--- title: "Belgium Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/belgium/ source_html: /jurisdictions/belgium/index.html description: "Belgium data protection and privacy regulation: 10 categories, 76 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: b919b382e6b61a20c0ac1d81014b00b7362c8a4fd8072c8196106b767bc9704f generator: "fe-fleet/md-twin@1.0" --- # Belgium Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 76 claims · 51 sources in the cumulative register Download report (PDF) Expand all The Belgian Data Protection Authority has fined IAB Europe EUR 250,000 over the Transparency and Consent Framework's GDPR violations, ordering the deletion of personal data processed under the framework. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Sectoral Watch, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=BELGIUM)[Build Report](/reports/?j=BELGIUM)[Compare](/compare/?j=BELGIUM) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Autorité de la protection des données / Gegevensbeschermingsautoriteit (Belgian Data Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 76 Claims 9 Tier-1 sources Traffic-light mix 7 green 2 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Law made at European Economic Area (Bloc) level that applies in Belgium is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Belgium’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 934 Full executive summary 205 ###### Latest update · 25 October 2026 #### Lead Signal The European Data Protection Board has directly overruled the Belgian data protection authority's handling of a prominent cookie-consent complaint. Binding Decision 1/2026, adopted 28 May 2026 and published 14 July 2026, rejected the Belgian authority's dismissal of a complaint brought by privacy advocacy group NOYB against public broadcaster VRT over its cookie-banner practices; the Belgian authority had dismissed that complaint as an abuse of the right to complain under the General Data Protection Regulation. The Board found this characterisation wrong and ordered the Belgian authority, acting as lead supervisory authority, to assess the complaint on its merits and submit a fresh draft decision under the Regulation's cooperation mechanism. The Belgian authority confirmed the obligation in an information notice dated 13 July 2026. This is a significant procedural correction: a national regulator's substantive handling of a high-profile complaint has been set aside at the European level, with the merits assessment still outstanding. #### Other Developments A smaller but concrete enforcement action on access rights. The Belgian authority fined a law firm EUR 4,920 on 8 May 2026 for insufficient fulfilment of data-subject access rights. The firm had charged EUR 135 to process an access request on a claim that the request was manifestly unfounded or excessive, a claim the authority found unsubstantiated, and the firm was also found to lack a privacy policy. This decision illustrates the Belgian authority's continuing attention to the practical mechanics of the access right, including the narrow conditions under which a controller may charge a fee or refuse to act on a request. #### Cross-Monitor Connections The VRT cookie-banner dispute sits at the boundary between data protection and commercial AdTech practice generally; developments in cookie-consent enforcement in Belgium are relevant to monitors tracking advertising-technology and commercial-privacy compliance more broadly, since the underlying legal question concerns what constitutes valid consent architecture for behavioural advertising and analytics on a public-facing website. No connection to financial-integrity, payments, or crypto-asset tracking arises from this period's Belgian developments. #### Outlook The central open question is what the Belgian authority's merits-stage decision on the VRT complaint will say once it is produced under the European Board's order; that decision, expected following the Board's binding ruling, will be the next material milestone in this dispute and will likely shape how Belgian controllers are expected to structure cookie-consent mechanisms going forward. The law firm access-rights fine is a closed enforcement matter with no outstanding procedural step identified this period. 4 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Belgian Data Protection Authority has fined IAB Europe EUR 250,000 over the Transparency and Consent Framework's GDPR violations, ordering the deletion of personal data processed under the framework. The EDPB has required the Belgian DPA, acting as lead supervisory authority, to reconsider on the merits a NOYB cookie-banner complaint against public broadcaster VRT, after an Austrian DPA objection to the Belgian regulator's earlier procedural dismissal. Together, the two actions confirm that the EU's landmark adtech consent-framework enforcement precedent remains fully active this cycle. #### Other Developments The Belgian Data Protection Authority (APD-GBA), based in Brussels, remains the national supervisory authority responsible for GDPR enforcement in Belgium. In April 2026 the DPA fined an employer EUR 8,500 in Decision No. 86/2026 for keeping a former employee's mailbox active and failing to respond to an erasure request. In May 2026 the DPA fined utility company SWDE EUR 86,000 under Decision No. 102/2026 for systematic call recording without valid consent, applying both the GDPR and the Belgian Electronic Communications Act. In a separate 2024 decision the DPA ordered loyalty-scheme operator Freedelity to reduce its data-retention period to a maximum of three years for a storage-limitation breach. The same Freedelity decision imposed a daily fine of EUR 5,000, capped at EUR 100,000, over non-compliant consent mechanisms and excessive ID-scanning data collection. A challenger review corrected an earlier account of the DPA's 2024 biometric time-registration case (Decision 114/2024), confirming that the employer lacked a valid Article 6/9 legal basis, breached purpose limitation and data minimisation, and failed to carry out a mandatory Article 35 impact assessment, rather than the previously reported records-of-processing violation. Belgium's implementing statute continues to set the age of digital consent at 13, a downward derogation from the GDPR's Article 8 default of 16. These April-May 2026 fines against Y.NV and SWDE extend a continuous enforcement-activity index for the Belgian regulator this year. #### Cross-Monitor Connections The EDPB and EDPS are understood to have adopted a Joint Opinion on 20 January 2026 addressing the interface between the GDPR and the AI Act within the proposed Digital Omnibus, though the measure has not yet been adopted as law. A related EDPB/EDPS Joint Opinion of 11 February 2026 is understood to raise concerns that the same Digital Omnibus proposal would narrow the GDPR's definition of personal data and raise the breach-notification threshold and deadline, a package with direct relevance for the artificial-intelligence monitor given its GDPR/AI-Act interoperability implications. Readers tracking the AI-Act side of this interface should consult the artificial-intelligence monitor's coverage directly. #### Outlook Belgium's overall regulatory posture remains one of moderate, stable risk carried forward on the back of active and continuing enforcement rather than new statutory change. In 2022 the EDPB expressed concern about proposed Belgian legislative reforms that would strengthen parliamentary oversight of the DPA, raising questions about the regulator's independence. That question has not been revisited in current reporting, and the present-cycle resolution status of Belgium's DPA-governance reform remains an open gap for verification. Read full brief · 934 words Standing brief, as of 25 August 2026. #### Regulatory Status Belgium's data protection regime continues to operate under the Belgian Data Protection Authority (APD-GBA), based in Brussels, which serves as the country's national GDPR supervisory authority. Substantive enforcement this cycle spans an employer biometric-fingerprint fine of EUR 45,000 for special-category processing without a valid Article 9 basis. Rights-focused enforcement is anchored by the 2026 Y.NV decision, which fined an employer EUR 8,500 for keeping a former employee's mailbox active and failing to respond to an erasure request. Belgium remains the epicentre of EU adtech enforcement, having fined IAB Europe EUR 250,000 over the Transparency and Consent Framework and ordered deletion of the data processed under it. On