Data protection & GDPR compliance in Belgium (2026)

Yes. As an EU/EEA member, Belgium applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Data Protection Authority (Gegevensbeschermingsautoriteit / APD).

The Data Protection Authority (Gegevensbeschermingsautoriteit / APD).

Up to €20 million or 4% of global annual turnover, whichever is higher.

A DPO is required where you carry out large-scale monitoring or process special-category data at scale.

Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.

The Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (published in the Belgian Official Gazette on 5 September 2018) supplements the GDPR where national law is required, and transposes Directive (EU) 2016/680 for police/criminal-justice processing. It replaced the Privacy Act of 8 December 1992.

The Belgian Data Protection Authority (APD/GBA), established by the Act of 3 December 2017, succeeded the former Commission for the Protection of Privacy on 25 May 2018. It is organized around an Executive Committee plus five operational bodies (General Secretariat, First-Line Service, Knowledge Centre, Inspection Service, and Litigation Chamber), headquartered in Brussels.

The Acts of 7 September 2023 and 25 December 2023 amended the 3 December 2017 DPA Act to strengthen the authority's independence and operational capacity, reform its internal composition, and — following a Belgian Constitutional Court ruling — allow interested third parties to challenge Litigation Chamber decisions.

The APD/GBA wields the full Article 58 GDPR toolkit — warnings, orders, temporary or definitive processing bans, and administrative fines up to €20 million or 4% of worldwide annual turnover (Art. 83 GDPR) — plus periodic penalty payments under Belgian law. A notable domestic limitation is that administrative fines generally cannot be imposed on public-sector bodies except where they offer goods/services on the open market.

The APD/GBA's Strategic Plan 2026-2028 targets two priority themes: (i) large-scale high-risk processing — explicitly including advertising technology, cross-border sharing among data brokers, profiling in banking/insurance, health data at hospitals, and tax-authority databases; and (ii) processing of minors' data, backed by specialised DPIA templates. The DPA is also restructuring complaint-handling toward mediation and selective investigation.

The 2018 Framework Act applies to controllers and processors established in Belgium (regardless of where actual processing occurs), and to non-EU controllers/processors that offer goods or services to individuals in Belgium or monitor their behaviour in Belgium, mirroring the GDPR's Article 3 extra-territorial reach.