🇧🇪Act of 30 July 2018 on the Protection of Natural Persons with Regard to Processing of Personal Data

← Back to laws in Belgium

Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data

Belgium applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act implements GDPR opening clauses and also contains separate regimes for law enforcement, intelligence, defence and other security-related processing.

National additions and variations

• Article 7 sets 13 as the Article 8 age for a child to consent to a directly offered information-society service; consent below 13 must come from the legal representative.
• Articles 8 and 9 require access-category lists and confidentiality safeguards for specified substantial-public-interest, genetic, biometric and health-data processing.
• Article 10 limits criminal-conviction and offence data to enumerated settings and applies access-list and confidentiality safeguards.
• Title 4 creates a detailed archiving, research and statistics regime: documented justifications, staged anonymisation or pseudonymisation, controlled de-pseudonymisation and dissemination restrictions.
• The Act allocates supervision among the general DPA and specialised bodies for police, intelligence and security processing; the correct route must be identified before handling a complaint or incident.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.