DMA (Digital Markets Act) Guide: how to achieve compliance?

What is the DMA?

The DMA is an economic regulation (competition law), distinct from the DSA which addresses content. It defines "gatekeepers" based on quantitative thresholds (turnover, market capitalisation, number of users) and their position as an unavoidable "gateway" between businesses and consumers.

For these gatekeepers, the DMA sets a precise list of obligations ("dos") and prohibitions ("don'ts") aimed at opening up markets: interoperability, data portability, fair access, and the end of self-preferencing.

The objective is to restore contestability in digital markets and rebalance the power dynamic between dominant platforms and the businesses that depend on them.

Who is affected?

Directly, a handful of very large companies designated as gatekeepers by the European Commission. Indirectly, the entire ecosystem of businesses and consumers that use their services.

• Designated gatekeepers: heavy obligations and direct oversight by the European Commission.
• Business users (application developers, e-merchants, publishers): new rights of access, portability and fairness.
• Consumers: more choice, interoperability and control over their data.
• Complementary service providers: potential beneficiaries of platform openness.

Gatekeepers' obligations and prohibitions

The DMA reads as a list of "dos" and "don'ts" for gatekeepers.

The rights the DMA grants to businesses

For the majority of companies, the challenge is not compliance but seizing opportunities. The DMA gives them concrete levers against dominant platforms.

• Accessing their performance data (advertising, sales) held by the gatekeeper.
• Benefiting from the portability of their data and that of their customers.
• Using alternative payment systems and distributing outside imposed app stores.
• Being treated fairly and without discrimination in rankings.

What penalties apply in the event of non-compliance?

DMA penalties are among the highest in European law, with the possibility of structural measures in the event of systematic infringements.

How to achieve compliance: the 6-step roadmap

Step 1 — Determine your position

The vast majority of companies are not gatekeepers. First check whether you meet the DMA thresholds (unlikely); if not, identify your role as a business user to activate your rights.

This clarification prevents you from allocating resources to obligations that do not apply to you.

• Assess your turnover, market capitalisation and number of users.
• Identify the core platform services you operate.
• Position yourself: gatekeeper or business user.

Step 2 — If gatekeeper: map your core platform services

List your core platform services and assess each DMA obligation and prohibition against your current practices, service by service.

This mapping is the starting point for your compliance plan and your report to the Commission.

• List your core platform services.
• Assess each practice against the obligations and prohibitions.
• Prioritise the most significant gaps.

Step 3 — If gatekeeper: bring your practices into compliance

Remove self-preferencing practices, open up interoperability and portability, revisit data combination and the conditions imposed on developers.

These changes are far-reaching and often affect the core of the business model.

• Put an end to self-preferencing practices.
• Open up interoperability, portability and third-party payments.
• Revisit data combination across services.

Step 4 — If gatekeeper: document and report

Prepare the compliance report and the measures adopted for submission to the Commission, and keep them up to date as requirements evolve.

Transparency towards the regulator is an ongoing obligation.

• Draft the compliance report.
• Document each measure adopted.
• Keep reporting up to date over time.

Step 5 — If business user: activate your rights

Exercise your rights of access to performance data, portability and fair treatment with gatekeepers. Many companies have yet to leverage these entitlements.

This is a strategic opportunity: better insight into your performance, reduced dependency and greater negotiating leverage.

• Request access to your performance data.
• Leverage the portability of your data.
• Explore third-party payments and alternative distribution channels.

Step 6 — Align with GDPR

Portability and the prohibition on combining data intersect with GDPR: secure consent and legal bases where personal data is involved.

This alignment prevents a GDPR risk from arising when exercising a DMA right.

• Secure the legal bases for data flows.
• Manage consent where it is required.
• Link these flows to your records of processing activities.

Common mistakes to avoid

• Confusing the DMA (competition) with the DSA (content): these are two distinct regulations.
• Believing the DMA only creates constraints: for business users, it opens up real rights.
• Overlooking the interaction between DMA portability and GDPR obligations.
• Ignoring the opportunities (third-party payments, sideloading, data access) offered by the new framework.
• Mobilising resources on gatekeeper obligations when you are not one.
• Failing to document the exercise of your rights vis-à-vis platforms.