---
title: "EU Digital Services Act: What It Means for Hosting"
description: "The DSA for hosting providers: liability, no general monitoring, notice and action, statements of reasons, orders, and how it differs from the DMCA."
url: https://offshoreserv.com/blog/digital-services-act-hosting
lang: en
updated: 2026-09-26
source: HTML page at the url above (canonical); this is its Markdown version
---

[Law & jurisdictions](https://offshoreserv.com/blog/category/law-jurisdictions)

# The EU Digital Services Act: what it means for hosting

The EU's Digital Services Act sets the rules for hosting providers in every member state. What it requires, article by article, how it compares with the US DMCA and where it applies to our servers.

26 September 2026 9 min read By the OffshoreServ team

Key takeaways

- The DSA, Regulation (EU) 2022/2065, has applied to all intermediary services since 17 February 2024.
- Hosts are not liable for content they do not know about if they act expeditiously once they learn of illegal content, and no general monitoring duty can be imposed (Articles 6 and 8).
- A notice gives a host actual knowledge only if a diligent host can see the illegality without a detailed legal examination (Article 16).
- Among our locations, the DSA applies in the Netherlands, Romania and Bulgaria.

The Digital Services Act is the EU regulation that sets the rules for hosting providers in every member state. For hosting, it does four things: it keeps a conditional liability exemption, bans general monitoring duties, requires a notice-and-action mechanism with reasons for restrictions, and sets conditions for orders from courts and authorities.

This guide takes the Digital Services Act hosting rules article by article, from the regulation's own text. For offshore hosting, the DSA is the main limit on a [DMCA-ignored hosting](https://offshoreserv.com/dmca-ignored-hosting) promise inside the EU.

> This guide summarizes the regulation's text. It is not legal advice, and each member state adds rules of its own.

## The Digital Services Act in one paragraph

[Regulation (EU) 2022/2065](https://eur-lex.europa.eu/eli/reg/2022/2065/oj) was adopted on 19 October 2022 and has applied in full since 17 February 2024 (Article 93). It is directly applicable in every member state and replaced the intermediary liability rules of the 2000 e-Commerce Directive (Article 89). It does not decide what is illegal: "illegal content" is information that breaks EU law or the law of a member state (Article 3 (h)), and EU copyright law applies alongside it (Article 2 (4)).

The duties come in layers: some for all intermediaries (Articles 11 to 15), more for hosting services (Articles 16 to 18) and more again for online platforms, which disseminate content to the public (Articles 19 to 28). Recital 29 names cloud computing and web hosting as hosting services, so server hosting normally sits in the middle layer. Each member state designates a Digital Services Coordinator (Article 49), and fines can reach 6% of annual worldwide turnover (Article 52).

## Where Digital Services Act hosting rules apply on our servers

Among our seven locations, the DSA applies directly in the three EU member states:

| Location | DSA | What else applies |
| --- | --- | --- |
| [Netherlands](https://offshoreserv.com/locations/netherlands) | Applies; coordinator: ACM | Dutch courts; prosecutor's orders under Article 125p |
| [Romania](https://offshoreserv.com/locations/romania) | Applies; coordinator: ANCOM | Romanian courts; authority orders under Law No. 50/2024 |
| [Bulgaria](https://offshoreserv.com/locations/bulgaria) | Applies; coordinator: Communications Regulation Commission | Bulgarian courts |
| [Iceland](https://offshoreserv.com/locations/iceland) | Not yet: EEA member, DSA [under scrutiny](https://www.efta.int/eea-lex/32022r2065) for incorporation | Act No. 30/2002 copyright notices; Icelandic courts |
| Switzerland | No | Swiss courts |
| Moldova | No; EU candidate | Moldovan courts; Law No. 20/2009 removal orders |
| Malaysia | No | Malaysian courts; section 43H copyright notices |

One nuance: the DSA's scope follows users, not machines. It covers intermediary services offered to recipients established or located in the EU, "irrespective of where the providers of those intermediary services have their place of establishment" (Article 2 (1)). If you run a platform for people in the EU, it can apply to you as the operator wherever your server is. Our complaint process follows the server: DSA notice and action in our EU locations, local law elsewhere.

## Hosting liability and no general monitoring

Article 6 keeps the hosting exemption. A host is not liable for information stored at a customer's request if it "does not have actual knowledge of illegal activity or illegal content" (and, for damages claims, is not aware of facts that make it apparent), or if, on obtaining such knowledge, it "acts expeditiously to remove or to disable access to the illegal content".

The exemption does not cover customers acting under the host's authority or control (Article 6 (2)), and it does not stop a court or authority from requiring a host to end or prevent an infringement (Article 6 (4)). Losing it does not by itself make a host liable: recital 17 leaves liability to other EU or national law.

