Belgium. Comprehensive data protection. Act
Belgian Data Protection Law 2018Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Partly verified
Medium confidence.ELI numac for the 2018 law not independently fetched.
§1Summary
- Synopsis
Belgium's framework law adapts the GDPR nationally, transposes the Law Enforcement Directive and contains derogations for journalism, research and the intelligence services. The DPA itself is organised by the separate law of 3 December 2017.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 13. Criminal offences for certain breaches; public bodies cannot receive administrative fines; specific rules on genetic, biometric and health data requiring an extra list of persons with access.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; criminal fines under Title 6; no administrative fines on public authorities
§3Dates
- Key dates
- Adopted
- In force
- Supervisory authority created separately by Law of 3 December 2017 establishing the Data Protection Authority
§4Text and authority
- Text
- Authoritative text ejustice.just.fgov.be
- English text dataprotectionauthority.be
- Authority
- Autorité de protection des données / Gegevensbeschermingsautoriteit (APD-GBA)
§5Where it applies
- Domestic law of
- Belgium
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.ELI numac for the 2018 law not independently fetched.