DSA notice and action in Cyprus: a platform workflow

Identify the hosting service and the relevant duties

Start with what the service does. Article 16 applies to providers of hosting services, including online platforms that store information supplied by a recipient. Examples can include a marketplace listing, public comment, user profile or uploaded file. A company website publishing only its own editorial content is not automatically a hosting service for this purpose. Document who supplies the information, whether it is stored at that person's request and what the service does with it. A mixed service may have hosted and first-party content in different areas.

Separate the layers of the DSA. Article 16 establishes the notice mechanism and decision process for hosting providers. Article 17 concerns statements of reasons when certain restrictions are imposed on a recipient because content is illegal or incompatible with terms. Article 20 adds an internal complaint system for online platforms, subject to the specific micro and small enterprise rule in Article 19. That size exclusion does not erase Article 16's hosting-service duty. Classify the entity and feature before reusing a generic platform-policy template.

A Cyprus provider serving recipients in the EU should also identify its point of contact and responsible operational team. Cyprus's Digital Services Coordinator is listed by the European Commission as the Radiotelevision and Digital Services Authority, but the practical notice process starts inside the provider. Define who receives a notice outside office hours, who can restrict content and who reviews an appeal. A named workflow reduces both wrongful removals and unexplained delay.

A marketplace's seller-onboarding duties are analysed separately in the DSA trader-traceability guide.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20; European Commission: The Digital Services Act; European Commission: Digital Services Coordinators, including Cyprus

Make the Article 16 notice form usable and precise

The mechanism must be easy to access, user-friendly and permit notices by electronic means. Place a reporting route near the relevant hosted item where practical, with a stable link in help information. Do not require the notifier to become a paying customer or find a legal department email address. Article 16(2) identifies the information the mechanism should enable: a substantiated explanation of alleged illegality, the exact electronic location, notifier name and email subject to a specific exception, and a good-faith accuracy statement. Design prompts that elicit those facts without demanding a legal essay.

An exact URL may identify a web listing, but a video timestamp, listing ID or account identifier may also be needed to locate the specific item. Give a field for context and supporting evidence when relevant. A generic complaint such as 'your site is illegal' may not let a reviewer identify a particular item. Conversely, a form that rejects a valid report because a user lacks a statute citation can obstruct useful notices. Keep the mandatory fields tied to Article 16, and allow an accessible alternative route where the interface itself fails.

Article 16 has a limited exception to the usual notifier name and email information for notices concerning material involving the offences specified in Articles 3 to 7 of Directive 2011/93/EU. Do not make blanket anonymity claims for every notice, or demand identifying details where the exception applies. Protect sensitive reports from broad staff access. Test the form on mobile and with a keyboard, verify that error messages explain missing information, and preserve the exact version of the item reported for later review.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20

Acknowledge, triage and assess without arbitrary decisions

Where the notice includes electronic contact information, Article 16(4) requires confirmation of receipt without undue delay. Generate a case reference and a receipt that identifies the submitted item without repeating sensitive allegations unnecessarily. Route urgent safety threats to an appropriate escalation channel; Article 18 separately addresses suspicion of specified serious crimes involving a threat to life or safety. Acknowledgement is not a decision that the content is illegal, nor a promise of automatic removal. Tell the notifier what step follows.

A sufficiently precise and adequately substantiated notice can give a hosting provider actual knowledge or awareness of a specific item for Article 6 purposes when a diligent provider can identify illegality without a detailed legal examination. This does not mean every accusation automatically proves illegality. Train reviewers to distinguish a complaint about law from a complaint about the platform's own terms, identify the legal or contractual ground considered, and note the evidence. Escalate disputed legal questions rather than forcing moderators to guess.

Article 16(6) requires timely, diligent, non-arbitrary and objective processing. Build a queue that exposes age, category, urgency, assigned reviewer and decision status. Automated tools can help surface duplicates or route cases, but their use in processing or deciding notices must be disclosed in the notice decision communication. Keep human supervision for consequential decisions and sample quality. Avoid an unpublished rule that removes all reported content or ignores every report lacking a preferred keyword.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20; European Commission: The Digital Services Act

Communicate the notice decision to the reporter

Article 16(5) requires the provider, without undue delay, to notify the notifier of the decision about the reported information and the available redress. A meaningful decision says whether the specific item was removed, restricted, left available or referred for another process, and gives an understandable reason within lawful limits. A silent deletion or a message saying only 'case closed' is difficult to review. Keep the item location, legal or terms basis, reviewer and time of decision in the case record.

The notifier and the affected publisher may need different communications. Do not disclose the reporter's identity by default to the person whose content is restricted; Article 17 requires that identity in the statement of reasons only where strictly necessary. If the complaint concerns a product listing, distinguish the seller's Article 30 identity file from the content moderation case. The notice outcome should not expose private onboarding documents or payment details. Align support templates with this separation so staff do not paste the full notice into a seller email.

If the provider decides not to act, explain the material reason, such as insufficient basis to identify a specific violation, and state the relevant challenge route. If it acts, note precisely what happened; disabling an item in one country is different from removing it globally. Maintain evidence of the original item and notice in a controlled record for complaint review and legal obligations. A transparent decision is easier to defend than an unsupported status code, and it helps detect inconsistent moderation across similar cases.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20

Give the affected user an Article 17 statement of reasons

When a hosting provider restricts visibility, monetisation, service or an account because a recipient's information is considered illegal or contrary to terms, Article 17 generally requires a clear and specific statement of reasons to the affected recipient if the provider knows relevant electronic contact details. It should be supplied at the latest when the restriction is imposed. The provision has particular exceptions, including deceptive high-volume commercial content and orders under Article 9. Do not apply those exceptions to every difficult case without checking their conditions.