Article 8 bars any "general obligation to monitor the information which providers of intermediary services transmit or store", or to actively seek facts indicating illegal activity. A host that checks content voluntarily, in good faith and diligently, keeps its exemption (Article 7). The DMCA has a comparable rule in [17 U.S.C. 512(m)](https://www.law.cornell.edu/uscode/text/17/512).

## DSA notice and action: what a valid notice contains

DSA Article 16 requires every hosting provider to run a notice mechanism that is "easy to access and user-friendly" and lets anyone submit notices "exclusively by electronic means". It must make it easy to include four elements:

1. a sufficiently substantiated explanation of why the information is illegal content;
2. "the exact electronic location of that information, such as the exact URL or URLs";
3. the sender's name and email address, except for notices about child sexual abuse offenses;
4. a statement of the sender's "bona fide belief" that the notice is accurate and complete.

A notice gives the host actual knowledge only where it allows "a diligent provider of hosting services to identify the illegality of the relevant activity or information without a detailed legal examination" (Article 16 (3)). A precise notice about plainly illegal content does that; a disputed copyright claim that turns on licenses or exceptions may not. That is why a notice is not an automatic takedown order.

The host confirms receipt without undue delay if the sender left electronic contact details, decides "in a timely, diligent, non-arbitrary and objective manner", and tells the sender its decision and the options for redress (Article 16 (4) to (6)). There is no deadline in hours. Trusted flaggers (Article 22) and the suspension of people who keep sending manifestly unfounded notices (Article 23) concern online platforms only.

## Statement of reasons (Article 17)

When a host restricts a customer because content is illegal or breaches its terms, it owes that customer "a clear and specific statement of reasons" from the moment the restriction applies, if it has the customer's electronic contact details. That covers removing, disabling or demoting content, stopping payments, suspending or ending the service, and suspending or closing an account. The statement must give:

- the decision, its territorial scope and its duration;
- the facts relied on, including whether a notice or the host's own investigation led to it;
- whether automated means were used;
- the legal or contractual ground, and why the content falls under it;
- the options for redress.

For hosting customers, redress mostly means the courts: internal complaint systems and certified out-of-court bodies are duties of online platforms (Articles 20 and 21). Orders under Article 9 follow their own rules instead (Article 17 (5)).

## Orders from authorities (Articles 9 and 10)

Article 9 creates no new powers (recital 31). It sets minimum conditions for orders that national judicial or administrative authorities issue "on the basis of the applicable Union law or national law in compliance with Union law". An order must cite its legal basis, explain why the content is illegal by reference to specific provisions, identify the authority, locate the content, "such as one or more exact URL", and describe the redress available. Its territorial scope must be limited to what is strictly necessary.

The host tells the authority without undue delay whether and when it complied, and tells the customer at the latest when it complies, or at the time the order sets, with reasons and redress options (Article 9 (5)). Article 10 applies the same model to orders for information about specific recipients, which can only reach information "already collected for the purposes of providing the service and which lies within its control".

National law decides who may issue orders. In Romania, Law No. 50/2024 lets sector regulators and judicial authorities do so; ANCOM recorded four removal orders and two information orders in 2024. Terrorist content can also be ordered offline within one hour under Regulation (EU) 2021/784.

## Suspected criminal offenses (Article 18)

A host that becomes aware of information "giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place" must promptly inform the law enforcement or judicial authorities of the member state concerned. If it cannot identify that state, it informs the authorities where it or its legal representative is established, or Europol, or both.

The scope is narrow: threats to life or safety, not every offense and not copyright claims. Separately, our own rules remove child sexual abuse material at once and report it to the competent authorities in every location.

## DSA vs DMCA: how the two systems compare

Both tie a host's protection to what it knows, but differ in the details:

|  | EU Digital Services Act | US DMCA (17 U.S.C. 512) |
| --- | --- | --- |
| Origin | EU regulation of 2022, directly applicable in every member state | US federal statute of 1998 |
| Scope | Any content illegal under EU or member-state law | Copyright infringement only |
| What a notice must contain | Reasons, exact location, sender's name and email address, good-faith statement | Signature, the work, the material and its location, contact details, good-faith statement, accuracy statement, and a statement under penalty of perjury that the sender is authorized |
| Effect of a valid notice | Actual knowledge if the illegality is clear without a detailed legal examination; the host decides | The host must remove the material expeditiously to keep its safe harbor |
| Counter-notice and redress | No counter-notice procedure for hosts; statement of reasons; courts | Formal counter-notice; material restored after 10 to 14 business days unless the sender sues |
| Who decides | The host, then courts and authorities | The host follows the procedure; courts decide the merits if anyone sues |
| Applies to our servers in | The Netherlands, Romania and Bulgaria | None of our seven locations |

So a DMCA notice sent to a server in Amsterdam does not become a DSA notice by arriving there. It counts as one only if it contains the Article 16 elements and concerns content that is illegal under EU or Dutch law. Our guide to [DMCA-ignored countries](https://offshoreserv.com/blog/dmca-ignored-countries) explains what our other locations apply instead.

