Belgium Data Protection Act — Law of 30 July 2018
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentLawSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionEuropeRegion DetailBelgiumPublisherBelgian Federal Parliament; enforced by the Belgian Data Protection Authority (GBA/APD)
- VersioningVersionBelgium Data Protection Act (Law of 30 July 2018)Effective Date5 September 2018 (Article 20 after a six-month period)Issue Date30 July 2018 (published 5 September 2018)
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Belgian Data Protection Authority publishes an unofficial English translation of the consolidated Act, and the official text appears in the Belgian Official Journal. The text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- Belgium's Data Protection Act of July 30, 2018 supplements the GDPR using the options left to Member States.
- It entered into force on September 5, 2018 and is supervised by the Belgian Data Protection Authority.
- Article 7 sets 13 as the age of consent for information society services, and Article 10 limits criminal data processing to six situations.
- Organizations must list who can access sensitive data, keep that list available to the authority, and bind those people to confidentiality.
- Criminal fines of 250 to 15,000 euros apply to listed breaches under Article 222.
Overview
The Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data was published in the Belgian Official Journal on 5 September 2018, the day it entered into force. It supplements the EU General Data Protection Regulation (GDPR) by using the options the GDPR leaves to Member States, and it also covers processing by law enforcement authorities (Title 2) and other authorities (Title 3). The Belgian Data Protection Authority, established by the Act of 3 December 2017, supervises it.
For most organizations, Title 1 is what matters. Article 7 sets 13 as the age at which a child can consent to information society services, Article 9 adds measures for genetic, biometric, and health data, Article 10 limits the processing of criminal convictions and offences data to six situations, Article 8 lists processing treated as necessary for substantial public interest, and Article 24 exempts journalistic, academic, artistic, and literary processing from parts of the GDPR.
Organizations apply it alongside the GDPR. They list the categories of people who can access sensitive data, keep that list available to the supervisory authority, bind those people to confidentiality, check the six grounds before processing criminal data, and apply the age of 13 in children's services. Criminal fines of 250 to 15,000 euros apply to listed breaches (Article 222).
Why does it matter?
Belgium layers national rules on top of the GDPR, so a GDPR program that ignores them can miss the Belgian age of consent, the extra access safeguards for health data, and the grounds for criminal data.
Key benefits include:
- A fixed age of consent
Children aged 13 or over can consent to information society services offered directly to them; below 13, consent must come from the child's legal representative (Article 7).
- Specific safeguards for sensitive data
Controllers of genetic, biometric, and health data designate who can access it, keep that list for the supervisory authority, and bind those people to confidentiality (Article 9).
- Clear grounds for criminal data
Processing of criminal convictions and offences data is allowed only in six situations, such as managing one's own disputes, a lawyer's defense of a client, or explicit written consent (Article 10).
- Defined exemptions
Journalistic purposes and academic, artistic, or literary expression are exempt from listed GDPR articles, subject to conditions (Article 24).
- Clear territorial scope
The Act applies to controllers and processors established in Belgium, and to non-EU controllers that offer goods or services to people in Belgium or monitor their behavior there (Article 4).
How does it work?
The Act has a preliminary title and eight titles: Title 1 implements the GDPR, Title 2 covers competent authorities for criminal matters, Title 3 covers other authorities, Title 4 covers archiving, scientific, historical, and statistical processing, Title 5 covers remedies and representation of data subjects, Title 6 sets penalties, Title 7 covers the Supervisory Body for Police Information Management, and Title 8 holds the final provisions. Title 1 starts by stating that it enforces the GDPR (Article 6).
The Act applies to processing wholly or partly by automated means and to filing systems (Article 2). It applies to processing in the context of an establishment in Belgium, whether or not the processing takes place in Belgium (Article 4). It also provides that the free movement of personal data is not restricted for data protection reasons (Article 3). The Act entered into force on publication, except Article 20, which follows after a six-month period (Article 281).
In SmartSuite, Privacy Management holds the records of processing and requests, Compliance Management links Belgian provisions to GDPR controls and evidence, and Workflow Orchestration runs the access-list and review steps for sensitive data.
Key Elements
- Children's consent (Article 7)
Consent to information society services offered directly to a child is lawful from age 13. Below 13, the child's legal representative must consent.
- Substantial public interest (Article 8)
Lists processing treated as necessary for reasons of substantial public interest, such as certain processing by human rights associations or foundations that the King has authorized, and sets access-list and confidentiality duties.
- Genetic, biometric, and health data (Article 9)
Controllers designate the categories of people with access, describe their capacity, keep the list available to the supervisory authority, and ensure they are bound by a legal, statutory, or equivalent contractual confidentiality obligation.
- Criminal convictions and offences (Article 10)
Allowed for own disputes, a lawyer's defense of clients, substantial public interest tasks, research or archiving, explicit written consent, or data the person clearly made public, with the same access-list duties.
- Restrictions of data subject rights (Articles 11 to 13)
Certain GDPR transparency and data subject rights do not apply to data originating from the intelligence and security authorities in Title 3, and controllers of such data must keep access limited and the data protected.
- Public sector rules (Articles 19 to 23)
A federal public authority formalizes transfers of personal data to other bodies in a protocol negotiated with the recipient and published on its website, private bodies working for it may need a data protection officer, and a specific data protection impact assessment is required before the processing.
- Penalties (Articles 221 and 222)
The supervisory authority's GDPR corrective powers extend to Articles 7 to 10, 20 to 24, and 28 to 70 and to Title 4 (Article 221), GDPR fines under Article 83 do not apply to public authorities except those offering products and services on a market, and listed breaches carry criminal fines of 250 to 15,000 euros.
What does it cover?
The Act applies to the processing of personal data wholly or partly by automated means and to filing systems, in the context of an establishment in Belgium, and to non-EU controllers and processors that offer goods or services to people in Belgium or monitor their behavior there. It also applies where Belgian law applies under public international law (Article 4). Title 1 covers most private-sector processing; Titles 2 and 3 cover authorities.
What are its objectives?
The Act's provisions serve several purposes alongside the GDPR.
Enforce the GDPR in Belgium and exercise its national options (Article 6).
Ensure that the free movement of personal data is not restricted for data protection reasons (Article 3).
Set specific rules for competent authorities in criminal matters and for other authorities (Titles 2 and 3).
Give data subjects injunction actions and representation (Title 5).
Provide administrative and criminal penalties (Title 6).
Framework in Context
The Act works with the GDPR, so most organizations map it to GDPR controls first. National data protection laws such as the German BDSG and the Dutch UAVG fill the same role in other Member States, and Belgium's Act should be read with the Act of 3 December 2017 that created the Data Protection Authority. Teams also map it to Convention 108+ and ISO/IEC 27701.
Common Framework Mappings
Organizations that process personal data in Belgium map the Act to the frameworks below, starting with the GDPR.
Mapped frameworks include:
APEC PF
CCPA/CPRA
Convention 108+
GDPR
ISO 27701
NIST Privacy Framework v1.0
UK DPA 2018
How SmartSuite Supports Belgium Data Protection Act
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management for the record of processing and requests, and Compliance Management to link the Belgian provisions to GDPR controls and evidence.
Belgian provisions register
Record Articles 7 to 10 and 24 against the GDPR controls they modify, with owners and review dates.
Children's services and age checks
Track which services are offered directly to children, the age of 13 rule, and the consent record for under-13s.
Sensitive data access lists
Keep the list of categories of people with access to genetic, biometric, health, and criminal data, with their confidentiality undertakings.
Criminal data grounds
Record which of the six Article 10 grounds applies to each criminal data processing activity.
Requests and exemptions
Run data subject requests with Privacy Management and record any exemption relied on, such as journalism or the restrictions in Articles 11 to 13.
Reporting
Use Enterprise Reporting to show open requests, access-list reviews, and control status.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
The NIST Privacy Framework Version 1.0 is a voluntary tool for managing privacy risk: five Functions, 18 Categories, 100 Subcategories, Profiles and four Implementation Tiers.
The Data Protection Act 2018 (c. 12) supplements the UK GDPR, sets the law enforcement and intelligence services regimes and gives the Information Commission its powers.
Frequently Asked Questions For Belgium Data Protection Act — Law of 30 July 2018
It uses options the GDPR leaves to Member States: the age of 13 for children's consent (Article 7), additional measures for genetic, biometric, and health data (Article 9), the grounds for processing criminal convictions and offences data (Article 10), exemptions for journalism and academic, artistic, and literary expression (Article 24), and rules for public authorities. It also covers law enforcement and other authorities in Titles 2 and 3.
13. Processing of a child's personal data in relation to information society services offered directly to the child is lawful where the child is at least 13 and gives consent. Below 13, the child's legal representative must consent (Article 7).
In six situations: by a person managing their own disputes, by lawyers or legal advisers for a client's defense, by others for substantial public interest tasks set by law, for scientific, historical, or statistical research or archiving, with the data subject's explicit written consent, or where the data subject clearly disclosed the data (Article 10).
Yes in some cases. It applies to non-EU controllers and processors that process data of people in Belgium in connection with offering goods or services to them, or monitoring their behavior in Belgium (Article 4). It also applies to processing in the context of an establishment in Belgium, wherever the processing takes place.
The supervisory authority's GDPR corrective powers extend to the Act's articles listed in Article 221, and GDPR administrative fines do not apply to public authorities unless they offer products and services on a market. Listed breaches, such as processing without a legal basis or unlawful transfers, carry criminal fines of 250 to 15,000 euros (Article 222).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.