Belgium Data Protection & Privacy Regulation

Lawful Processing & Special Data

The APD/GBA is understood to apply an exceptionally strict reading of Article 6 GDPR, requiring controllers to clearly choose, document and evidence application of their chosen lawful basis for processing. This supervisory-interpretation posture is reported at a Probable confidence level, resting on a single lower-tier source, and should be read as an indication of the regulator's general orientation rather than a confirmed, citable standard.

The concrete, confirmed development this cycle sits in the consent space: the APD/GBA published Recommendation 01/2026 on direct marketing, which replaces and supersedes the regulator's February 2020 recommendation on the same subject. The new recommendation clarifies the conditions for valid consent, the circumstances requiring consent renewal, and how profiling and automated decision-making should be treated when used in a direct-marketing context. This is a binding guidance instrument, in force from early 2026, and represents the DPA's most concrete lawful-processing-adjacent output this cycle.

Outlook

The practical application of Recommendation 01/2026 -- particularly how the DPA treats consent-renewal timing and profiling-related marketing practices in any subsequent enforcement activity -- is the item to watch. Whether the reported strict-reading posture toward Article 6 generally is corroborated by a primary-source APD/GBA statement in a future cycle would also strengthen that finding's confidence tier.

Controller/Processor Duties

Belgium's controller and processor accountability expectations are tightening this cycle, driven primarily by the APD/GBA's 2026-2028 Strategic Plan, which shifts the regulator's posture from individual complaint response toward proactive, sector-targeted Systemic Impact Enforcement audits in healthcare, finance and minors' data processing. This is a confirmed strategic reorientation, though it remains a plan rather than a binding legal instrument, and its accountability implications for controllers will depend on how the named audits are actually scoped and conducted.

Notably, this tightening in stated regulatory ambition coincides with a decline in reported breach-notification volume: the APD/GBA received 1,216 data breach notifications in 2025, down from 1,455 in 2024. This is a genuine divergence worth stating plainly rather than smoothing over: rising proactive-enforcement ambition and falling breach-notification volume are not contradictory on their face, but they do mean that any assessment of Belgium's controller-duty compliance environment cannot rely on breach-notification trends alone as a proxy for overall accountability performance.

Outlook

The key items to watch are whether the Strategic Plan's proactive audits surface accountability or DPIA-adequacy gaps that breach-notification data alone would not have revealed, and whether the declining breach-notification trend continues or reverses as the DPA's supervisory attention increases under the new plan.

Controller/Processor Duties

The Belgian Market Court has confirmed that IAB Europe acts as joint data controller for the processing of user preferences via the TC String within its Transparency and Consent Framework. This confirmed, in-force ruling settles a question central to how consent-management infrastructure providers are characterised under Belgian and EU data protection law: an entity that operates the technical mechanism for recording and transmitting consent signals can itself be held to be a joint controller of the personal data processed through that mechanism, alongside the businesses that rely on it.

This controller characterisation compounds the APD's broader strategic direction toward demonstrable accountability. The APD's 2026-2028 Strategic Plan is understood to demand demonstrable accountability logs from controllers and processors as part of its proactive Systemic Impact Enforcement approach, meaning organisations relying on shared consent-management infrastructure of the kind at issue in the IAB Europe proceedings should expect scrutiny of how joint-controller responsibilities are documented and evidenced, not merely asserted.

Outlook

The joint-controller finding's practical consequences will become clearer once the APD completes its required re-validation of IAB Europe's corrective action plan following the Market Court's annulment of the prior validation. Organisations using the Transparency and Consent Framework, or comparable shared consent-management infrastructure, should watch for how the re-validated plan allocates joint-controller obligations in practice.

Cross-Border & Adequacy

The Belgian Market Court referred thirteen preliminary questions to the Court of Justice of the European Union concerning the material scope of GDPR Article 96 and the framework governing third-country transfers, following the APD Litigation Chamber's Decision 79/2025 finding that FPS Finance's FATCA-related transfers of personal data to the United States were unlawful. This is a confirmed, in-force development of high materiality: it places directly before the CJEU the question of how the GDPR's transfer framework interacts with pre-existing international agreements concluded before the Regulation's entry into force, of which FATCA, the US Foreign Account Tax Compliance Act cooperation framework, is a prominent example.