## How we handle Digital Services Act hosting notices

1. Every complaint about a server in the Netherlands, Romania or Bulgaria is logged and checked against EU and national law.
2. Citing the US DMCA changes nothing. What matters is whether a notice meets Article 16 and concerns illegal content: one that does is assessed on its merits, whoever sends it, and one that does not is handled as a foreign notice under our [DMCA and complaints policy](https://offshoreserv.com/dmca-policy).
3. A valid court order, an Article 9 order or a notice that meets Article 16 can require action. The customer is informed first and can respond, unless a court forbids it; when a matter is not urgent or sealed, we normally allow 5 business days. A restriction comes with a statement of reasons.
4. Requests and outcomes are counted, without customer data, in our quarterly [transparency report](https://offshoreserv.com/transparency-report), which has a category for DSA notices.

## Frequently asked questions

### Does the Digital Services Act apply to hosting providers?

Yes. Hosting is one of the three intermediary services the DSA covers, with mere conduit and caching. The core DSA hosting provider obligations are a notice-and-action mechanism, statements of reasons, handling valid orders and reporting threats to life or safety; separately, hosts keep a conditional liability exemption. Online platforms and the largest services carry extra duties.

### What is notice and action under the DSA?

It is the procedure in Article 16. Anyone can notify a host of content they consider illegal, giving reasons, the exact URL, their name and email address and a good-faith statement. A notice that lets a diligent host see the illegality without a detailed legal examination gives it actual knowledge, and the host must then decide in a timely, diligent and objective way.

### Is the DSA the same as the DMCA?

No. The DMCA is a US law about copyright only, with a fixed takedown and counter-notice routine. The DSA is an EU regulation covering all illegal content, and it leaves the decision to the host, subject to a statement of reasons and the courts. A DMCA notice has no force under the DSA unless it also meets Article 16.

### Does the DSA apply to servers outside the EU?

Not as local law. The DSA is not part of Swiss, Moldovan or Malaysian law, and not yet part of Icelandic law. Its scope follows users, though: Article 2 (1) covers services offered to people in the EU wherever the provider is established, so an EU-facing platform can fall under it even on a server outside the EU.

### Do hosts have to monitor content under the DSA?

No. Article 8 forbids imposing a general obligation to monitor stored information or to actively seek facts indicating illegal activity. Hosts must act on specific notices and orders instead. A host may still check content voluntarily without losing its liability exemption, provided it acts in good faith and diligently (Article 7).

**Host it where the law is on your side.**

Offshore VPS, dedicated, RDP and GPU servers in seven jurisdictions. No KYC, paid in crypto.

## More from the blog.

- [Law & jurisdictions 5, 9 and 14 Eyes countries: what they mean for hosting Which countries are in the Five, Nine and 14 Eyes, what is official and what was leaked, and what membership really means for a server in each of our seven locations.26 September 2026 8 min read](https://offshoreserv.com/blog/14-eyes-countries-hosting)
- [Law & jurisdictions DMCA-ignored countries in 2026: what "ignored" really means The DMCA stops at the US border, so every other country ignores it in a sense. Here is what decides takedowns instead, country by country, and what still reaches a server anywhere.26 September 2026 10 min read](https://offshoreserv.com/blog/dmca-ignored-countries)
- [Law & jurisdictions DMCA-ignored hosting explained: what it means in 2026 US takedown notices have no legal force outside the United States, but DMCA-ignored does not mean copyright law stops applying. Here is what the label really covers in 2026.26 September 2026 9 min read](https://offshoreserv.com/blog/dmca-ignored-hosting-explained)

---

OffshoreServ is an offshore hosting provider: VPS, dedicated servers, Windows RDP and GPU servers in seven jurisdictions (Iceland, Switzerland, Moldova, Romania, the Netherlands, Bulgaria and Malaysia), paid only in cryptocurrency (Bitcoin, Ethereum, Monero, Tether (USDT) and Solana), with no identity checks (no KYC).

Prices and plans: https://offshoreserv.com/pricing · Answers: https://offshoreserv.com/faq · Every page: https://offshoreserv.com/llms.txt