BelgiumGDPR Articles 33-34, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
A breach notification rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Notify the GBA/APD within 72 hours of becoming aware of a personal-data breach affecting a person in Belgium, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A controller must notify the GBA/APD within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. No Belgium-specific derogation from this timeline or threshold was found in the Act of 30 July 2018.
A related but distinct power, Act of 3 December 2017 Article 100, 7, lets the Litigation Chamber order that a data subject be informed of a security problem, a corrective power over an Article 34 failure rather than a separate notification duty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometrics
Read the law
GDPR Arts. 33-34
Act of 3 December 2017, Art. 100, 7
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.