OneClickComply
    Book a demo
    Belgian Data Protection Act (Act of 30 July 2018)Supported in OneClickComply

    Meet the Belgian Data Protection Act alongside your GDPR controls

    The Belgian Data Protection Act is the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, which supplements the GDPR in Belgium.

    See the Belgian Data Protection Act requirements
    Belgian Data Protection Act mapped
    Automated evidence
    Continuous monitoring
    Who needs the Belgian Data Protection Act

    Is the Belgian Data Protection Act right for your organisation?

    It sets national rules on matters the GDPR leaves to member states, such as the age of consent for online services, sensitive and criminal data, and public sector data sharing. It also transposes the Law Enforcement Directive and repealed the Privacy Act of 8 December 1992.

    Any controller or processor established in Belgium must comply, as must organisations processing personal data of people in Belgium in the circumstances set out in Article 4. Private companies are mainly affected by Title 1, which applies in addition to the GDPR, while police, intelligence and other public bodies have their own titles. It matters most when you expand into Belgium, process health, biometric or criminal data, or work with Belgian public authorities.

    How we help

    How OneClickComply helps with the Belgian Data Protection Act

    OneClickComply supports the Belgian Data Protection Act today, so your GDPR and ISO 27001 controls can be reused rather than rebuilt. OneClickComply collects security evidence automatically, generates privacy policies from your real environment and tracks Belgian-specific duties such as access lists for health, genetic and biometric data. Our in-house audit team can advise on gaps through Ask an Auditor.

    Requirements covered

    286 articles across a preliminary title and 8 titles, with GDPR-supplementing rules for most organisations in Title 1 (Articles 6 to 24) and penalties in Title 6 (Articles 221 to 230).

    Why automate

    Manual Belgian Data Protection Act compliance vs OneClickComply

    Doing it manually

    • Working out which Belgian rules add to the GDPR and which do not apply to you
    • Keeping lists of people with access to health, genetic and biometric data by hand
    • Duplicating GDPR work because nothing maps across to the Belgian Act
    • Chasing screenshots to prove security measures are in place
    • Finding gaps only when the Data Protection Authority asks questions

    With OneClickComply

    • Ask an Auditor gives expert guidance on Belgian-specific obligations
    • Access reviews and evidence collection keep sensitive data access lists current
    • Control mapping reuses your GDPR evidence across the Belgian Act
    • Evidence is collected automatically from connected tools
    • Continuous monitoring flags control drift before a regulator does
    Capabilities

    Everything you need for the Belgian Data Protection Act

    • Map existing GDPR and ISO 27001 controls to Belgian Act articles

    • Collect security evidence automatically from 13,000+ integrations

    • Generate privacy and security policies with AutoComplete

    • Track access lists and confidentiality duties for sensitive data

    • Assess processors and vendors through vendor risk management

    • Monitor controls continuously, with alerts when they drift

    How it works

    Three steps to Belgian Data Protection Act compliance

    1. Connect and scan

      Connect your cloud, identity and SaaS tools. OneClickComply checks them against the Belgian Data Protection Act and shows which controls pass and which fail.

    2. Fix and generate

      OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts Belgian Data Protection Act policies from your real environment.

    3. Monitor and evidence

      Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.

    See how far your current setup is from the Belgian Data Protection Act.

    Requirements

    Belgian Data Protection Act (Act of 30 July 2018) requirements

    Every article of Title 1, which supplements the GDPR for most organisations, listed individually, with the public authority, research, remedies, penalties and final titles shown as article ranges.