children's data, Belgium's statute sets the digital age of consent at 13, a downward derogation from the GDPR's Article 8 default of 16. #### Outlook Belgium's jurisdiction-level risk posture remains moderate and stable, carried forward on continuing enforcement rather than fresh statutory change, with controller/processor duties, adtech and enforcement/redress the three modules showing the most active movement this cycle. Sectoral overlays beyond telecoms and employment, several algorithmic and children's-data sub-modules, and the current resolution status of the 2022 DPA-independence concern all remain open verification items for the next research cycle. Read full brief · 205 words Key regulatory facts for Belgium Regulatory Dimension Belgium Standing Position Jurisdiction Belgium (BE) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 76 sourced findings) Regulator & Framework Full GDPR-aligned statutory framework in force with an operational, active supervisory authority; only narrow public-sector carve-outs from administrative fines. Lawful Processing & Special Data Core lawful-basis and special-category rules are GDPR-aligned and actively enforced by the Belgian DPA; pseudonymisation/anonymisation guidance is thin. Data Subject Rights Rights framework is GDPR-aligned and enforced through repeated Belgian DPA decisions; portability enforcement activity specifically is thin. Controller/Processor Duties All core controller/processor duties are GDPR-aligned, actively guided by Belgian DPA published lists, and enforced through repeated fines; joint-controller arrangements lack Belgium-specific findings. Primary Instruments Cited EDPB, DataGuidance, DataGuidance, Belgium Official Instrument (recordinglaw.com belgium-data-privacy-laws), Autorité de protection des données — Chambre Contentieuse (Belgium) Last Confirmed / Updated 2026-10-25 (51 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Belgium: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR-aligned statutory framework in force with an operational, active supervisory authority; only narrow public-sector carve-outs from administrative fines. Primary framework General Data Protection Regulation (EU) 2016/679, as implemented by the Belgian Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data and the Act of 3 December 2017 Establishing the Data Protection Authority Supervisory authority [Autorité de la protection des données / Gegevensbeschermingsautoriteit (Belgian Data Protection Authority, APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green Full GDPR-aligned statutory framework in force with an operational, active supervisory authority; only narrow public-sector carve-outs from administrative fines. #### Sub-modules (5) #### Regulator And AuthorityGreen The APD-GBA is the sole Belgian supervisory authority for GDPR matters, headquartered in Brussels. Claims (5): - The Belgian Data Protection Authority (APD-GBA), based in Brussels, is the national supervisory authority responsible for GDPR enforcement in Belgium. - The APD/GBA's institutional structure (Litigation Chamber for enforcement decisions, Inspection Service for investigations) was established by the Law of 3 December 2017; Litigation Chamber decisions may be appealed to the Market Court (Brussels Court of Appeal) - The APD/GBA is organised into five operational bodies plus an Executive Committee, including a Litigation Chamber (Chambre Contentieuse) and Inspection Service. - APD/GBA — Executive Committee plus five operational bodies including the Litigation Chamber and Knowledge Centre - The Belgian Market Court annulled the APD's 2023 validation of IAB Europe's TCF remedial action plan in a January 2026 judgment and remanded the matter for a fresh APD decision; no new validation decision had been issued as of the source's late-July 2026 writing. #### Act And InstrumentsGreen The GDPR is implemented domestically via two founding Acts: the 2017 Act creating the DPA and the 2018 Act on personal data protection. Claims (3): - Belgium implemented the GDPR through the Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data, together with the Act of 3 December 2017 Establishing the Data Protection Authority. - APD/GBA 2026-2028 Strategic Plan — The APD/GBA's 2026-2028 Strategic Plan shifts enforcement focus from individual complaint-handling toward proactive, large-scale 'Systemic Impact Enforcement' in healthcare, finance, and processing of minors' data. - Belgium — Law of 30 July 2018 (GDPR implementation) and Law of 3 December 2017 (establishing the DPA) #### Material ScopeAmber The Act applies broadly to private and public controllers/processors, with a narrow carve-out excluding most public authorities from GDPR Article 83 administrative fines. Claims (1): - The Belgian Data Protection Act applies to both private and public controllers and processors, except that public authorities (other than public-law legal persons offering goods or services on a market) are excluded from GDPR Article 83 administrative fines. #### Territorial ScopeGreen The Act mirrors GDPR establishment-based territorial scope, applying regardless of where the actual processing occurs. Claims (2): - The Belgian Data Protection Act applies to processing carried out in the context of the activities of an establishment of a controller or processor on Belgian territory, regardless of whether the processing itself takes place in Belgium. - APD Litigation Chamber — The Litigation Chamber has addressed its competence under GDPR Article 3 over complaints filed against defendants located outside the EEA (Decision 13/2024). #### Regulator Registration And FilingAmber Belgium has no general controller-registration regime (abolished under GDPR); the principal filing obligation is communication of DPO contact details to the Belgian DPA. Claims (2): - Controllers and processors appointing a DPO under GDPR Article 37 must publish the DPO's contact details and communicate them to the Belgian DPA, constituting the principal filing obligation under the Belgian regime. - APD/GBA — 1,161 DPO notifications received and 8,533 organisations with an active registered DPO as at 31 December 2025 #### Key findings (11) - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file - Belgian DPA and dual founding Acts (2017/2018) confirmed in force; narrow public-authority carve-out from Article 83 fines. — source on file Belgium is an EU Member State operating under the GDPR (Regulation (EU) 2016/679) as the omnibus instrument, implemented domestically through the Act of 3 December 2017 Establishing the Data Protection Authority and the Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data. The Belgian Data Protection Authority (APD-GBA) is the single national supervisory authority, based in Brussels, with a Litigation Chamber acting as its administrative enforcement/sanctioning body and an Inspection Service handling investigations. Periodic update · new data 2026-10-11 #### Regulator & Framework The most significant development in Belgium's data-protection framework this period concerns the scope of the erasure right as it applies to religious and historical registers. On 1 October 2026, Advocate-General Medina issued an opinion in APD/GBA v. Diocese of Ghent concluding that the GDPR applies to baptismal-register data and that erasure can in principle be requested by objection. The opinion is understood to largely follow the position the Belgian Data Protection Authority itself has taken in the underlying dispute, though the opinion is an Advocate-General's view, not a final ruling, and the CJEU has not yet handed down judgment. If the Court follows the Advocate-General's opinion, the resulting judgment would extend GDPR erasure-right applicability into religious and historical register contexts that have not previously been tested at the level of the EU's apex court. This is a question with implications reaching well beyond Belgium, since any Member State's religious institutions maintaining historical registers of this kind would be affected by a ruling that settles whether and how erasure requests can be made against such records, and on what basis a controller might resist them. The Belgian Data Protection Authority's own management planning for the coming year also references its contribution to European Data Protection Board guidance on data anonymisation and scientific research, continuing work set out in its 2026 management plan. This is a standing area of regulatory contribution rather than a fresh development, but it sits within the same framework-level category as the Diocese of Ghent litigation. #### Outlook The CJEU's final judgment in APD/GBA v. Diocese of Ghent is expected in the first quarter of 2027. Until the Court rules, the question of whether erasure rights extend to religious and historical register data remains formally open, notwithstanding the Advocate-General's opinion. Any controller holding historical or religious-register personal data with a Belgian nexus has reason to watch this judgment closely, as it would be among the first apex-level EU rulings to address erasure rights in this specific context. 