The stakes of this referral extend well beyond the specific FATCA context. A CJEU ruling clarifying Article 96's scope would have implications for any pre-GDPR international agreement involving cross-border transfers of personal data from Belgium, and by extension from other member states facing comparable disputes, to third countries. Until the CJEU rules, the practical transfer framework for FATCA-related and comparable pre-GDPR-agreement transfers from Belgium remains unsettled.

Outlook

The CJEU's ruling on the Market Court's thirteen preliminary questions is the central item to watch in this domain, though it is not expected imminently given the scale and complexity of the referral. In the interim, entities relying on pre-GDPR international agreements for cross-border transfers from Belgium should treat the underlying legal basis as contested rather than settled.

Sectoral Watch

The EU Data Act is the dominant sectoral item for Belgium this cycle. The Regulation's general application began 12 September 2025, and from 12 September 2026 the obligation to design connected products for direct user access to generated data by default applies to products placed on the market after that date. This is a directly applicable EU Regulation that does not require national transposition to take legal effect on manufacturers, but Belgium's national implementing law — which would designate the competent authority and set out procedural powers and sanctions for domestic enforcement — remains in draft. The Belgian Council of Ministers approved that draft law on 27 March 2026 and it was transmitted to the other institutions involved in the legislative process, but it had not been enacted as of this cycle. BIPT is proposed, though not yet statutorily confirmed, as the national competent authority under that draft.

A second sectoral instrument worth noting for continuity is Article 129 of the Belgian Law of 13 June 2005 on electronic communications, which transposes the ePrivacy Directive's Article 5(3) strict opt-in requirement for non-essential cookies. This is a standing instrument, jointly enforced by the APD (on the data-protection angle) and BIPT (on the telecom angle), and no change to this instrument was located this cycle; it is noted here because BIPT's co-enforcement role under Article 129 is the same authority under consideration for the Data Act's competent-authority designation, meaning BIPT's institutional capacity is being stretched across two sectoral enforcement roles as the Data Act implementing law proceeds.

Outlook

The approaching 12 September 2026 access-by-design commencement date is the operative deadline to track, since it applies regardless of whether Belgium's national implementing law has been enacted by then — the Data Act itself is directly applicable. Whether the Belgian implementing law passes the remaining legislative institutions before or after that date, and whether BIPT is formally confirmed as competent authority in that process, are the two concrete items that would resolve the current gap between EU-level applicability and Belgian domestic enforcement capacity.

Sectoral Watch

The APD/GBA's 2026-2028 Strategic Plan designates healthcare and finance as tailored priority-workflow sectors for large-scale profiling and health-data audits. This sectoral designation is assessed as probable, resting on the Strategic Plan's own stated priorities as reported by secondary sources, rather than on a confirmed primary-source audit programme document. The designation nonetheless represents a meaningful signal for entities in either sector: it indicates that generic, complaint-driven regulatory attention is being supplemented, and in the plan's stated intent partially superseded, by sector-specific proactive audit activity.

No further sector-specific instrument, guidance, or audit finding beyond this Strategic Plan designation was located this cycle. The designation should therefore be read as a forward-looking prioritisation signal rather than an account of any completed or in-progress sectoral audit.

Outlook

Whether the Strategic Plan's healthcare and finance prioritisation translates into a published audit programme, timeline, or set of sector-specific guidance documents in the coming cycles is the principal item to watch. Any concrete healthcare or finance audit finding arising from this prioritisation would represent a material escalation from the current planning-stage signal.

