BelgiumGDPR Articles 12-21 and Act of 30 July 2018 Title 5, Data Subject Rights and Action en Cessation in Belgium
Regulation (EU) 2016/679, Arts. 12-21; Loi du 30 juillet 2018, Arts. 209-211, 220
In force since , effective .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Belgium within one month of receipt.
These lines are LexLint's reading of the law's text. Also read by: Gegevensbeschermingsautoriteit (Belgian Data Protection Authority) (guidance, recorded ); Case C-487/21 F.F. v Österreichische Datenschutzbehörde and CRIF, judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0487
- Guidance link
- https://www.gegevensbeschermingsautoriteit.be/burger/privacy/wat-zijn-mijn-rechten
- Case citation
- Case C-487/21 F.F. v Österreichische Datenschutzbehörde and CRIF, judgment of the Court of Justice of (First Chamber)
- Guidance body
- Gegevensbeschermingsautoriteit (Belgian Data Protection Authority)
- Open questions
- Does the requirement in Article 220, paragraph 2, point 4 of the Act of that a non-profit body has been active in data protection for at least three years bar a newly formed body from receiving a mandate under Article 80(1) of Regulation (EU) 2016/679?
What it makes you log
Logging duty
Articles 12 to 21 set response periods for data-subject requests, and Articles 209 to 211 and 220 of the Act of give a court route and a representation right. None of them requires a log or a record.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Belgium can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
The Loi du 30 juillet 2018 adds a court route: on an action en cessation brought by the data subject or the supervisory authority, the president of the court of first instance, sitting as in summary proceedings, can find that processing breaches data-protection law and order it to stop, and can order rectification or erasure or ban the use of inaccurate, incomplete or unlawfully kept data (Arts. 209 to 211). Article 220 lets a person mandate a non-profit body to lodge a complaint and bring those actions on their behalf.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .