name, in the name of an entity, or in the name of a group of researchers. 

Collect the required documents and supporting documents: the portal requests, among other things: a confirmation of affiliation with a research organisation, a declaration of independence from commercial interests, the commitment to make the research results public, …  

⚠️ Please note that from 29 October 2025 it will be possible to submit an official application via the portal, as the European Commission's delegated act will enter into force on that date.   

In the meantime, researchers can already submit a test application via the portal.

Choosing the DSC  

As a principal researcher affiliated to a Belgian research organisation, you will have two options in the Data Access Portal for submitting your application:  

  • Option 1: Directly to the DSC of the country where the VLOP or VLOSE is established (e.g. to Coimisiún na Meán, the Irish DSC);  
  • Option 2: First to the BIPT. In that case: 
    • The BIPT or another Belgian competent authority (VRM, CSA or Medienrat) carries out an initial assessment. 
    • The request is then forwarded to the DSC of the country where the VLOP or VLOSE is established, which takes the final decision.  

Currently, no VLOP or VLOSE is established in Belgium. Therefore, the BIPT can only receive applications from researchers affiliated to a Belgian research organisation.  

Language of the application

Applications and related documents can be processed by the BIPT in English, Dutch, French, or German. Since the application is always forwarded to the foreign DSC of the country where the VLOP or VLOSE is established, we recommend that the application be transferred in English (unless the VLOP or VLOSE concerned is established in a country where French, Dutch or German is an official language).  

On the DSA Data Access Portal, you will find additional information on how to submit an application, such as an application template, tips and frequently asked questions.

How is your application assessed and then how works the request for access?

As mentioned above, the processing of your application depends on which DSC you select in your application.  

Option 1: direct processing by the DSC of the VLOP/VLOSE 

If you choose to send your application to the DSC of the country where the VLOP/VLOSE is established, this DSC will process it. In principle, this can be done without the intervention of the Belgian DSA authorities.  

The processing of the application should in principle take up to maximum 80 working days.  

Option 2: initial assessment by a Belgian competent authority, then final decision by the DSC of the VLOP/VLOSE 

If you choose to address your application to the BIPT, as the Belgian DSC, a decision will first be made as to which Belgian DSA authority(s) is competent in accordance with the Belgian rules on the division of powers: BIPT, VRM, CSA or Medienrat.  

In any case, the Belgian competent authority will only carry out an initial assessment of your application.  

The application is then forwarded, together with the initial assessment, to the DSC of the country where the VLOP or VLOSE is established, which ultimately takes the final decision. Here too, the processing should in principle take up to maximum 80 working days from the first submission.

The request for access 

If your application is sufficiently justified and you meet all the conditions, the DSC of the country where the VLOP or VLOSE is established will grant you the status of “vetted researcher”.  

In that case, that DSC must then submit a reasoned request for access to the non-public data to the VLOP or VLOSE. In that request, the DSC also determines the access modalities under which such access can be granted.  

The VLOP or VLOSE may request an amendment to that request if: 

  • it does not itself have access to the requested data, or  
  • granting access will lead to significant vulnerabilities, for example in the area of security or trade secrets.  

The DSC of the country where the VLOP/VLOSE is established decides whether to accept this amendment request. 

Example of a data access application

Suppose you want to do research on a social media platform and therefore want to request access to certain non-public data. How do you go about that? 

  1. Check the list of VLOPs/VLOSEs: check this list to see if the platform was designated by the European Commission as a very large online platform (VLOP) or a very large online search engine (VLOSE). Only those platforms are eligible for a request for non-public data.  
  2. Check the country in which the platform is established: the aforementioned list also shows the country where the platform is established. You can then directly submit your request to the DSC of that country. Is your research organisation established in Belgium? Then you can choose to first submit your request to the BIPT for an initial assessment by a Belgian competent authority. 
  3. Determine which data are required for your research: do you only require public data? If not, clearly explain why access to non-public data is necessary, exactly what data you need, and in what form. Check if you meet all the requirements of Article 40(8) DSA.  
  4. Choose a principal researcher: that person submits an application via the DSA Data Access Portal under their own name, in the name of an entity or of a group of researchers.  
  5. Submit your application via the portal: follow the steps and upload the required documents.  

Your application must for instance: 

  • Describe the systemic risk or risk mitigation measure you are researching: describe the systemic risk that could be related to the platform. How does your research help identify that systemic risk or the effectiveness of a risk mitigation measure? 
  • Describe the requested data: describe in sufficient detail what data you wish to access and in what form (aggregated statistics, anonymised data, pseudonymised data, etc.). Demonstrate that these data are necessary and proportionate for your investigation. 
  • Demonstrate that you meet the other requirements: such as data protection, transparency regarding funding and commercial interests, making the results available free of charge. 

You have chosen to first send your application to the BIPT? Then, we or another Belgian competent authority will carry out an initial assessment of your application. Because the platform is established in another country, we will have to send it to the DSC of that country, which will then take the final decision.

How do researchers get actual access to the data?

Actual access to the non-public data from the VLOP or VLOSE is not granted via the DSA Data Access Portal. From the moment an application submitted by a researcher is approved, the DSC of the country where the VLOP or VLOSE is established submits a request for access to the platform.

The request also includes the access modalities, based among other things on the application submitted by the researcher.  

Recital 17 of the delegated act of the European Commission gives a few examples of access modalities:  

  • Data transmission to the vetted researchers via an appropriate interface and appropriate data storage;  
  • Access for vetted researchers to a secure processing environment operated by the data provider or a third party, but with no data transmission to the vetted researchers; 
  • Other access modalities to be set up or facilitated by the data provider; 
  • Other technical, organisational or legal modalities.  

VLOPS and VLOSEs must in principle publish information regarding the access modalities they suggest, so that researchers can already get an idea of the technical, organisational and legal conditions under which access is considered appropriate.  

⚠️Should the proposed access modalities pose a problem for the research, we advise researchers to mention this in their application. In that case, you should also propose a reasoned alternative, taking into account the level of sensitivity of the requested datasets. 

How can you request access to publicly accessible data?

Besides non-public data, researchers and people affiliated to not for profit bodies, organisations and associations may also request access to the data of VLOPS or VLOSEs that are publicly available via their online interfaces. They can only use these data for research contributing to the detection, identification and understanding of systemic risks in the EU.  

The conditions to gain access to public data are the following:  

  1. To be independent from commercial interests; 
  2. Indicate in the request where the funding of the research comes from; 
  3. To be capable of fulfilling the specific data security and confidentiality requirements for each request and protect personal data. The request describes the appropriate technical and organisational measures taken to this end. 
  4. The access to the data and the time frames requested are necessary for and proportionate to the purposes of the research and the results of the research will contribute to the assessment of systemic risks.  

How do you submit such a request?  

Access to public data must be requested directly from the VLOP or VLOSE. You cannot submit your request to the BIPT. You will find more information on how to proceed on the website of the VLOP or VLOSE concerned.  

You can not find information on the website of the VLOP or VLOSE?  

Please contact the BIPT at dsa@bipt.be. 

Contact

If you have questions regarding:

  • The status of vetted researcher  
  • Access to the data of VLOPS or VLOSEs 
  • Or the DSA in general  

Contact the BIPT via email.

Back to top