AdTech & Commercial Privacy

The European Data Protection Board's Binding Decision 1/2026 is the most consequential AdTech-adjacent development in Belgium this period, even though the Board itself is a supranational body rather than the Belgian regulator. The decision, adopted 28 May 2026 and published 14 July 2026, addressed a complaint brought by privacy advocacy group NOYB against public broadcaster VRT concerning its cookie-banner consent practices. The Belgian data protection authority had dismissed the underlying complaint, characterising it as an abuse of the right to complain under Articles 77 and 80(1) of the General Data Protection Regulation. The Board rejected that characterisation and ordered the Belgian authority, in its capacity as lead supervisory authority for the matter, to assess the complaint on its merits and to submit a new draft decision under the cooperation mechanism set out in Article 60(3) of the Regulation. The Belgian authority issued an information notice on 13 July 2026 confirming that it is bound by this order.

The practical significance for commercial AdTech practice in Belgium is that the substantive question underlying the original complaint, namely whether VRT's cookie-banner consent architecture met the Regulation's standards for valid consent, remains to be answered by the Belgian authority rather than having been resolved by the original dismissal. Organisations relying on cookie-consent mechanisms modelled on, or similar to, the practices originally complained of should treat the matter as open pending the Belgian authority's forthcoming merits-stage decision, rather than treating the original dismissal as having settled the question.

Outlook

The Belgian authority's merits-stage draft decision on the VRT complaint, required under the European Board's binding order, is the key document to watch. Its content will likely provide the clearest recent guidance from the Belgian regulator on what cookie-consent practices it considers compliant with the General Data Protection Regulation's consent standard, and may have broader relevance for other Belgian organisations operating comparable consent-banner architecture.

AdTech & Commercial Privacy

The Belgian Data Protection Authority's Settlement Decision 163/2026, dated 16 July 2026, imposed a EUR5,000 fine on a company found to operate a non-compliant and overly complex direct-marketing unsubscribe mechanism. Alongside the fine, the decision carried a thirty-day correction order requiring the company to bring its unsubscribe process into compliance. This decision is reported through a secondary source citing the settlement rather than through a directly retrieved APD publication, so the specific procedural detail beyond the fine amount and correction period should be read with that sourcing context in mind.

The decision is a concrete, dated example of the APD's continuing enforcement attention toward the mechanics of direct-marketing opt-out processes, an area within AdTech and Commercial Privacy that often escapes the more visible, higher-value fines associated with cross-border data transfer or special-category data processing. A fine of this size, paired with a short correction window, signals that the APD treats unsubscribe-mechanism complexity as a compliance failure worth a formal settlement decision, even where the financial penalty itself is modest relative to GDPR's maximum fining tiers.

Outlook

No further direct-marketing or commercial-privacy enforcement development beyond the July 2026 settlement was identified this cycle. The correction order attached to Settlement Decision 163/2026 implies a compliance deadline roughly thirty days after the 16 July 2026 decision date, which would mark the point at which the fined company's unsubscribe mechanism should have been brought into line with the APD's expectations.

AdTech & Commercial Privacy

The APD/GBA published Recommendation 01/2026 on direct marketing this cycle, replacing and superseding its February 2020 recommendation on the same subject. The new recommendation clarifies the conditions for valid consent in a direct-marketing context, the circumstances under which consent must be renewed, and how profiling and automated decision-making should be treated when deployed for marketing purposes. It also addresses the use of existing customers' contact details under a "soft opt-in" approach, providing updated guidance on when marketing to an existing customer base can proceed without fresh, explicit consent.

This is a confirmed, binding guidance instrument, in force from early 2026, and represents the most concrete and directly on-point commercial-privacy development this cycle. It supersedes six years of standing guidance under the 2020 recommendation, meaning organisations relying on the prior framework's specific consent-renewal or soft-opt-in thresholds should reassess their marketing-consent practices against the updated 2026 text.

Outlook

The practical enforcement application of Recommendation 01/2026 -- particularly whether the APD/GBA brings any enforcement action explicitly citing the new recommendation's profiling or consent-renewal provisions -- is the item to watch in the coming cycles.

