BelgiumAct of 30 July 2018 on the Protection of Natural Persons with regard to Personal Data
Loi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Belgium, and treat 13 as the digital-consent age under Act Article 7 for information-society services offered directly to a child.
These lines are LexLint's reading of the law's text. Also read by: Gegevensbeschermingsautoriteit (Belgian Data Protection Authority) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://www.gegevensbeschermingsautoriteit.be/professioneel/avg/rechtsgronden
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber)
- Guidance body
- Gegevensbeschermingsautoriteit (Belgian Data Protection Authority)
- Open questions
- Does the age of 13 for consent in Article 7 of the Act of apply to a service established in another Member State that offers an information society service directly to children in Belgium?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Act requires the controller, and any processor, to draw up a list of the categories of persons who have access to the special-category data, with a description of each category's function, and to keep that list available to the supervisory authority. The clause names no log of individual accesses and no retention period.
- Kind
- Implicit
- As of
- Provision
- Article 8, paragraph 2, and Article 9, point 2 (a list of the categories of persons with access to special-category data, kept available to the supervisory authority)
- Trigger
- personal_data_processing
What this law does
Belgium gives the General Data Protection Regulation (GDPR) domestic effect through the Act of , published in the Moniteur belge on . Article 6 states Title 1 executes the Regulation; the Act sets the digital-consent age at 13 (Art. 7), designates public-interest processing categories under GDPR Article 9(2)(g) (Art. 8), and adds criminal-conviction-data grounds (Art. 10). The supervisory structure sits in a separate statute, the Act of . The Act has been amended seven times on the Justel record, most recently in 2024.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .