Belgium

The national layer is the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. Article 7 fixes the digital consent age at 13, the floor the General Data Protection Regulation allows, rather than the 16-year default. Below 13 the legal representative must consent. Article 228 makes the controller, the processor or its representative in Belgium liable for paying fines imposed on their staff or agents, which is unusual drafting and matters when a foreign group relies on a thin Belgian entity. There is no separate Belgian registration, licence or filing before you may process personal data; the only routine filing is notifying your data protection officer's contact details to the regulator.

Sector by sector, checked 18 August 2026. GAMBLING: the strictest rule in the country. Article 43/8 of the Gambling Act of 7 May 1999 requires the Royal Decree on supervision of online games to contain, at minimum, the condition that the servers managing the website's data and structure sit in a permanent establishment on Belgian territory. This is a licence condition, so the sanction is losing the licence, not a fine. TELECOM: article 126 of the Telecommunications Act of 13 June 2005, as replaced by the Act of 20 July 2022, obliges operators to retain subscriber identification data and metadata on European Union territory and to supply requested data in Belgium. BANKING, PAYMENTS, INSURANCE, SECURITIES: no localisation rule found. The European Digital Operational Resilience Act has applied since 17 January 2025 and governs; the National Bank of Belgium's 2020 cloud outsourcing circular requires you to know and disclose where data sits and to notify material outsourcing, but does not require Belgian or European storage. The Financial Services and Markets Authority is running active supervision, including a June 2026 communication on frontier artificial intelligence systems and cyber risk. HEALTH: no Belgian equivalent of France's compulsory health-data hosting certification was found. The federal Health Data Agency, created for secondary use of health data, is operational and is Belgium's route into the European Health Data Space. GOVERNMENT: no statutory localisation found; the federal G-Cloud offers in-country hosting as a procurement choice, not a legal duty. EDUCATION, GEOSPATIAL, DEFENCE: no localisation rule found. Remember that Regulation (EU) 2018/1807 forbids member states from imposing localisation on non-personal data except on public-security grounds.

The approved-destination list is populated and currently runs to sixteen countries and territories plus the European Patent Organisation. The United States counts only for organisations that have self-certified under the European Union-United States Data Privacy Framework, and that framework is under legal and political pressure: the European Data Protection Board formally wrote to the Commission on 31 July 2026 asking it to examine whether the decision is still valid. It has not been suspended. Treat it as usable but never as your only route. The 2021 standard contractual clauses remain the operative set; the promised new clauses for importers already directly caught by the General Data Protection Regulation are still not adopted. Belgium's own contribution is the sting in the tail: transferring personal data abroad in breach of the European safeguards is a criminal offence under the Act of 30 July 2018, punishable by a fine, and the court may order the judgment printed in newspapers at your expense.

The Authority was created inside the Chamber of Representatives by the Act of 3 December 2017 and succeeded the old Privacy Commission. Its president is Koen Gorissen. Structurally it has a General Secretariat, a First Line Service, a Knowledge Centre, an Inspection Service and a Litigation Chamber, plus a management committee. Volume is high but individual fines are modest by European standards, which is why the honest rating is active rather than aggressive: this is a regulator that decides a lot of complaints rather than one that hunts large penalties. Its most-cited case, against a digital advertising standards body, was decided in 2022, upheld in substance and annulled on a procedural defect by the Market Court, and remains the reference point for online advertising consent in Europe. Other enforcers: the Centre for Cybersecurity Belgium for the network and information security law, the Belgian Institute for Postal Services and Telecommunications for operators, the Gaming Commission for gambling licences, the National Bank of Belgium and the Financial Services and Markets Authority for financial firms.

Accounting floor: seven years from 1 January of the year following the closing of the books, three years for supporting documents not intended to serve as evidence against third parties, per the Accounting Act as read by the Accounting Standards Commission. Telecom floors under the Act of 20 July 2022: subscriber identification data for as long as the service is used plus twelve months after it ends; certain traffic data for twelve months from the date of an incoming communication so the sender can be identified; a shorter four-month period for some traffic data of interpersonal communications services; and a reduced six-month period for one category of session data where the operator keeps an alternative identifier. Ceiling: the Camera Act sets a maximum retention of one month in principle for surveillance footage, extendable only in defined cases, alongside a duty to notify the cameras and keep an internal register. A separate value-added-tax retention period for invoices also applies and is longer than the accounting period; we could not verify its current length against an official source and have flagged it.

Belgium was the first European Union member state to transpose the second network and information security directive: the Act of 26 April 2024, in force 18 October 2024. The Centre for Cybersecurity Belgium's own notification guide sets the clocks: early warning within 24 hours of becoming aware of the significant incident; incident notification within 72 hours, or 24 hours for trust service providers; an intermediate report on request of the national computer security incident response team or the sectoral authority; and a final report no later than one month after the incident notification. If the incident is still running, you send progress reports and then a final report within one month of the incident being dealt with. The guide stresses that all these are outer limits: the duty is to notify without undue delay, and the full period is available only in duly justified special circumstances.

(1) Article 222 of the Act of 30 July 2018 makes unlawful international transfer, processing without a legal basis, ignoring a regulator's order and obstructing an inspection punishable by a criminal fine of 250 to 15,000 euro, before the statutory multipliers that Belgian criminal law applies to all fines. Article 225 allows publication of the judgment. Article 230 applies Book I of the Criminal Code, which brings corporate criminal liability into play. (2) Article 229, paragraph 2: absent a protocol between the regulator and the prosecution service, the public prosecutor has two months from receiving the report to say a criminal investigation has started; that notification removes the regulator's power to use its corrective powers. (3) Article 221, paragraph 2 disapplies the European fining article to public authorities and their staff, unless the body is a legal person governed by public law that offers products or services on a market. (4) Access to National Register data and use of the National Register number is authorised by the minister responsible for the Interior under the Act of 8 August 1983 as amended in 2018; the old sectoral committee's general authorisations survive but new users must apply. (5) A further trap for telecom operators: article 107/5 of the Telecommunications Act says a foreign operator's use of encryption cannot prevent a Belgian authority's targeted request being executed, and any contract clause obstructing that is void by operation of law.

Confirmed and dated: the Data Protection Authority's Strategic Plan 2026-2028 was published on 23 December 2025 and commits to more own-initiative supervision, faster and more accessible dispute handling, and two thematic priorities, large-scale high-risk processing and the personal data of minors. From Europe: the Data Act's hard deadline of 12 January 2027 for zero cloud switching and egress charges; the European Union-United States Data Privacy Framework remains in force but the European Data Protection Board asked the Commission on 31 July 2026 to examine its continued validity, and an appeal against the General Court's Latombe judgment is pending. The Digital Omnibus proposal of 19 November 2025 is not adopted and has no legal effect. DORMANT SWITCHES that can move overnight with no consultation: first, the ministerial decree that names which judicial districts and police zones are subject to telecom data retention and for how long, last remade on 28 March 2024 after an earlier version of 30 March 2023; second, the Royal Decree confirming the threat level across the whole territory, which is the mechanism that widens targeted retention into general nationwide retention; third, the Royal Decree setting online gambling licence conditions, which is where the Belgian server requirement actually lives and can be tightened without primary legislation.