AdTech & Commercial Privacy

On 7 January 2026 the Belgian Market Court annulled the APD's January 2023 decision validating IAB Europe's Transparency and Consent Framework corrective action plan. Critically, the annulment did not disturb the underlying February 2022 finding that TC-String processing breaches the GDPR; the Market Court's ruling concerned only the adequacy of the APD's validation of the corrective action plan meant to remedy that underlying breach, requiring the APD to redo its validation with a narrower scope after a formal hearing.

This sits alongside the Market Court's separate confirmation that IAB Europe acts as joint data controller for TC String processing, reinforcing rather than undermining the substantive finding of GDPR non-compliance in the Transparency and Consent Framework's operation. Taken together, these developments indicate that while the mechanics of remedying the underlying breach remain procedurally unresolved, the underlying characterisation of the breach itself, and of IAB Europe's controller status, has been judicially confirmed rather than called into question.

Outlook

The APD's re-issued validation decision for the corrective action plan, expected following the required formal hearing, is the key item to watch. Its narrower scope, as directed by the Market Court, should clarify precisely what remedial measures the APD now considers sufficient to bring the Transparency and Consent Framework into compliance, which will be directly relevant to any organisation relying on that framework for advertising consent management.

Algorithmic, Biometric & Surveillance Governance

Belgium missed the EU AI Act's Article 70 deadline of 2 August 2025 to designate national competent authorities and market-surveillance authorities for the Regulation. As of this cycle, BIPT is the authority proposed under a federal cooperation agreement to take the lead role, but that designation has not been given statutory force. A representative of FOD Economie, Etienne Mignolet, confirmed that the reading of a legal vacuum is correct: from 2 August 2026, the rights created by the AI Act in Belgium can only be enforced through the courts, since no administrative enforcement authority has been formally designated to exercise the Regulation's market-surveillance and enforcement powers domestically.

This is the most consequential regulatory-gap finding of this cycle for Belgium: a confirmed, dated administrative enforcement vacuum for the AI Act, distinct from and outside the scope of GDPR enforcement (which continues under the APD/GBA regardless) or any financial-sector-specific carve-out that might otherwise provide a supervisory backstop. The gap is specifically about who has administrative power to enforce the AI Act's substantive obligations in Belgium, not about whether those obligations exist; the AI Act's substantive provisions remain legally in force, but a person seeking to vindicate rights under it in Belgium must currently proceed through the courts rather than through a dedicated regulator.

Outlook

The open question is whether and when Belgium formally designates BIPT, or another authority, with statutory enforcement powers under the AI Act, closing the gap FOD Economie has confirmed exists as of 2 August 2026. No legislative timetable for that designation was located this cycle. Until a designation is enacted, the court-only enforcement route identified by FOD Economie remains the operative mechanism for AI Act rights in Belgium.

Children & Vulnerable Groups

The APD/GBA's 2026-2028 Strategic Plan names minors' data processing as a priority area, with specialised Data Protection Impact Assessment (DPIA) templates for minors' data reportedly planned. This is assessed as probable rather than confirmed: the Strategic Plan's stated prioritisation is reported via secondary sources, and no primary-source publication of the planned specialised DPIA templates themselves was located this cycle. The distinction matters -- a stated intent to develop specialised templates is a different, and less binding, development than the templates' actual publication and entry into use.

No further children-and-vulnerable-groups-specific instrument, enforcement action, or guidance document was identified this cycle beyond this Strategic Plan prioritisation signal.

Outlook

Whether the planned specialised DPIA templates for minors' data are actually published, and what specific assessment criteria they introduce, is the key item to watch in coming cycles. Publication would represent a material escalation from the current planning-stage signal to a binding or quasi-binding compliance instrument.

Enforcement & Redress

Belgium's enforcement and redress landscape this period is dominated by the European Data Protection Board's binding intervention into the Belgian data protection authority's own complaint-handling practice. Binding Decision 1/2026, adopted 28 May 2026 and published 14 July 2026, found that the Belgian authority had wrongly dismissed a NOYB-led complaint against VRT over cookie-banner practices as an abuse of the right to complain under Articles 77 and 80(1) of the General Data Protection Regulation. The Board ordered the Belgian authority, as lead supervisory authority, to assess the complaint on its merits and to produce a new draft decision under the Article 60(3) cooperation mechanism. An information notice from the Belgian authority dated 13 July 2026 confirmed this obligation. This is a notable instance of the European-level dispute-resolution architecture being used to correct a national authority's procedural handling of a complaint, rather than its substantive privacy findings, and the Belgian authority's own merits decision remains the open item.

Separately, and on a smaller scale, the Belgian authority fined a law firm EUR 4,920 on 8 May 2026 for insufficiently fulfilling a data-subject access request: the firm had charged a fee on an unsubstantiated manifestly-unfounded-or-excessive claim and lacked a privacy policy. This is a routine enforcement action by comparison with the VRT matter, but it confirms the authority continues to issue fines for access-right process failures at the smaller end of its enforcement activity, alongside the larger procedural matter working through the European cooperation mechanism.

Outlook

The Belgian authority's forthcoming merits-stage decision on the VRT cookie-banner complaint is the clearest and most consequential item to watch in Belgian data protection enforcement; it will be the authority's first opportunity to state its substantive view on the underlying consent-architecture question since the European Board's order. No further procedural development is expected in the law firm access-rights matter, which appears closed.

Enforcement & Redress

The APD/GBA's 2026-2028 Strategic Plan sets out a shift in enforcement posture described as a move from individual complaint-handling toward what the authority terms Systemic Impact Enforcement. Under this approach, smaller disputes are directed into a mediation-first track, but companies that do not engage constructively in that mediation can expect a fast-track escalation directly into formal enforcement. This is a procedural posture change rather than a change to the underlying statutory powers or fine levels the APD/GBA may impose.

Those underlying statutory powers remain as previously established: Belgium's Law of 30 July 2018, at Articles 221 to 230, provides for criminal sanctions of fines up to EUR 160,000 plus imprisonment for serious breaches of the GDPR, running alongside and in addition to the standard administrative-fine tiers set by GDPR Article 83. The same 2018 Law, at Article 4, exempts federal and regional public authorities from APD administrative fines; the Belgian Constitutional Court has upheld that exemption as proportionate and justified. No change to either the criminal-sanctions figures or the public-authority exemption was located this cycle; both stand as the long-established enforcement architecture against which the Strategic Plan's procedural shift now operates.

Outlook

The practical effect of the mediation-first, fast-track-escalation posture described in the 2026-2028 Strategic Plan will become visible as individual cases move through the new process; no specific case outcomes under the new posture were located this cycle. Readers monitoring enforcement trends for Belgium should expect the volume and framing of published Litigation Chamber decisions to shift as the mediation-first track filters out matters that previously would have proceeded straight to a decision.

Enforcement & Redress

The Belgian Data Protection Authority's Litigation Chamber (Geschillenkamer) holds the power to impose administrative fines under GDPR Article 58.2(i), a power carried into Belgian domestic law by Article 100 Section 1 of the Law of 3 December 2017, commonly referred to as the WOG. The fines the Litigation Chamber may impose are capped at the Article 83 maxima set out in the GDPR itself, which is the higher of EUR20,000,000 or 4 percent of a company's total worldwide annual turnover. This statutory basis is directly corroborated by the Litigation Chamber's own decision 99/2026, which states in its original Dutch text that the Chamber imposes the administrative fine in application of Article 58.2(i), a direct quotation that confirms the fining power is being exercised on the precise legal basis the WOG and the GDPR together establish.

This enforcement architecture also bears on the pending CJEU litigation in APD/GBA v. Diocese of Ghent, since the Litigation Chamber's powers over erasure-related enforcement would extend to religious-register contexts if the Court follows Advocate-General Medina's October 2026 opinion that the GDPR applies to baptismal-register data. The Chamber's fining and corrective powers under Article 58.2(i) would, in that scenario, become directly relevant to any Belgian religious institution found not to have complied with an erasure request falling within the scope the Advocate-General's opinion describes.