2 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Regulator & Framework The Belgian Data Protection Authority, the APD/GBA, is organised around an Executive Committee plus five operational bodies, including the Litigation Chamber and the Knowledge Centre. Its statutory basis rests on the Law of 30 July 2018 implementing the GDPR domestically and the Law of 3 December 2017 establishing the DPA itself -- a stable, standing legislative baseline that was not disturbed this cycle. Registration activity continues at a steady pace: as at 31 December 2025, the APD/GBA reports 1,161 DPO notifications received and 8,533 organisations with an active registered Data Protection Officer, figures that reflect ongoing compliance engagement across the regulated population rather than a new development in themselves. The material development this cycle is institutional rather than legislative: the APD/GBA has adopted a 2026-2028 Strategic Plan that reorients the regulator's operating posture from individual complaint-handling toward proactive, sector-targeted audits described internally as Systemic Impact Enforcement, with healthcare, finance and minors' data processing named as priority areas. This is a confirmed structural shift in regulatory strategy, though it is a plan rather than a binding instrument, and its practical effect will depend on how the named priority audits are actually conducted and resourced over the plan's multi-year horizon. #### Outlook The Strategic Plan's translation into concrete audit activity in the named priority sectors is the central item to watch over the coming cycles. Whether the DPA's institutional structure or resourcing changes to support the shift toward proactive Systemic Impact Enforcement, as distinct from reactive complaint-handling, will be a useful marker of how seriously the plan is being operationalised. Periodic update · new data 2026-09-14 #### Regulator & Framework The APD/GBA is organised into five operational bodies plus an Executive Committee, including a Litigation Chamber, known formally as the Chambre Contentieuse, and an Inspection Service. This organisational structure underpins the regulator's dual capacity to investigate and to adjudicate. The most significant development this cycle concerns the regulator's own stated direction rather than a fresh case: the APD's 2026-2028 Strategic Plan is understood to shift enforcement focus away from individual complaint-handling and toward proactive, large-scale Systemic Impact Enforcement, concentrating audits in healthcare, finance, and the processing of minors' data. This represents a probable, materially significant reorientation of how the regulator allocates its resources. Rather than responding primarily to complaints as they arrive, the APD would initiate its own systemic audits in prioritised sectors. Separately, the Litigation Chamber has previously addressed its own competence under GDPR Article 3 over complaints filed against defendants located outside the European Economic Area, in Decision 13/2024, a confirmed and in-force precedent establishing the territorial reach of the regulator's jurisdiction. #### Outlook The practical test of the Strategic Plan's proactive enforcement shift will be whether the APD produces concrete Systemic Impact Enforcement audit outputs in its named priority sectors within the plan's 2026-2028 window. Confirmation of a first such audit, particularly in healthcare or finance, would be the clearest signal that the shift from complaint-driven to proactive enforcement is materialising in practice rather than remaining a stated policy direction. Sources and claims (13) - [EDPB](https://www.edpb.europa.eu/about-edpb/our-members_en) — The Belgian Data Protection Authority (APD-GBA), based in Brussels, is the national supervisory authority responsible for GDPR enforcement in Belgium. - [DataGuidance](https://www.dataguidance.com/jurisdictions/belgium?article_type=insight) — Belgium implemented the GDPR through the Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data, together with the Act of 3 December 2017 Establishing the Data Protection Authority. - [DataGuidance](https://legacy.dataguidance.com/notes/belgium-data-protection-overview) — The Belgian Data Protection Act applies to both private and public controllers and processors, except that public authorities (other than public-law legal persons offering goods or services on a market) are excluded from GDPR Article 83 administrative fines. - [DataGuidance](https://legacy.dataguidance.com/notes/belgium-data-protection-overview) — The Belgian Data Protection Act applies to processing carried out in the context of the activities of an establishment of a controller or processor on Belgian territory, regardless of whether the processing itself takes place in Belgium. - [DataGuidance](https://www.dataguidance.com/jurisdictions/belgium?article_type=insight) — Controllers and processors appointing a DPO under GDPR Article 37 must publish the DPO's contact details and communicate them to the Belgian DPA, constituting the principal filing obligation under the Belgian regime. - [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/belgium-data-privacy-laws/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/belgium-data-privacy-laws/) — The APD/GBA's institutional structure (Litigation Chamber for enforcement decisions, Inspection Service for investigations) was established by the Law of 3 December 2017; Litigation Chamber decisions may be appealed to the Market Court (Brussels Court of Appeal) - [Autorité de protection des données — Chambre Contentieuse (Belgium)](https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-49-2026.pdf) — The APD/GBA is organised into five operational bodies plus an Executive Committee, including a Litigation Chamber (Chambre Contentieuse) and Inspection Service. - [Cranium](https://www.cranium.eu/how-the-belgian-dpa-will-enforce-the-gdpr-differently-in-2026/) — APD/GBA 2026-2028 Strategic Plan — The APD/GBA's 2026-2028 Strategic Plan shifts enforcement focus from individual complaint-handling toward proactive, large-scale 'Systemic Impact Enforcement' in healthcare, finance, and processing of minors' data. - [APD/GBA](https://www.dataprotectionauthority.be/publications/bevel-nr.-13-2024-engels.pdf) — APD Litigation Chamber — The Litigation Chamber has addressed its competence under GDPR Article 3 over complaints filed against defendants located outside the EEA (Decision 13/2024). - [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/belgium-data-privacy-laws/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/belgium-data-privacy-laws/) — APD/GBA — Executive Committee plus five operational bodies including the Litigation Chamber and Knowledge Centre - [APD/GBA](https://www.dataprotectionauthority.be/) — Belgium — Law of 30 July 2018 (GDPR implementation) and Law of 3 December 2017 (establishing the DPA) - [https://www.linklaters.com/insights/data-protected/data-protected---belgium](https://www.linklaters.com/insights/data-protected/data-protected---belgium) — APD/GBA — 1,161 DPO notifications received and 8,533 organisations with an active registered DPO as at 31 December 2025 - [Linklaters Data Protected](https://www.linklaters.com/insights/data-protected/data-protected---belgium) — The Belgian Market Court annulled the APD's 2023 validation of IAB Europe's TCF remedial action plan in a January 2026 judgment and remanded the matter for a fresh APD decision; no new validation decision had been issued as of the source's late-July 2026 writing. ### Belgium: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category rules are GDPR-aligned and actively enforced by the Belgian DPA; pseudonymisation/anonymisation guidance is thin. Primary framework GDPR Articles 6, 7 and 9, read with Belgian Act of 30 July 2018 and CBA-based employment-data rules Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green Core lawful-basis and special-category rules are GDPR-aligned and actively enforced by the Belgian DPA; pseudonymisation/anonymisation guidance is thin. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data The APD/GBA is understood to apply an exceptionally strict reading of Article 6 GDPR, requiring controllers to clearly choose, document and evidence application of their chosen lawful basis for processing. This supervisory-interpretation posture is reported at a Probable confidence level, resting on a single lower-tier source, and should be read as an indication of the regulator's general orientation rather than a confirmed, citable standard. The concrete, confirmed development this cycle sits in the consent space: the APD/GBA published Recommendation 01/2026 on direct marketing, which replaces and supersedes the regulator's February 2020 recommendation on the same subject. The new recommendation clarifies the conditions for valid consent, the circumstances requiring consent renewal, and how profiling and automated decision-making should be treated when used in a direct-marketing context. This is a binding guidance instrument, in force from early 2026, and represents the DPA's most concrete lawful-processing-adjacent output this cycle. #### Outlook The practical application of Recommendation 01/2026 -- particularly how the DPA treats consent-renewal timing and profiling-related marketing practices in any subsequent enforcement activity -- is the item to watch. Whether the reported strict-reading posture toward Article 6 generally is corroborated by a primary-source APD/GBA statement in a future cycle would also strengthen that finding's confidence tier. D2 · Lawful Processing — Full Module Record 4 sub-modules · 51 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights framework is GDPR-aligned and enforced through repeated Belgian DPA decisions; portability enforcement activity specifically is thin. Primary framework GDPR Articles 12-22 as applied in Belgium Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green Rights framework is GDPR-aligned and enforced through repeated Belgian DPA decisions; portability enforcement activity specifically is thin. #### Sub-modules (5) #### Access RightGreen The Belgian DPA is particularly active in issuing enforcement decisions concerning responses to data subject access requests. Claims (2): - In Decision No. 86/2026, the Belgian DPA fined an employer €8,500 after it kept a former employee's professional mailbox active and failed to respond to the employee's erasure request. - Belgian APD/GBA — A law firm was fined EUR 4,920 on 8 May 2026 for insufficient fulfilment of data-subject rights, including charging EUR 135 to process an access request on an unsubstantiated manifestly-unfounded/excessive claim, and for lacking a privacy policy #### Rectification And ErasureGreen Failure to action erasure requests has been the subject of Belgian DPA fines, including the 2026 Y.NV decision. Claims (1): - In Decision No. 86/2026, the Belgian DPA fined an employer €8,500 after it kept a former employee's professional mailbox active and failed to respond to the employee's erasure request. #### Restriction And ObjectionGreen The Belgian DPA has fined controllers for failing to honour objection requests to direct-marketing processing. Claims (1): - The Belgian DPA fined a controller €1,000 for not responding to a data subject's request to object to processing of his data for marketing purposes and for failing to cooperate with the authority's injunction. #### Data PortabilityRed No Belgium-specific portability enforcement decision or derogating guidance was located beyond the GDPR Article 20 baseline. #### Deadlines And Response WindowsGreen The standard one-month response deadline under GDPR Article 12(3)/(4) applies in Belgium without a shortened or extended national variant identified. Claims (2): - Where a controller does not act on a data subject's rights request, it must inform the data subject without delay and at the latest within one month of receipt, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy. - APD/GBA — 1,394 complaints received in 2025, up from 837 in 2024, and 3,034 information requests (compared to 3,051 in 2024) #### Key findings (11) - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file - Y.NV erasure-failure fine and standard one-month response-window baseline; one objection-fine detail escalated. — source on file Belgium follows the GDPR data-subject-rights catalogue (access, rectification/erasure, restriction/objection, portability) with the standard one-month response deadline. The Belgian DPA is particularly active in enforcement concerning access requests, erasure failures, and objection to marketing. Periodic update · new data 2026-10-25 #### Data Subject Rights The Belgian data protection authority fined a law firm EUR 4,920 on 8 May 2026 in connection with its handling of a data-subject access request. The firm had charged EUR 135 to process the request, relying on a claim that the request was manifestly unfounded or excessive, a basis the authority found the firm had not substantiated. The authority also found that the firm lacked a privacy policy. The fine is comparatively modest in scale but addresses a recurring compliance point: the General Data Protection Regulation permits a controller to charge a reasonable fee or refuse to act on a request only where the request is genuinely manifestly unfounded or excessive, and the controller bears the burden of demonstrating that condition is met rather than asserting it as a default basis for charging. This decision is reported through a single secondary source rather than independently retrieved from the Belgian authority's own decision text, so the finding is treated as probable rather than confirmed; the core facts, including the fine amount, the date, and the two grounds cited, are consistent across that reporting. #### Outlook No further procedural step in this specific matter has been identified; it appears to be a closed enforcement decision rather than an ongoing one. More broadly, this decision is a data point for how the Belgian authority applies the manifestly-unfounded-or-excessive threshold in practice, which is of standing relevance to any Belgian controller designing its access-request fee and refusal policies. 1 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Data Subject Rights Data subject rights activity in Belgium rose materially in 2025. The APD/GBA reports 1,394 complaints received in 2025, up sharply from 837 in 2024 -- an increase of well over half in a single year. Information requests, by contrast, held roughly steady: 3,034 in 2025 compared to 3,051 in 2024, essentially flat year over year. This divergence between rapidly rising complaints and stable information-request volume suggests the increase in subject-rights activity is concentrated in adversarial or dispute-oriented engagement with the regulator rather than in general information-seeking, though the underlying drivers of the complaint increase were not further specified this cycle. This rising complaint volume arrives in the same cycle as the APD/GBA's adoption of its 2026-2028 Strategic Plan reorienting toward proactive enforcement, creating a combined picture of a regulator facing increased reactive demand from data subjects at the same time it is attempting to shift resources toward proactive sector audits. How the DPA balances these two pressures -- a rising complaint caseload and a strategic pivot toward proactive audit work -- is not resolved by the evidence available this cycle. #### Outlook Whether the 2025 complaint increase continues, stabilises, or reverses in the coming cycle is the key data point to watch, as is whether the DPA's response-time performance on individual complaints changes as it reallocates resources toward the Strategic Plan's proactive audit priorities. Sources and claims (5) - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504) — Where a controller does not act on a data subject's rights request, it must inform the data subject without delay and at the latest within one month of receipt, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy. - [EDPB / Belgian DPA](https://www.edpb.europa.eu/news/national-news/2020/belgian-dpa-imposes-fine-1000-euro-controller-not-responding-request-object_en) — The Belgian DPA fined a controller €1,000 for not responding to a data subject's request to object to processing of his data for marketing purposes and for failing to cooperate with the authority's injunction. - [DataGuidance](https://www.dataguidance.com/news/belgium-apd-fines-ynv-eu8500-unlawful-processing) — In Decision