GDPR: Compliance for Belgian Companies

Introduction

The General Data Protection Regulation (GDPR), applicable since May 25, 2018, imposes strict obligations on all companies processing personal data of European residents. In Belgium, the Data Protection Authority (DPA) oversees compliance with these rules and can impose significant sanctions.

Fundamental principles of the GDPR

The 7 key principles

The GDPR is based on seven principles that every company must respect:

Legal bases for processing

To process personal data, you must have at least one legal basis:

• The consent of the data subject
• Performance of a contract
• A legal obligation
• Protection of vital interests
• Performance of a public interest task
• Legitimate interests of the data controller

Concrete obligations for your company

1. The record of processing activities

Any company with more than 250 employees (or processing sensitive data) must maintain a processing register. In practice, the DPA recommends that all companies maintain this register. It must contain:

• The purposes of each processing activity
• The categories of data processed
• The recipients of the data
• Retention periods
• Security measures in place

2. Information for data subjects

You must inform people whose data you process through a clear and accessible privacy policy containing:

• The identity of the data controller
• The purposes and legal bases of processing
• The recipients of the data
• The rights of data subjects (access, rectification, erasure, portability, objection)
• Retention periods
• The right to lodge a complaint with the DPA

3. The DPO (Data Protection Officer)

Appointing a DPO is mandatory if:

• You are a public authority or body
• Your core activities involve regular and systematic large-scale monitoring
• You process sensitive data on a large scale (health, convictions, etc.)

Even if not mandatory, appointing a DPO is recommended. The DPO can be an employee or an external service provider.

4. Data Protection Impact Assessment (DPIA)

A DPIA is required when processing is likely to result in a high risk to individuals' rights, particularly in cases of:

• Automated profiling with legal effects
• Large-scale processing of sensitive data
• Systematic monitoring of a publicly accessible area
• Use of new technologies

5. Data breach notification

In case of a data breach (leak, hacking, loss), you must:

• Notify the DPA within 72 hours if the breach presents a risk to individuals
• Inform data subjects if the risk is high
• Document all breaches, even minor ones

Belgian DPA sanctions

Sanctioning powers

The Belgian DPA has extensive powers:

• Warnings and formal notices
• Orders for compliance
• Administrative fines up to:
• EUR 10 million or 2% of global turnover (less serious infringements)
• EUR 20 million or 4% of global turnover (most serious infringements)

Examples of recent sanctions

The Belgian DPA has already imposed several significant sanctions on Belgian companies for GDPR non-compliance, particularly for lack of consent, insufficient transparency, or absence of adequate security measures.

Action plan for compliance

Essential steps

Conclusion

Looking to make your company GDPR compliant? LegalBelgique supports you through every step, from the initial audit to full compliance. Our specialized legal advisors help you protect your company and your clients' data.