    ReferenceRequirement
    Art. 1Constitutional basis of the Act
    Art. 2Material scope
    Art. 3Free movement of personal data
    Art. 4Territorial scope
    Art. 5Definitions and meaning of public authority
    Art. 6Title 1 enforces the GDPR
    Art. 7Child's consent for information society services (age 13)
    Art. 8Special category processing for substantial public interest
    Art. 9Additional measures for genetic, biometric and health data
    Art. 10Processing of criminal convictions and offences data
    Art. 11Restriction of rights for data from intelligence and security authorities
    Art. 12No notification of disclosures to security authorities
    Art. 13Security of direct database access by security authorities
    Art. 14Restriction of rights for data from judicial and police authorities
    Art. 15Restriction of rights for Passenger Information Unit processing
    Art. 16Rights over data in judgments and criminal proceedings
    Art. 17Data provided to common databases
    Art. 18Accreditation of certification bodies
    Art. 19Police services treated as one public authority
    Art. 20Protocols for federal public sector data transfers

    Always check the official text of the Belgian Data Protection Act for the exact wording.

    FAQs

    Belgian Data Protection Act questions, answered

    Can't find what you need? Our in-house auditors can talk you through the Belgian Data Protection Act on a 30-minute call.

    What is the Belgian Data Protection Act?

    The Belgian Data Protection Act is the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. Published in the Belgian Official Journal on 5 September 2018, it supplements the GDPR with national rules, transposes the EU Law Enforcement Directive for police and justice authorities, regulates processing by intelligence services and sets criminal penalties. It replaced the Privacy Act of 8 December 1992.

    Who must comply with the Belgian Data Protection Act?

    The Act applies to processing in the context of an establishment of a controller or processor in Belgium, wherever the processing takes place, and in some cases to processing of data about people in Belgium by controllers outside the EU. Businesses are mainly affected by Title 1, which applies alongside the GDPR. Police, justice, intelligence and other public authorities are covered by separate titles.

    What does the Belgian Act add to the GDPR?

    It uses the GDPR's opening clauses to set Belgian rules. Examples include a digital age of consent of 13, extra measures for genetic, biometric and health data such as a list of people with access, conditions for processing criminal data, restrictions on data subject rights for security bodies, protocols for federal public sector data sharing, exemptions for journalism and research safeguards in Title 4.

    What are the penalties under the Belgian Data Protection Act?

    The Belgian Data Protection Authority can use its GDPR corrective powers and impose GDPR administrative fines, up to EUR 20 million or 4% of worldwide annual turnover for the most serious infringements. The Act adds criminal fines in Articles 222 to 230, for example for processing without a legal basis or obstructing the authority. Under Article 221, GDPR fines generally do not apply to public authorities.

    What is the age of digital consent in Belgium?

    The age of digital consent in Belgium is 13. Article 7 of the Act of 30 July 2018 provides that a child aged 13 or over can consent to the processing of their personal data for information society services offered directly to them. For children under 13, consent must be given by the child's legal representative. This is lower than the GDPR default of 16.

    Who enforces data protection law in Belgium?

    The Belgian Data Protection Authority (Autorité de protection des données or Gegevensbeschermingsautoriteit) is the main supervisory authority for GDPR and Title 1 processing. It was set up by a separate Act of 3 December 2017. Other bodies supervise specific sectors, including the Supervisory Body for Police Information Management, which is established under Title 7 of the 2018 Act.

    How do you comply with the Belgian Data Protection Act?

    Start with full GDPR compliance, then apply the Belgian additions that fit your processing. Check the age of consent for online services, document who can access health, genetic and biometric data and bind them to confidentiality, meet the conditions for criminal data, and use protocols when exchanging data with federal authorities. Keep records, policies and security evidence ready for the Data Protection Authority.

    Does OneClickComply support the Belgian Data Protection Act?

    Yes. OneClickComply supports the Belgian Data Protection Act today. It lets you reuse your GDPR and ISO 27001 controls and evidence against the Act, with automated evidence collection, policy generation and continuous monitoring. OneClickComply does not certify compliance, but our in-house audit team can guide you through gaps via Ask an Auditor.

    Start working towards the Belgian Data Protection Act

    Automate controls, gather evidence continuously and stay audit-ready, all on one platform.