No. 86/2026, the Belgian DPA fined an employer €8,500 after it kept a former employee's professional mailbox active and failed to respond to the employee's erasure request. - [https://www.linklaters.com/insights/data-protected/data-protected---belgium](https://www.linklaters.com/insights/data-protected/data-protected---belgium) — APD/GBA — 1,394 complaints received in 2025, up from 837 in 2024, and 3,034 information requests (compared to 3,051 in 2024) - [Enforcement Tracker](https://www.enforcementtracker.com/ETid-3145) — Belgian APD/GBA — A law firm was fined EUR 4,920 on 8 May 2026 for insufficient fulfilment of data-subject rights, including charging EUR 135 to process an access request on an unsubstantiated manifestly-unfounded/excessive claim, and for lacking a privacy policy ### Belgium: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ All core controller/processor duties are GDPR-aligned, actively guided by Belgian DPA published lists, and enforced through repeated fines; joint-controller arrangements lack Belgium-specific findings. Primary framework GDPR Articles 24-39 as applied and supplemented by Belgian DPA guidance Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green All core controller/processor duties are GDPR-aligned, actively guided by Belgian DPA published lists, and enforced through repeated fines; joint-controller arrangements lack Belgium-specific findings. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Belgium's controller and processor accountability expectations are tightening this cycle, driven primarily by the APD/GBA's 2026-2028 Strategic Plan, which shifts the regulator's posture from individual complaint response toward proactive, sector-targeted Systemic Impact Enforcement audits in healthcare, finance and minors' data processing. This is a confirmed strategic reorientation, though it remains a plan rather than a binding legal instrument, and its accountability implications for controllers will depend on how the named audits are actually scoped and conducted. Notably, this tightening in stated regulatory ambition coincides with a decline in reported breach-notification volume: the APD/GBA received 1,216 data breach notifications in 2025, down from 1,455 in 2024. This is a genuine divergence worth stating plainly rather than smoothing over: rising proactive-enforcement ambition and falling breach-notification volume are not contradictory on their face, but they do mean that any assessment of Belgium's controller-duty compliance environment cannot rely on breach-notification trends alone as a proxy for overall accountability performance. #### Outlook The key items to watch are whether the Strategic Plan's proactive audits surface accountability or DPIA-adequacy gaps that breach-notification data alone would not have revealed, and whether the declining breach-notification trend continues or reverses as the DPA's supervisory attention increases under the new plan. Periodic update · new data 2026-09-14 #### Controller/Processor Duties The Belgian Market Court has confirmed that IAB Europe acts as joint data controller for the processing of user preferences via the TC String within its Transparency and Consent Framework. This confirmed, in-force ruling settles a question central to how consent-management infrastructure providers are characterised under Belgian and EU data protection law: an entity that operates the technical mechanism for recording and transmitting consent signals can itself be held to be a joint controller of the personal data processed through that mechanism, alongside the businesses that rely on it. This controller characterisation compounds the APD's broader strategic direction toward demonstrable accountability. The APD's 2026-2028 Strategic Plan is understood to demand demonstrable accountability logs from controllers and processors as part of its proactive Systemic Impact Enforcement approach, meaning organisations relying on shared consent-management infrastructure of the kind at issue in the IAB Europe proceedings should expect scrutiny of how joint-controller responsibilities are documented and evidenced, not merely asserted. #### Outlook The joint-controller finding's practical consequences will become clearer once the APD completes its required re-validation of IAB Europe's corrective action plan following the Market Court's annulment of the prior validation. Organisations using the Transparency and Consent Framework, or comparable shared consent-management infrastructure, should watch for how the re-validated plan allocates joint-controller obligations in practice. D4 · Controller & Processor — Full Module Record 7 sub-modules · 46 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Transfer mechanisms are fully operative and actively used (BCR lead-authority role, Schrems II guidance); adequacy grant/receipt is not a Member-State-level competence. Primary framework GDPR Chapter V (Articles 44-49) Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green Transfer mechanisms are fully operative and actively used (BCR lead-authority role, Schrems II guidance); adequacy grant/receipt is not a Member-State-level competence. Periodic update · new data 2026-09-14 #### Cross-Border & Adequacy The Belgian Market Court referred thirteen preliminary questions to the Court of Justice of the European Union concerning the material scope of GDPR Article 96 and the framework governing third-country transfers, following the APD Litigation Chamber's Decision 79/2025 finding that FPS Finance's FATCA-related transfers of personal data to the United States were unlawful. This is a confirmed, in-force development of high materiality: it places directly before the CJEU the question of how the GDPR's transfer framework interacts with pre-existing international agreements concluded before the Regulation's entry into force, of which FATCA, the US Foreign Account Tax Compliance Act cooperation framework, is a prominent example. The stakes of this referral extend well beyond the specific FATCA context. A CJEU ruling clarifying Article 96's scope would have implications for any pre-GDPR international agreement involving cross-border transfers of personal data from Belgium, and by extension from other member states facing comparable disputes, to third countries. Until the CJEU rules, the practical transfer framework for FATCA-related and comparable pre-GDPR-agreement transfers from Belgium remains unsettled. #### Outlook The CJEU's ruling on the Market Court's thirteen preliminary questions is the central item to watch in this domain, though it is not expected imminently given the scale and complexity of the referral. In the interim, entities relying on pre-GDPR international agreements for cross-border transfers from Belgium should treat the underlying legal basis as contested rather than settled. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 64 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong, sourced coverage of telecoms and employment overlays; other sectors carry an evidentiary gap requiring escalation. Primary framework GDPR plus Belgian Electronic Communications Act (LCE) and CBA No. 81 Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Amber Strong, sourced coverage of telecoms and employment overlays; other sectors carry an evidentiary gap requiring escalation. Periodic update · new data 2026-10-18 #### Sectoral Watch The EU Data Act is the dominant sectoral item for Belgium this cycle. The Regulation's general application began 12 September 2025, and from 12 September 2026 the obligation to design connected products for direct user access to generated data by default applies to products placed on the market after that date. This is a directly applicable EU Regulation that does not require national transposition to take legal effect on manufacturers, but Belgium's national implementing law — which would designate the competent authority and set out procedural powers and sanctions for domestic enforcement — remains in draft. The Belgian Council of Ministers approved that draft law on 27 March 2026 and it was transmitted to the other institutions involved in the legislative process, but it had not been enacted as of this cycle. BIPT is proposed, though not yet statutorily confirmed, as the national competent authority under that draft. A second sectoral instrument worth noting for continuity is Article 129 of the Belgian Law of 13 June 2005 on electronic communications, which transposes the ePrivacy Directive's Article 5(3) strict opt-in requirement for non-essential cookies. This is a standing