The statement should identify the restriction, its territorial scope and duration when relevant; the facts and circumstances; whether automation contributed; the legal ground or exact terms provision; why the content falls within it; and available redress. A generic 'violation of community guidelines' notice does not explain why a particular listing or comment was restricted. If the decision followed a notifier report, the notice can say that without unnecessarily identifying the reporter. Keep the public rules version that applied at the time so a later terms update does not rewrite the historical reason.

Review a draft reason from the affected person's perspective. Can they identify the item, understand what conduct is at issue and prepare a meaningful challenge? Use a concise explanation and provide a link to the complaint path where available. Preserve any legal restriction on disclosure, but do not conceal an ordinary moderation decision behind a vague security claim. Test notice delivery after email bounces or account suspension. The Article 17 message is distinct from the Article 16 decision sent to the notifier.

Where the underlying complaint is about a physical product listing, consult the product-safety listing guide for the separate product information and safety issues.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20

Check whether the Article 20 complaint system applies

Article 20 adds an effective internal complaint system for online platforms. Eligible notifiers and affected recipients must be able to challenge specified decisions electronically, free of charge, for at least six months after they are informed of the decision. Covered decisions include whether content is removed or left available, service or account restrictions, and restrictions on monetisation. Design the complaint link into both sides' decision communications. Preserve the decision timestamp because it starts the minimum period for access to this challenge route.

Article 19 excludes qualifying micro and small online-platform providers from most obligations in this additional platform section, including Article 20, subject to its conditions and the very-large-platform exception. Confirm provider size using Recommendation 2003/361/EC; do not confuse it with the size of an individual trader or assume that a small operator has no Article 16 duties. A platform may voluntarily offer an internal challenge route even if Article 20 is not mandatory. Describe the legal position and the voluntary service separately.

For a platform subject to Article 20, complaints must be handled in a timely, non-discriminatory, diligent and non-arbitrary way. If the complaint provides sufficient grounds showing the earlier decision was unfounded, reverse it without undue delay. Inform the complainant of the reasoned outcome and the out-of-court settlement route and other redress. Decisions under Article 20 must be supervised by appropriately qualified staff and cannot be taken solely by automated means. Document the reviewer and any restored listing or account.

This content-decision complaint path is separate from the consumer dispute information after the EU ODR platform closure.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20; Commission Recommendation 2003/361/EC on SME definitions

Keep evidence and test the whole moderation path

For each case, preserve the received notice, exact item reference, relevant snapshot, category, legal or terms ground, acknowledgement, decision, communications, automation use, reviewer and complaint outcome. Set access and retention rules based on the nature of the record and applicable law; reports may contain sensitive allegations or personal information. A case ID should let the team reconstruct the decision without making the information broadly searchable inside the company. Use aggregate data to identify repeated errors and training needs, not to build unexamined profiles of reporters.

Run end-to-end tests: a well-substantiated illegal-content notice, an incomplete notice, a false-positive report, an item violating only terms, a decision to leave content available and a successful appeal. Confirm that the reporter receives acknowledgement and decision, the affected recipient receives an appropriate reason for any restriction, and both receive correct redress information when applicable. Check that a suspended account can still reach its reason and challenge route. Test localisation and accessibility of the reporting interface on mobile.

Do not conflate notice and action with a universal obligation to monitor everything users post. The DSA distinguishes targeted notices and voluntary own-initiative action from general monitoring. A practical policy should explain the categories the provider reviews and the grounds it uses, while leaving room for individual judgment. Periodically compare similar cases for consistency and verify that automated routing has not silently changed the decision standard. Store the version of terms and moderation guidance that reviewers used.

Because notice records may contain personal data, apply a documented retention approach like the GDPR retention-schedule workflow.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20; European Commission: The Digital Services Act

Turn the law into a release checklist

First, document whether each feature is hosting and whether it also qualifies as an online platform. Then identify the required Article 16 entry points and the Article 17 reason template; assess Article 20 scope separately. Map the old report button to the exact information Article 16 expects. An operational owner should receive each notice and a legal or policy owner should approve uncertain grounds. Build urgent escalation only for truly urgent categories and avoid making it the normal route for every complaint.

Next, implement event-driven records: submission, acknowledgement, triage, decision, notifications, restriction and appeal. Test that timestamps and status changes are consistent if the content is deleted or an account is disabled mid-case. Ensure a case remains reviewable by appropriately qualified staff and that public reporting forms do not reveal internal moderation notes. Create clear user-facing language in the languages supported by the service. A production test should verify email delivery and the precise links supplied to both the notifier and the affected user.

Finally, review cases after launch. Track median time to decision, reversals, inaccessible reporting paths and templates that fail to explain the legal or contractual basis. Use that evidence to improve the policy and staff training. The goal is a defensible, user-understandable process, not automatic removal of every reported item. When platform features or legal obligations change, update the scope memo and the test suite before relying on last year's moderation workflow.

Basis and guidance: Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20; European Commission: The Digital Services Act; European Commission: Digital Services Coordinators, including Cyprus

Primary sources and scope

Sources checked: October 7, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) 2022/2065, Digital Services Act, Articles 16, 17, 19 and 20
• European Commission: The Digital Services Act
• European Commission: Digital Services Coordinators, including Cyprus
• Commission Recommendation 2003/361/EC on SME definitions