Belgium

The national layer is the Act of 30 July 2018 on the protection of natural persons with regard to personal data. Article 7 sets the digital consent age at 13. That is the lowest age the General Data Protection Regulation allows, rather than the 16-year default. Below 13 the legal representative must consent. Article 228 covers fines imposed on staff or agents. Three parties can be made to pay them: the company that decides how data is used, its supplier, or that supplier's representative in Belgium. That is unusual drafting. It matters when a foreign group relies on a thin Belgian entity. There is no separate Belgian registration, licence or filing before you may use personal data. The only routine filing is telling the regulator your data protection officer's contact details.

Industry by industry, checked 18 August 2026. GAMBLING: the strictest rule in the country. Article 43/8 of the Gambling Act of 7 May 1999 requires the Royal Decree on supervision of online games to include one condition as a minimum. The servers managing the website's data and structure must sit in a permanent establishment on Belgian territory. This is a licence condition, so the punishment is losing the licence, not a fine. TELECOM: article 126 of the Telecommunications Act of 13 June 2005 was replaced by the Act of 20 July 2022. It makes operators keep subscriber identification data and metadata on European Union territory. They must also supply requested data in Belgium. BANKING, PAYMENTS, INSURANCE, SECURITIES: we found no rule forcing data to stay in a particular country. The European Digital Operational Resilience Act has applied since 17 January 2025 and governs here. The National Bank of Belgium's 2020 cloud outsourcing circular makes you know and disclose where data sits, and tell the Bank about material outsourcing. It does not require Belgian or European storage. The Financial Services and Markets Authority supervises actively, including a June 2026 communication on frontier artificial intelligence systems and cyber risk. HEALTH: we found no Belgian equivalent of France's compulsory health-data hosting certification. The federal Health Data Agency, created for secondary use of health data, is working. It is Belgium's route into the European Health Data Space. GOVERNMENT: we found no law forcing data to stay in Belgium. The federal G-Cloud offers in-country hosting as a buying choice, not a legal duty. EDUCATION, GEOSPATIAL, DEFENCE: no rule forcing data to stay in the country was found. Remember that Regulation (EU) 2018/1807 stops member states from forcing non-personal data to stay in their country, except on public-security grounds.

The approved-destination list currently runs to sixteen countries and territories, plus the European Patent Organisation. The United States counts only for organisations that have self-certified under the European Union-United States Data Privacy Framework. That arrangement is under legal and political pressure. The European Data Protection Board formally wrote to the Commission on 31 July 2026, asking it to examine whether the decision is still valid. It has not been suspended. Treat it as usable, but never as your only route. The 2021 standard contractual clauses are still the ones to use. The promised new clauses, for importers already directly caught by the General Data Protection Regulation, have still not been adopted. Belgium adds one more thing. Sending personal data abroad in breach of the European safeguards is a criminal offence under the Act of 30 July 2018. It is punishable by a fine, and the court may order the judgment printed in newspapers at your expense.

The Authority was created inside the Chamber of Representatives by the Act of 3 December 2017. It succeeded the old Privacy Commission. Its president is Koen Gorissen. It has a General Secretariat, a First Line Service, a Knowledge Centre, an Inspection Service and a Litigation Chamber, plus a management committee. It handles a lot of cases, but individual fines are modest by European standards. That is why the honest rating is active rather than aggressive. It decides a lot of complaints rather than hunting large penalties. Its most-cited case was against a digital advertising standards body. It was decided in 2022, upheld in substance, and annulled on a procedural defect by the Market Court. It remains the reference point for online advertising consent in Europe. Other enforcers: the Centre for Cybersecurity Belgium for the network and information security law; the Belgian Institute for Postal Services and Telecommunications for operators; the Gaming Commission for gambling licences; and the National Bank of Belgium and the Financial Services and Markets Authority for financial firms.

Minimum keeping periods. Accounting: seven years from 1 January of the year following the closing of the books. Three years for supporting documents not intended to serve as evidence against third parties. That comes from the Accounting Act as read by the Accounting Standards Commission. Telecom minimums under the Act of 20 July 2022: subscriber identification data for as long as the service is used, plus twelve months after it ends; certain traffic data for twelve months from the date of an incoming communication, so the sender can be identified; a shorter four-month period for some traffic data of interpersonal communications services; and a reduced six-month period for one category of session data where the operator keeps an alternative identifier. Deletion. The Camera Act sets a maximum of one month in principle for surveillance footage. That can be extended only in defined cases. It comes with a duty to notify the cameras and keep an internal register. A separate value-added-tax keeping period for invoices also applies, and it is longer than the accounting period. We could not verify its current length against an official source, so we have flagged it.

Belgium was the first European Union member state to write the second network and information security directive into national law. That is the Act of 26 April 2024, in force 18 October 2024. The Centre for Cybersecurity Belgium's own notification guide sets the deadlines. An early warning within 24 hours of learning about the significant incident. An incident notification within 72 hours, or 24 hours for trust service providers. An intermediate report if the national computer security incident response team or the industry regulator asks for one. And a final report no later than one month after the incident notification. If the incident is still running, you send progress reports, then a final report within one month of the incident being dealt with. The guide stresses that these are all outer limits. The duty is to notify without undue delay. You get the full period only in special circumstances that you can justify.

(1) Article 222 of the Act of 30 July 2018 creates criminal fines of 250 to 15,000 euro. They apply to unlawful international transfer, to using personal data with no legal basis, to ignoring a regulator's order, and to obstructing an inspection. Belgian criminal law then applies statutory multipliers to all fines. Article 225 allows publication of the judgment. Article 230 applies Book I of the Criminal Code, which brings criminal liability for companies into play. (2) Article 229, paragraph 2 applies where there is no protocol between the regulator and the prosecution service. The public prosecutor then has two months from receiving the report to say a criminal investigation has started. That notice removes the regulator's power to use its corrective powers. (3) Article 221, paragraph 2 switches off the European fining article for public authorities and their staff. The exception is a body governed by public law that offers products or services on a market. (4) The minister responsible for the Interior authorises access to National Register data and use of the National Register number. That comes from the Act of 8 August 1983, as amended in 2018. The old committee's general authorisations survive, but new users must apply. (5) A further trap for telecom operators. Article 107/5 of the Telecommunications Act says a foreign operator's use of encryption cannot stop a Belgian authority's targeted request being carried out. Any contract clause that gets in the way is void automatically.

Confirmed and dated: the Data Protection Authority's Strategic Plan 2026-2028 was published on 23 December 2025. It commits to more supervision on the Authority's own initiative, to faster and more accessible dispute handling, and to two themed priorities. Those are large-scale high-risk use of data, and the personal data of minors. From Europe: the Data Act's firm deadline of 12 January 2027 for zero cloud switching and egress charges. The European Union-United States Data Privacy Framework remains in force. But on 31 July 2026 the European Data Protection Board asked the Commission to examine whether it is still valid. An appeal against the General Court's Latombe judgment is also pending. The Digital Omnibus proposal of 19 November 2025 is not adopted and has no legal effect. THREE POWERS THAT CAN CHANGE OVERNIGHT WITH NO CONSULTATION. First, the ministerial decree that names which judicial districts and police zones are subject to telecom data retention, and for how long. It was last remade on 28 March 2024, after an earlier version of 30 March 2023. Second, the Royal Decree confirming the threat level across the whole territory. That is the mechanism that widens targeted retention into general nationwide retention. Third, the Royal Decree setting online gambling licence conditions. That is where the Belgian server requirement actually lives, and it can be tightened without a new Act.