instrument, jointly enforced by the APD (on the data-protection angle) and BIPT (on the telecom angle), and no change to this instrument was located this cycle; it is noted here because BIPT's co-enforcement role under Article 129 is the same authority under consideration for the Data Act's competent-authority designation, meaning BIPT's institutional capacity is being stretched across two sectoral enforcement roles as the Data Act implementing law proceeds. #### Outlook The approaching 12 September 2026 access-by-design commencement date is the operative deadline to track, since it applies regardless of whether Belgium's national implementing law has been enacted by then — the Data Act itself is directly applicable. Whether the Belgian implementing law passes the remaining legislative institutions before or after that date, and whether BIPT is formally confirmed as competent authority in that process, are the two concrete items that would resolve the current gap between EU-level applicability and Belgian domestic enforcement capacity. Periodic update · new data 2026-09-28 #### Sectoral Watch The APD/GBA's 2026-2028 Strategic Plan designates healthcare and finance as tailored priority-workflow sectors for large-scale profiling and health-data audits. This sectoral designation is assessed as probable, resting on the Strategic Plan's own stated priorities as reported by secondary sources, rather than on a confirmed primary-source audit programme document. The designation nonetheless represents a meaningful signal for entities in either sector: it indicates that generic, complaint-driven regulatory attention is being supplemented, and in the plan's stated intent partially superseded, by sector-specific proactive audit activity. No further sector-specific instrument, guidance, or audit finding beyond this Strategic Plan designation was located this cycle. The designation should therefore be read as a forward-looking prioritisation signal rather than an account of any completed or in-progress sectoral audit. #### Outlook Whether the Strategic Plan's healthcare and finance prioritisation translates into a published audit programme, timeline, or set of sector-specific guidance documents in the coming cycles is the principal item to watch. Any concrete healthcare or finance audit finding arising from this prioritisation would represent a material escalation from the current planning-stage signal. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 49 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D7 AdTech & Commercial Privacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Strong enforcement record across cookies, dark patterns, cross-context advertising (TCF) and direct marketing; opt-out-signal and clean-room specifics are thin. Primary framework GDPR plus ePrivacy Directive as transposed via the Belgian Electronic Communications Act (LCE) Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green Strong enforcement record across cookies, dark patterns, cross-context advertising (TCF) and direct marketing; opt-out-signal and clean-room specifics are thin. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy The European Data Protection Board's Binding Decision 1/2026 is the most consequential AdTech-adjacent development in Belgium this period, even though the Board itself is a supranational body rather than the Belgian regulator. The decision, adopted 28 May 2026 and published 14 July 2026, addressed a complaint brought by privacy advocacy group NOYB against public broadcaster VRT concerning its cookie-banner consent practices. The Belgian data protection authority had dismissed the underlying complaint, characterising it as an abuse of the right to complain under Articles 77 and 80(1) of the General Data Protection Regulation. The Board rejected that characterisation and ordered the Belgian authority, in its capacity as lead supervisory authority for the matter, to assess the complaint on its merits and to submit a new draft decision under the cooperation mechanism set out in Article 60(3) of the Regulation. The Belgian authority issued an information notice on 13 July 2026 confirming that it is bound by this order. The practical significance for commercial AdTech practice in Belgium is that the substantive question underlying the original complaint, namely whether VRT's cookie-banner consent architecture met the Regulation's standards for valid consent, remains to be answered by the Belgian authority rather than having been resolved by the original dismissal. Organisations relying on cookie-consent mechanisms modelled on, or similar to, the practices originally complained of should treat the matter as open pending the Belgian authority's forthcoming merits-stage decision, rather than treating the original dismissal as having settled the question. #### Outlook The Belgian authority's merits-stage draft decision on the VRT complaint, required under the European Board's binding order, is the key document to watch. Its content will likely provide the clearest recent guidance from the Belgian regulator on what cookie-consent practices it considers compliant with the General Data Protection Regulation's consent standard, and may have broader relevance for other Belgian organisations operating comparable consent-banner architecture. Periodic update · new data 2026-10-11 #### AdTech & Commercial Privacy The Belgian Data Protection Authority's Settlement Decision 163/2026, dated 16 July 2026, imposed a EUR5,000 fine on a company found to operate a non-compliant and overly complex direct-marketing unsubscribe mechanism. Alongside the fine, the decision carried a thirty-day correction order requiring the company to bring its unsubscribe process into compliance. This decision is reported through a secondary source citing the settlement rather than through a directly retrieved APD publication, so the specific procedural detail beyond the fine amount and correction period should be read with that sourcing context in mind. The decision is a concrete, dated example of the APD's continuing enforcement attention toward the mechanics of direct-marketing opt-out processes, an area within AdTech and Commercial Privacy that often escapes the more visible, higher-value fines associated with cross-border data transfer or special-category data processing. A fine of this size, paired with a short correction window, signals that the APD treats unsubscribe-mechanism complexity as a compliance failure worth a formal settlement decision, even where the financial penalty itself is modest relative to GDPR's maximum fining tiers. #### Outlook No further direct-marketing or commercial-privacy enforcement development beyond the July 2026 settlement was identified this cycle. The correction order attached to Settlement Decision 163/2026 implies a compliance deadline roughly thirty days after the 16 July 2026 decision date, which would mark the point at which the fined company's unsubscribe mechanism should have been brought into line with the APD's expectations. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy The APD/GBA published Recommendation 01/2026 on direct marketing this cycle, replacing and superseding its February 2020 recommendation on the same subject. The new recommendation clarifies the conditions for valid consent in a direct-marketing context, the circumstances under which consent must be renewed, and how profiling and automated decision-making should be treated when deployed for marketing purposes. It also addresses the use of existing customers' contact details under a "soft opt-in" approach, providing updated guidance on when marketing to an existing customer base can proceed without fresh, explicit consent. This is a confirmed, binding guidance instrument, in force from early 2026, and represents the most concrete and directly on-point commercial-privacy development this cycle. It supersedes six years of standing guidance under the 2020 recommendation, meaning organisations relying on the prior framework's specific consent-renewal or soft-opt-in thresholds should reassess their marketing-consent practices against the updated 2026 text. #### Outlook The practical enforcement application of Recommendation 01/2026 -- particularly whether the APD/GBA brings any enforcement action explicitly citing the new recommendation's profiling or consent-renewal provisions -- is the item to watch in the coming cycles. Periodic update · new data 2026-09-14 #### AdTech & Commercial Privacy On 7 January 2026 the Belgian Market Court annulled the APD's January 2023 decision validating