Processes personal data, in Belgium
Each law's tag says when it binds: since in force proposed proposed
Code de Droit Économique Article XVII.37, 10 degrees/1, Collective Redress for GDPR Claimssince 1 line
Code de droit economique, Art. XVII.37, 10 degrees/1, as inserted by the Loi du 30 juillet 2018 portant dispositions diverses en matiere d'Economie (numac 2018031589), Art. 43 · Read the law's page
- Comply with the GDPR toward Belgian data subjects, since a breach can found a collective redress action by a qualified consumer entity under Code de droit economique Book XVII, Title 2, in addition to any individual Article 82 claim.
Act of 3 December 2017, GBA/APD and Litigation Chambersince 1 line
Loi du 3 decembre 2017 portant creation de l'Autorite de protection des donnees (numac 2017031916) · Read the law's page
- Pay an administrative fine imposed by the GBA/APD Litigation Chamber within thirty days of the registered-mail notice of the decision, under Act of Article 102.
GDPR Articles 12-21 and Act of 30 July 2018 Title 5, Data Subject Rights and Action en Cessation in Belgiumsince 1 line
Regulation (EU) 2016/679, Arts. 12-21; Loi du 30 juillet 2018, Arts. 209-211, 220 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Belgium within one month of receipt.
GDPR Articles 33-34, Breach Notificationsince 2 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify the GBA/APD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Belgium, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
GDPR Chapter V and Act Article 222, 4, Cross-Border Transfer Restrictionssince 1 line
Regulation (EU) 2016/679, Arts. 44-49; Loi du 30 juillet 2018, Art. 222, 4 · Read the law's page
- Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Belgium outside the EEA; a grossly negligent or malicious breach is a criminal offense under Act Article 222, 4.
Act of 30 July 2018 on the Protection of Natural Persons with regard to Personal Datasince 1 line
Loi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581) · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Belgium, and treat 13 as the digital-consent age under Act Article 7 for information-society services offered directly to a child.
Act of 30 July 2018 Title 6 Chapter II, Criminal Sanctionssince 1 line
Loi du 30 juillet 2018, Arts. 222-230 · Read the law's page
- Do not process personal data of a person in Belgium without a legal basis under GDPR Article 6, under Act of Article 222.
Avant-projet de loi (Council of Ministers, 18 July 2026), partial transposition of Directive (EU) 2024/2853 on liability for defective productsproposed1 line
Avant-projet de loi modifiant les dispositions du Code civil relatives à la responsabilité du fait des produits défectueux, et insérant l’article 877/1 dans le Code judiciaire · Read the law's page
- Answer for a defective product under the Civil Code provisions on liability for defective products, which the draft amends; the draft also inserts Article 877/1 into the Judicial Code.