Separately, the Litigation Chamber's July 2026 settlement decision against a company for a non-compliant direct-marketing unsubscribe mechanism, resulting in a EUR5,000 fine and a thirty-day correction order, is a further concrete instance of the same Article 58.2(i) power being exercised, albeit at a considerably smaller scale than the Article 83 maxima permit.

Outlook

The scope of the Litigation Chamber's enforcement reach into religious and historical-register erasure disputes depends directly on the outcome of the pending CJEU judgment in APD/GBA v. Diocese of Ghent, expected in the first quarter of 2027. Until that judgment is handed down, the Chamber's Article 58.2(i) powers continue to be exercised in more conventional enforcement contexts, as the July 2026 direct-marketing settlement illustrates.

Enforcement & Redress

Belgium's enforcement and redress landscape this cycle presents a mixed picture of high procedural volume alongside low aggregate financial penalties and meaningful appellate friction. The Litigation Chamber issued 214 decisions in 2025, but total fines imposed across those decisions amounted to only EUR 75,700 in aggregate -- a notably low financial total relative to the decision count, consistent with an enforcement style weighted toward corrective and procedural remedies rather than large monetary penalties.

Appellate outcomes complicate the enforcement picture further. The Brussels Market Court issued 25 rulings in 2025 (9 final, 3 interim) on 20 appeals against Litigation Chamber decisions, and 13 of those decisions were totally or partially annulled. A roughly half-to-majority annulment rate on appealed decisions is a material signal about the durability of the Litigation Chamber's enforcement output, though it should be read alongside the caveat that no primary-source confirmation of this specific statistic beyond the secondary reporting was located this cycle.

Separately, and illustrating a different enforcement tool, the APD/GBA is understood to have imposed a daily penalty of EUR 40,000 on RTL Belgium for GDPR violations related to non-compliant cookie banners -- a continuing-violation penalty structure distinct from the one-off fine amounts reflected in the EUR 75,700 aggregate figure above, and a standing precedent for how the DPA can escalate penalties for unresolved ongoing violations.

Outlook

The high Market Court annulment rate is the most consequential open question for Belgium's enforcement credibility going forward: whether this rate persists, worsens, or improves as more Litigation Chamber decisions move through the appellate pipeline will materially affect how durable the DPA's enforcement output proves to be. Primary-source confirmation of the annulment statistic itself would also strengthen this finding's evidentiary basis.

Enforcement & Redress

Belgium's enforcement and redress landscape is escalating this cycle, driven by an active caseload centred on two major proceedings: the Market Court's 7 January 2026 annulment of the APD's IAB Europe TCF corrective action plan validation, and the Market Court's 4 December 2025 referral of thirteen preliminary questions to the CJEU following the Litigation Chamber's finding that FPS Finance's FATCA-related transfers to the United States were unlawful. Both proceedings remain active, with outcomes pending.

These two proceedings sit against a backdrop of historical enforcement precedent, including the Litigation Chamber's Decision 21/2022, which imposed an administrative fine of EUR 250,000 on IAB Europe, and a separate fine of EUR 174,640 recorded in Decision 07/2024. The confirmed, escalating trajectory this cycle reflects both the scale of the two active Market Court proceedings and the APD's own stated strategic shift toward proactive Systemic Impact Enforcement, which would, if realised, add a further category of self-initiated audit activity to the regulator's enforcement toolkit alongside its existing complaint-driven and judicial-appeal caseload.

Outlook

The resolution timelines for the two active Market Court proceedings, the TCF corrective action plan re-validation and the CJEU's ruling on the FATCA-related referral, are the primary enforcement developments to track. The APD's first concrete Systemic Impact Enforcement outputs, expected as the 2026-2028 Strategic Plan matures, will be the clearest signal of whether the proactive enforcement shift is translating into comparable or greater enforcement volume than the historical complaint-driven model.