IAB Europe's Transparency and Consent Framework corrective action plan. Critically, the annulment did not disturb the underlying February 2022 finding that TC-String processing breaches the GDPR; the Market Court's ruling concerned only the adequacy of the APD's validation of the corrective action plan meant to remedy that underlying breach, requiring the APD to redo its validation with a narrower scope after a formal hearing. This sits alongside the Market Court's separate confirmation that IAB Europe acts as joint data controller for TC String processing, reinforcing rather than undermining the substantive finding of GDPR non-compliance in the Transparency and Consent Framework's operation. Taken together, these developments indicate that while the mechanics of remedying the underlying breach remain procedurally unresolved, the underlying characterisation of the breach itself, and of IAB Europe's controller status, has been judicially confirmed rather than called into question. #### Outlook The APD's re-issued validation decision for the corrective action plan, expected following the required formal hearing, is the key item to watch. Its narrower scope, as directed by the Market Court, should clarify precisely what remedial measures the APD now considers sufficient to bring the Transparency and Consent Framework into compliance, which will be directly relevant to any organisation relying on that framework for advertising consent management. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 46 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Strong sourced coverage on biometric DPIA triggers and state-surveillance carve-outs; profiling/ADM-transparency and genetic-data specifics were not substantiated, and AI risk-assessment rules remain proposals. Primary framework GDPR Article 22 and Title 3 of the Belgian Act of 30 July 2018; EU AI Act (interfacing, not yet Belgium-specific) Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Red Strong sourced coverage on biometric DPIA triggers and state-surveillance carve-outs; profiling/ADM-transparency and genetic-data specifics were not substantiated, and AI risk-assessment rules remain proposals. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Belgium missed the EU AI Act's Article 70 deadline of 2 August 2025 to designate national competent authorities and market-surveillance authorities for the Regulation. As of this cycle, BIPT is the authority proposed under a federal cooperation agreement to take the lead role, but that designation has not been given statutory force. A representative of FOD Economie, Etienne Mignolet, confirmed that the reading of a legal vacuum is correct: from 2 August 2026, the rights created by the AI Act in Belgium can only be enforced through the courts, since no administrative enforcement authority has been formally designated to exercise the Regulation's market-surveillance and enforcement powers domestically. This is the most consequential regulatory-gap finding of this cycle for Belgium: a confirmed, dated administrative enforcement vacuum for the AI Act, distinct from and outside the scope of GDPR enforcement (which continues under the APD/GBA regardless) or any financial-sector-specific carve-out that might otherwise provide a supervisory backstop. The gap is specifically about who has administrative power to enforce the AI Act's substantive obligations in Belgium, not about whether those obligations exist; the AI Act's substantive provisions remain legally in force, but a person seeking to vindicate rights under it in Belgium must currently proceed through the courts rather than through a dedicated regulator. #### Outlook The open question is whether and when Belgium formally designates BIPT, or another authority, with statutory enforcement powers under the AI Act, closing the gap FOD Economie has confirmed exists as of 2 August 2026. No legislative timetable for that designation was located this cycle. Until a designation is enacted, the court-only enforcement route identified by FOD Economie remains the operative mechanism for AI Act rights in Belgium. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 58 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong sourced coverage of the age-13 threshold and parental-consent rule; education-settings and dependent-adults sub-modules carry an evidentiary gap. Primary framework Belgian Act of 30 July 2018, Article on children's consent (derogating from GDPR Article 8 default age of 16) Supervisory authority [Belgian Data Protection Authority (APD-GBA)](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Amber Strong sourced coverage of the age-13 threshold and parental-consent rule; education-settings and dependent-adults sub-modules carry an evidentiary gap. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups The APD/GBA's 2026-2028 Strategic Plan names minors' data processing as a priority area, with specialised Data Protection Impact Assessment (DPIA) templates for minors' data reportedly planned. This is assessed as probable rather than confirmed: the Strategic Plan's stated prioritisation is reported via secondary sources, and no primary-source publication of the planned specialised DPIA templates themselves was located this cycle. The distinction matters -- a stated intent to develop specialised templates is a different, and less binding, development than the templates' actual publication and entry into use. No further children-and-vulnerable-groups-specific instrument, enforcement action, or guidance document was identified this cycle beyond this Strategic Plan prioritisation signal. #### Outlook Whether the planned specialised DPIA templates for minors' data are actually published, and what specific assessment criteria they introduce, is the key item to watch in coming cycles. Publication would represent a material escalation from the current planning-stage signal to a binding or quasi-binding compliance instrument. D9 · Children's Privacy — Full Module Record 5 sub-modules · 41 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Belgium: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Robust, judicially-tested enforcement powers with continuous 2026 enforcement activity; capacity/independence concerns are a noted but non-disqualifying risk factor. Primary framework GDPR Articles 58, 77-84 as applied via the Belgian Act of 30 July 2018 Supervisory authority [Belgian Data Protection Authority (APD-GBA) — Litigation Chamber](https://www.autoriteprotectiondonnees.be) Traffic-light rationale — Green Robust, judicially-tested enforcement powers with continuous 2026 enforcement activity; capacity/independence concerns are a noted but non-disqualifying risk factor. Periodic update · new data 2026-10-25 #### Enforcement & Redress Belgium's enforcement and redress landscape this period is dominated by the European Data Protection Board's binding intervention into the Belgian data protection authority's own complaint-handling practice. Binding Decision 1/2026, adopted 28 May 2026 and published 14 July 2026, found that the Belgian authority had wrongly dismissed a NOYB-led complaint against VRT over cookie-banner practices as an abuse of the right to complain under Articles 77 and 80(1) of the General Data Protection Regulation. The Board ordered the Belgian authority, as lead supervisory authority, to assess the complaint on its merits and to produce a new draft decision under the Article 60(3) cooperation mechanism. An information notice from the Belgian authority dated 13 July 2026 confirmed this obligation. This is a notable instance of the European-level dispute-resolution architecture being used to correct a national authority's procedural handling of a complaint, rather than its substantive privacy findings, and the Belgian authority's own merits decision remains the open item. Separately, and on a smaller scale, the Belgian authority fined a law firm EUR 4,920 on 8 May 2026 for insufficiently fulfilling a data-subject access request: the firm had charged a fee on an unsubstantiated manifestly-unfounded-or-excessive claim and lacked a privacy policy. This is a routine enforcement action by comparison with the VRT matter, but it confirms the authority continues to issue fines for access-right process failures at the smaller end of its enforcement activity, alongside the larger procedural matter working through the European cooperation mechanism. #### Outlook The Belgian authority's forthcoming merits-stage decision on the VRT cookie-banner complaint is the clearest and most consequential item to watch in Belgian data protection enforcement; it will be the authority's first opportunity to state its substantive view on the underlying consent-architecture question since the European Board's order. No further procedural development is expected in the law firm access-rights matter, which appears closed. Periodic update · new data 2026-10-18 #### Enforcement & Redress The APD/GBA's 2026-2028 Strategic Plan sets out a shift in enforcement posture described as a move from individual complaint-handling toward what the authority terms Systemic Impact Enforcement. Under this approach, smaller disputes are directed into a mediation-first track, but companies that do not engage constructively in that mediation can expect a fast-track escalation directly into formal enforcement. This is a procedural posture change rather than a change to the underlying statutory powers or fine levels the APD/GBA may impose. Those underlying statutory powers remain as previously established: Belgium's Law of 30 July 2018, at Articles 221 to 230, provides for criminal sanctions of fines up to EUR 160,000 plus imprisonment for serious breaches of the GDPR, running alongside and in addition to the standard administrative-fine tiers set by GDPR Article 83. The same 2018 Law, at Article 4, exempts federal and regional public authorities from APD administrative fines; the Belgian Constitutional Court has upheld that exemption as proportionate and justified. No change to either the criminal-sanctions figures or the public-authority exemption was located this cycle; both stand as the long-established enforcement architecture against which the Strategic Plan's procedural shift now operates. #### Outlook The practical effect of the mediation-first, fast-track-escalation posture described in the 2026-2028 Strategic Plan will become visible as individual cases move through the new process; no specific case outcomes under the new posture were located this cycle. Readers monitoring enforcement trends for Belgium should expect the volume and framing of published Litigation Chamber decisions to shift as the mediation-first track filters out matters that previously would have proceeded straight to a decision. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Belgian Data Protection Authority's Litigation Chamber (Geschillenkamer) holds the power to impose administrative fines under GDPR Article 58.2(i), a power carried into Belgian domestic law by Article 100 Section 1 of the Law of 3 December 2017, commonly referred to as the WOG. The fines the Litigation Chamber may impose are capped at the Article 83 maxima set out in the GDPR itself, which is the higher of EUR20,000,000 or 4 percent of a company's total worldwide annual turnover. This statutory basis is directly corroborated by the Litigation Chamber's own decision 99/2026, which states in its original Dutch text that the Chamber imposes the administrative fine in application of Article 58.2(i), a direct quotation that confirms the fining power is being exercised on the precise legal basis the WOG and the GDPR together establish. This enforcement architecture also bears on the pending CJEU litigation in APD/GBA v. Diocese of Ghent, since the Litigation Chamber's powers over erasure-related enforcement would extend to religious-register contexts if the Court follows Advocate-General Medina's October 2026 opinion that the GDPR applies to baptismal-register data. The Chamber's fining and corrective powers under Article 58.2(i) would, in that scenario, become directly relevant to any Belgian religious institution found not to have complied with an erasure request falling within the scope the Advocate-General's opinion describes. Separately, the Litigation Chamber's July 2026 settlement decision against a company for a non-compliant direct-marketing unsubscribe mechanism, resulting in a EUR5,000 fine and a thirty-day correction order, is a further concrete instance of the same Article 58.2(i) power being exercised, albeit at a considerably smaller scale than the Article 83 maxima permit. #### Outlook The scope of the Litigation Chamber's enforcement reach into religious and historical-register erasure disputes depends directly on the outcome of the pending CJEU judgment in APD/GBA v. Diocese of Ghent, expected in the first quarter of 2027. Until that judgment is handed down, the Chamber's Article 58.2(i) powers continue to be exercised in more conventional enforcement contexts, as the July 2026 direct-marketing settlement illustrates. Periodic update · new data 2026-09-28 #### Enforcement & Redress Belgium's enforcement and redress landscape this cycle presents a mixed picture of high procedural volume alongside low aggregate financial penalties and meaningful appellate friction. The Litigation Chamber issued 214 decisions in 2025, but total fines imposed across those decisions amounted to only EUR 75,700 in aggregate -- a notably low financial total relative to the decision count, consistent with an enforcement style weighted toward corrective and procedural remedies rather than large monetary penalties. Appellate outcomes complicate the enforcement picture further. The Brussels Market Court issued 25 rulings in 2025 (9 final, 3 interim) on 20 appeals against Litigation Chamber decisions, and 13 of those decisions were totally or partially annulled. A roughly half-to-majority annulment rate on appealed decisions is a material signal about the durability of the Litigation Chamber's enforcement output, though it should be read alongside the caveat that no primary-source confirmation of this specific statistic beyond the secondary reporting was located this cycle. Separately, and illustrating a different enforcement tool, the APD/GBA is understood to have imposed a daily penalty of EUR 40,000 on RTL Belgium for GDPR violations related to non-compliant cookie banners -- a continuing-violation penalty structure distinct from the one-off fine amounts reflected in the EUR 75,700 aggregate figure above, and a standing precedent for how the DPA can escalate penalties for unresolved ongoing violations. #### Outlook The high Market Court annulment rate is the most consequential open question for Belgium's enforcement credibility going forward: whether this rate persists, worsens, or improves as more Litigation Chamber decisions move through the appellate pipeline will materially affect how durable the DPA's enforcement output proves to be. Primary-source confirmation of the annulment statistic itself would also strengthen this finding's evidentiary basis. Periodic update · new data 2026-09-14 #### Enforcement & Redress Belgium's enforcement and redress landscape is escalating this cycle, driven by an active caseload centred on two major proceedings: the Market Court's 7 January 2026 annulment of the APD's IAB Europe TCF corrective action plan validation, and the Market Court's 4 December 2025 referral of thirteen preliminary questions to the CJEU following the Litigation Chamber's finding that FPS Finance's FATCA-related transfers to the United States were unlawful. Both proceedings remain active, with outcomes pending. These two proceedings sit against a backdrop of historical enforcement precedent, including the Litigation Chamber's Decision 21/2022, which imposed an administrative fine of EUR 250,000 on IAB Europe, and a separate fine of EUR 174,640 recorded in Decision 07/2024. The confirmed, escalating trajectory this cycle reflects both the scale of the two active Market Court proceedings and the APD's own stated strategic shift toward proactive Systemic Impact Enforcement, which would, if realised, add a further category of self-initiated audit activity to the regulator's enforcement toolkit alongside its existing complaint-driven and judicial-appeal caseload. #### Outlook The resolution timelines for the two active Market Court proceedings, the TCF corrective action plan re-validation and the CJEU's ruling on the FATCA-related referral, are the primary enforcement developments to track. The APD's first concrete Systemic Impact Enforcement outputs, expected as the 2026-2028 Strategic Plan matures, will be the clearest signal of whether the proactive enforcement shift is translating into comparable or greater enforcement volume than the historical complaint-driven model. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 85 words · 13 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (35 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 13-14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16-17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure